1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <vector>
20 #include <memory>
21 #include <queue>
22 #include <string>
23 #undef private
24 #include "hpae_node.h"
25 #include "hpae_pcm_buffer.h"
26 #include "audio_info.h"
27 #include "i_capturer_stream.h"
28 #include "hpae_source_input_node.h"
29 #include "hpae_source_output_node.h"
30 #include "audio_engine_log.h"
31 using namespace std;
32 using namespace OHOS::AudioStandard::HPAE;
33
34
35 namespace OHOS {
36 namespace AudioStandard {
37 using namespace std;
38 static const uint8_t *RAW_DATA = nullptr;
39 static size_t g_dataSize = 0;
40 static size_t g_pos;
41 const size_t THRESHOLD = 10;
42 const uint32_t DEFAULT_FRAME_LENGTH = 960;
43 const uint32_t DEFAULT_NODE_ID = 1243;
44 static vector<HpaeSessionState> sessionStateMap = {
45 HPAE_SESSION_INVALID,
46 HPAE_SESSION_NEW,
47 HPAE_SESSION_PREPARED,
48 HPAE_SESSION_RUNNING,
49 HPAE_SESSION_PAUSING,
50 HPAE_SESSION_PAUSED,
51 HPAE_SESSION_STOPPING,
52 HPAE_SESSION_STOPPED,
53 HPAE_SESSION_RELEASED,
54 };
55 typedef void (*TestPtr)(const uint8_t *, size_t);
56
57 template<class T>
GetData()58 T GetData()
59 {
60 T object {};
61 size_t objectSize = sizeof(object);
62 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
63 return object;
64 }
65 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
66 if (ret != EOK) {
67 return {};
68 }
69 g_pos += objectSize;
70 return object;
71 }
72
73 template<class T>
GetArrLength(T & arr)74 uint32_t GetArrLength(T& arr)
75 {
76 if (arr == nullptr) {
77 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
78 return 0;
79 }
80 return sizeof(arr) / sizeof(arr[0]);
81 }
82
GetTestNodeInfo(HpaeNodeInfo & nodeInfo)83 static void GetTestNodeInfo(HpaeNodeInfo &nodeInfo)
84 {
85 nodeInfo.nodeId = DEFAULT_NODE_ID;
86 nodeInfo.frameLen = DEFAULT_FRAME_LENGTH;
87 nodeInfo.samplingRate = SAMPLE_RATE_48000;
88 nodeInfo.channels = STEREO;
89 nodeInfo.format = SAMPLE_S16LE;
90 nodeInfo.sceneType = HPAE_SCENE_RECORD;
91 nodeInfo.sourceBufferType = HPAE_SOURCE_BUFFER_TYPE_MIC;
92 }
93
DoProcessFuzzTest()94 void DoProcessFuzzTest()
95 {
96 HpaeNodeInfo nodeInfo;
97 GetTestNodeInfo(nodeInfo);
98 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
99 hpaeSourceOutputNode->DoProcess();
100 }
101
ResetFuzzTest()102 void ResetFuzzTest()
103 {
104 HpaeNodeInfo nodeInfo;
105 GetTestNodeInfo(nodeInfo);
106 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
107 hpaeSourceOutputNode->Reset();
108 }
109
ResetAllFuzzTest()110 void ResetAllFuzzTest()
111 {
112 HpaeNodeInfo nodeInfo;
113 GetTestNodeInfo(nodeInfo);
114 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
115 hpaeSourceOutputNode->ResetAll();
116 }
117
ConnectFuzzTest()118 void ConnectFuzzTest()
119 {
120 HpaeNodeInfo nodeInfo;
121 GetTestNodeInfo(nodeInfo);
122 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
123 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
124 hpaeSourceOutputNode->Connect(hpaeSourceInputNode);
125 hpaeSourceOutputNode->DisConnect(hpaeSourceInputNode);
126 }
127
ConnectWithInfoFuzzTest()128 void ConnectWithInfoFuzzTest()
129 {
130 HpaeNodeInfo nodeInfo;
131 GetTestNodeInfo(nodeInfo);
132 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
133 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
134 hpaeSourceOutputNode->ConnectWithInfo(hpaeSourceInputNode, nodeInfo);
135 hpaeSourceOutputNode->DisConnectWithInfo(hpaeSourceInputNode, nodeInfo);
136 }
137
DisConnectFuzzTest()138 void DisConnectFuzzTest()
139 {
140 HpaeNodeInfo nodeInfo;
141 GetTestNodeInfo(nodeInfo);
142 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
143 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
144 hpaeSourceOutputNode->DisConnect(hpaeSourceInputNode);
145 }
146
DisConnectWithInfoFuzzTest()147 void DisConnectWithInfoFuzzTest()
148 {
149 HpaeNodeInfo nodeInfo;
150 GetTestNodeInfo(nodeInfo);
151 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
152 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
153 hpaeSourceOutputNode->DisConnectWithInfo(hpaeSourceInputNode, nodeInfo);
154 }
155
SetStateFuzzTest()156 void SetStateFuzzTest()
157 {
158 HpaeNodeInfo nodeInfo;
159 GetTestNodeInfo(nodeInfo);
160 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
161 uint32_t index = GetData<uint32_t>() % sessionStateMap.size();
162 HpaeSessionState captureState = sessionStateMap[index];
163 hpaeSourceOutputNode->SetState(captureState);
164 }
165
GetStateFuzzTest()166 void GetStateFuzzTest()
167 {
168 HpaeNodeInfo nodeInfo;
169 GetTestNodeInfo(nodeInfo);
170 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
171 hpaeSourceOutputNode->GetState();
172 }
173
SetAppUidFuzzTest()174 void SetAppUidFuzzTest()
175 {
176 HpaeNodeInfo nodeInfo;
177 GetTestNodeInfo(nodeInfo);
178 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
179 int32_t appUid = GetData<int32_t>();
180 hpaeSourceOutputNode->SetAppUid(appUid);
181 }
182
GetAppUidFuzzTest()183 void GetAppUidFuzzTest()
184 {
185 HpaeNodeInfo nodeInfo;
186 GetTestNodeInfo(nodeInfo);
187 auto hpaeSourceOutputNode = std::make_shared<HpaeSourceOutputNode>(nodeInfo);
188 hpaeSourceOutputNode->GetAppUid();
189 }
190
191 typedef void (*TestFuncs[11])();
192
193 TestFuncs g_testFuncs = {
194 DoProcessFuzzTest,
195 ResetFuzzTest,
196 ResetAllFuzzTest,
197 ConnectFuzzTest,
198 ConnectWithInfoFuzzTest,
199 DisConnectFuzzTest,
200 DisConnectWithInfoFuzzTest,
201 SetStateFuzzTest,
202 GetStateFuzzTest,
203 SetAppUidFuzzTest,
204 GetAppUidFuzzTest,
205 };
206
FuzzTest(const uint8_t * rawData,size_t size)207 bool FuzzTest(const uint8_t* rawData, size_t size)
208 {
209 if (rawData == nullptr) {
210 return false;
211 }
212
213 // initialize data
214 RAW_DATA = rawData;
215 g_dataSize = size;
216 g_pos = 0;
217
218 uint32_t code = GetData<uint32_t>();
219 uint32_t len = GetArrLength(g_testFuncs);
220 if (len > 0) {
221 g_testFuncs[code % len]();
222 } else {
223 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
224 }
225
226 return true;
227 }
228
229 } // namespace AudioStandard
230 } // namesapce OHOS
231
232 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)233 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
234 {
235 if (size < OHOS::AudioStandard::THRESHOLD) {
236 return 0;
237 }
238
239 OHOS::AudioStandard::FuzzTest(data, size);
240 return 0;
241 }
242