1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 */
17
18 /**
19 * NOTE
20 * 1) The input to AudioFlinger binder calls are fuzzed in this fuzzer
21 * 2) AudioFlinger crashes due to the fuzzer are detected by the
22 Binder DeathRecipient, where the fuzzer aborts if AudioFlinger dies
23 */
24
25 #include <android_audio_policy_configuration_V7_0-enums.h>
26 #include <android/content/AttributionSourceState.h>
27 #include <binder/IServiceManager.h>
28 #include <binder/MemoryDealer.h>
29 #include <media/AidlConversion.h>
30 #include <media/AudioEffect.h>
31 #include <media/AudioRecord.h>
32 #include <media/AudioSystem.h>
33 #include <media/AudioTrack.h>
34 #include <media/IAudioFlinger.h>
35 #include "fuzzer/FuzzedDataProvider.h"
36
37 #define MAX_STRING_LENGTH 256
38 #define MAX_ARRAY_LENGTH 256
39
40 constexpr int32_t kMinSampleRateHz = 4000;
41 constexpr int32_t kMaxSampleRateHz = 192000;
42 constexpr int32_t kSampleRateUnspecified = 0;
43
44 using namespace std;
45 using namespace android;
46
47 namespace xsd {
48 using namespace ::android::audio::policy::configuration::V7_0;
49 }
50
51 using android::content::AttributionSourceState;
52
53 constexpr audio_unique_id_use_t kUniqueIds[] = {
54 AUDIO_UNIQUE_ID_USE_UNSPECIFIED, AUDIO_UNIQUE_ID_USE_SESSION, AUDIO_UNIQUE_ID_USE_MODULE,
55 AUDIO_UNIQUE_ID_USE_EFFECT, AUDIO_UNIQUE_ID_USE_PATCH, AUDIO_UNIQUE_ID_USE_OUTPUT,
56 AUDIO_UNIQUE_ID_USE_INPUT, AUDIO_UNIQUE_ID_USE_CLIENT, AUDIO_UNIQUE_ID_USE_MAX,
57 };
58
59 constexpr audio_mode_t kModes[] = {
60 AUDIO_MODE_INVALID, AUDIO_MODE_CURRENT, AUDIO_MODE_NORMAL, AUDIO_MODE_RINGTONE,
61 AUDIO_MODE_IN_CALL, AUDIO_MODE_IN_COMMUNICATION, AUDIO_MODE_CALL_SCREEN};
62
63 constexpr audio_session_t kSessionId[] = {AUDIO_SESSION_NONE, AUDIO_SESSION_OUTPUT_STAGE,
64 AUDIO_SESSION_DEVICE};
65
66 constexpr audio_encapsulation_mode_t kEncapsulation[] = {
67 AUDIO_ENCAPSULATION_MODE_NONE,
68 AUDIO_ENCAPSULATION_MODE_ELEMENTARY_STREAM,
69 AUDIO_ENCAPSULATION_MODE_HANDLE,
70 };
71
72 constexpr audio_port_role_t kPortRoles[] = {
73 AUDIO_PORT_ROLE_NONE,
74 AUDIO_PORT_ROLE_SOURCE,
75 AUDIO_PORT_ROLE_SINK,
76 };
77
78 constexpr audio_port_type_t kPortTypes[] = {
79 AUDIO_PORT_TYPE_NONE,
80 AUDIO_PORT_TYPE_DEVICE,
81 AUDIO_PORT_TYPE_MIX,
82 AUDIO_PORT_TYPE_SESSION,
83 };
84
85 template <typename T, typename X, typename FUNC>
getFlags(const xsdc_enum_range<X> & range,const FUNC & func,const std::string & findString={})86 std::vector<T> getFlags(const xsdc_enum_range<X> &range, const FUNC &func,
87 const std::string &findString = {}) {
88 std::vector<T> vec;
89 for (const auto &xsdEnumVal : range) {
90 T enumVal;
91 std::string enumString = toString(xsdEnumVal);
92 if (enumString.find(findString) != std::string::npos &&
93 func(enumString.c_str(), &enumVal)) {
94 vec.push_back(enumVal);
95 }
96 }
97 return vec;
98 }
99
100 static const std::vector<audio_stream_type_t> kStreamtypes =
101 getFlags<audio_stream_type_t, xsd::AudioStreamType, decltype(audio_stream_type_from_string)>(
102 xsdc_enum_range<xsd::AudioStreamType>{}, audio_stream_type_from_string);
103
104 static const std::vector<audio_format_t> kFormats =
105 getFlags<audio_format_t, xsd::AudioFormat, decltype(audio_format_from_string)>(
106 xsdc_enum_range<xsd::AudioFormat>{}, audio_format_from_string);
107
108 static const std::vector<audio_channel_mask_t> kChannelMasks =
109 getFlags<audio_channel_mask_t, xsd::AudioChannelMask, decltype(audio_channel_mask_from_string)>(
110 xsdc_enum_range<xsd::AudioChannelMask>{}, audio_channel_mask_from_string);
111
112 static const std::vector<audio_usage_t> kUsages =
113 getFlags<audio_usage_t, xsd::AudioUsage, decltype(audio_usage_from_string)>(
114 xsdc_enum_range<xsd::AudioUsage>{}, audio_usage_from_string);
115
116 static const std::vector<audio_content_type_t> kContentType =
117 getFlags<audio_content_type_t, xsd::AudioContentType, decltype(audio_content_type_from_string)>(
118 xsdc_enum_range<xsd::AudioContentType>{}, audio_content_type_from_string);
119
120 static const std::vector<audio_source_t> kInputSources =
121 getFlags<audio_source_t, xsd::AudioSource, decltype(audio_source_from_string)>(
122 xsdc_enum_range<xsd::AudioSource>{}, audio_source_from_string);
123
124 static const std::vector<audio_gain_mode_t> kGainModes =
125 getFlags<audio_gain_mode_t, xsd::AudioGainMode, decltype(audio_gain_mode_from_string)>(
126 xsdc_enum_range<xsd::AudioGainMode>{}, audio_gain_mode_from_string);
127
128 static const std::vector<audio_devices_t> kDevices =
129 getFlags<audio_devices_t, xsd::AudioDevice, decltype(audio_device_from_string)>(
130 xsdc_enum_range<xsd::AudioDevice>{}, audio_device_from_string);
131
132 static const std::vector<audio_input_flags_t> kInputFlags =
133 getFlags<audio_input_flags_t, xsd::AudioInOutFlag, decltype(audio_input_flag_from_string)>(
134 xsdc_enum_range<xsd::AudioInOutFlag>{}, audio_input_flag_from_string, "_INPUT_");
135
136 static const std::vector<audio_output_flags_t> kOutputFlags =
137 getFlags<audio_output_flags_t, xsd::AudioInOutFlag, decltype(audio_output_flag_from_string)>(
138 xsdc_enum_range<xsd::AudioInOutFlag>{}, audio_output_flag_from_string, "_OUTPUT_");
139
140 template <typename T, size_t size>
getValue(FuzzedDataProvider * fdp,const T (& arr)[size])141 T getValue(FuzzedDataProvider *fdp, const T (&arr)[size]) {
142 return arr[fdp->ConsumeIntegralInRange<int32_t>(0, size - 1)];
143 }
144
145 template <typename T>
getValue(FuzzedDataProvider * fdp,std::vector<T> vec)146 T getValue(FuzzedDataProvider *fdp, std::vector<T> vec) {
147 return vec[fdp->ConsumeIntegralInRange<int32_t>(0, vec.size() - 1)];
148 }
149
getSampleRate(FuzzedDataProvider * fdp)150 int32_t getSampleRate(FuzzedDataProvider *fdp) {
151 if (fdp->ConsumeBool()) {
152 return fdp->ConsumeIntegralInRange<int32_t>(kMinSampleRateHz, kMaxSampleRateHz);
153 }
154 return kSampleRateUnspecified;
155 }
156
157 class DeathNotifier : public IBinder::DeathRecipient {
158 public:
binderDied(const wp<IBinder> &)159 void binderDied(const wp<IBinder> &) { abort(); }
160 };
161
162 class AudioFlingerFuzzer {
163 public:
164 AudioFlingerFuzzer(const uint8_t *data, size_t size);
165 void process();
166
167 private:
168 FuzzedDataProvider mFdp;
169 void invokeAudioTrack();
170 void invokeAudioRecord();
171 status_t invokeAudioEffect();
172 void invokeAudioSystem();
173 status_t invokeAudioInputDevice();
174 status_t invokeAudioOutputDevice();
175 void invokeAudioPatch();
176
177 sp<DeathNotifier> mDeathNotifier;
178 };
179
AudioFlingerFuzzer(const uint8_t * data,size_t size)180 AudioFlingerFuzzer::AudioFlingerFuzzer(const uint8_t *data, size_t size) : mFdp(data, size) {
181 sp<IServiceManager> sm = defaultServiceManager();
182 sp<IBinder> binder = sm->getService(String16("media.audio_flinger"));
183 if (binder == nullptr) {
184 return;
185 }
186 mDeathNotifier = new DeathNotifier();
187 binder->linkToDeath(mDeathNotifier);
188 }
189
invokeAudioTrack()190 void AudioFlingerFuzzer::invokeAudioTrack() {
191 uint32_t sampleRate = getSampleRate(&mFdp);
192 audio_format_t format = getValue(&mFdp, kFormats);
193 audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
194 size_t frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
195 int32_t notificationFrames = mFdp.ConsumeIntegral<int32_t>();
196 uint32_t useSharedBuffer = mFdp.ConsumeBool();
197 audio_output_flags_t flags = getValue(&mFdp, kOutputFlags);
198 audio_session_t sessionId = getValue(&mFdp, kSessionId);
199 audio_usage_t usage = getValue(&mFdp, kUsages);
200 audio_content_type_t contentType = getValue(&mFdp, kContentType);
201 audio_attributes_t attributes = {};
202 sp<IMemory> sharedBuffer;
203 sp<MemoryDealer> heap = nullptr;
204 audio_offload_info_t offloadInfo = AUDIO_INFO_INITIALIZER;
205
206 bool offload = false;
207 bool fast = ((flags & AUDIO_OUTPUT_FLAG_FAST) != 0);
208
209 if (useSharedBuffer != 0) {
210 size_t heapSize = audio_channel_count_from_out_mask(channelMask) *
211 audio_bytes_per_sample(format) * frameCount;
212 heap = new MemoryDealer(heapSize, "AudioTrack Heap Base");
213 sharedBuffer = heap->allocate(heapSize);
214 frameCount = 0;
215 notificationFrames = 0;
216 }
217 if ((flags & AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD) != 0) {
218 offloadInfo.sample_rate = sampleRate;
219 offloadInfo.channel_mask = channelMask;
220 offloadInfo.format = format;
221 offload = true;
222 }
223
224 attributes.content_type = contentType;
225 attributes.usage = usage;
226 sp<AudioTrack> track = new AudioTrack();
227
228 // TODO b/182392769: use attribution source util
229 AttributionSourceState attributionSource;
230 attributionSource.uid = VALUE_OR_FATAL(legacy2aidl_uid_t_int32_t(getuid()));
231 attributionSource.pid = VALUE_OR_FATAL(legacy2aidl_pid_t_int32_t(getpid()));
232 attributionSource.token = sp<BBinder>::make();
233 track->set(AUDIO_STREAM_DEFAULT, sampleRate, format, channelMask, frameCount, flags, nullptr,
234 nullptr, notificationFrames, sharedBuffer, false, sessionId,
235 ((fast && sharedBuffer == 0) || offload) ? AudioTrack::TRANSFER_CALLBACK
236 : AudioTrack::TRANSFER_DEFAULT,
237 offload ? &offloadInfo : nullptr, attributionSource, &attributes, false, 1.0f,
238 AUDIO_PORT_HANDLE_NONE);
239
240 status_t status = track->initCheck();
241 if (status != NO_ERROR) {
242 track.clear();
243 return;
244 }
245 track->getSampleRate();
246 track->latency();
247 track->getUnderrunCount();
248 track->streamType();
249 track->channelCount();
250 track->getNotificationPeriodInFrames();
251 uint32_t bufferSizeInFrames = mFdp.ConsumeIntegral<uint32_t>();
252 track->setBufferSizeInFrames(bufferSizeInFrames);
253 track->getBufferSizeInFrames();
254
255 int64_t duration = mFdp.ConsumeIntegral<int64_t>();
256 track->getBufferDurationInUs(&duration);
257 sp<IMemory> sharedBuffer2 = track->sharedBuffer();
258 track->setCallerName(mFdp.ConsumeRandomLengthString(MAX_STRING_LENGTH));
259
260 track->setVolume(mFdp.ConsumeFloatingPoint<float>(), mFdp.ConsumeFloatingPoint<float>());
261 track->setVolume(mFdp.ConsumeFloatingPoint<float>());
262 track->setAuxEffectSendLevel(mFdp.ConsumeFloatingPoint<float>());
263
264 float auxEffectSendLevel;
265 track->getAuxEffectSendLevel(&auxEffectSendLevel);
266 track->setSampleRate(getSampleRate(&mFdp));
267 track->getSampleRate();
268 track->getOriginalSampleRate();
269
270 AudioPlaybackRate playbackRate = {};
271 playbackRate.mSpeed = mFdp.ConsumeFloatingPoint<float>();
272 playbackRate.mPitch = mFdp.ConsumeFloatingPoint<float>();
273 track->setPlaybackRate(playbackRate);
274 track->getPlaybackRate();
275 track->setLoop(mFdp.ConsumeIntegral<uint32_t>(), mFdp.ConsumeIntegral<uint32_t>(),
276 mFdp.ConsumeIntegral<uint32_t>());
277 track->setMarkerPosition(mFdp.ConsumeIntegral<uint32_t>());
278
279 uint32_t marker = {};
280 track->getMarkerPosition(&marker);
281 track->setPositionUpdatePeriod(mFdp.ConsumeIntegral<uint32_t>());
282
283 uint32_t updatePeriod = {};
284 track->getPositionUpdatePeriod(&updatePeriod);
285 track->setPosition(mFdp.ConsumeIntegral<uint32_t>());
286 uint32_t position = {};
287 track->getPosition(&position);
288 track->getBufferPosition(&position);
289 track->reload();
290 track->start();
291 track->pause();
292 track->flush();
293 track->stop();
294 track->stopped();
295 }
296
invokeAudioRecord()297 void AudioFlingerFuzzer::invokeAudioRecord() {
298 int32_t notificationFrames = mFdp.ConsumeIntegral<int32_t>();
299 uint32_t sampleRate = getSampleRate(&mFdp);
300 size_t frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
301 audio_format_t format = getValue(&mFdp, kFormats);
302 audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
303 audio_input_flags_t flags = getValue(&mFdp, kInputFlags);
304 audio_session_t sessionId = getValue(&mFdp, kSessionId);
305 audio_source_t inputSource = getValue(&mFdp, kInputSources);
306
307 audio_attributes_t attributes = {};
308 bool fast = ((flags & AUDIO_OUTPUT_FLAG_FAST) != 0);
309
310 attributes.source = inputSource;
311
312 // TODO b/182392769: use attribution source util
313 AttributionSourceState attributionSource;
314 attributionSource.packageName = std::string(mFdp.ConsumeRandomLengthString().c_str());
315 attributionSource.token = sp<BBinder>::make();
316 sp<AudioRecord> record = new AudioRecord(attributionSource);
317 record->set(AUDIO_SOURCE_DEFAULT, sampleRate, format, channelMask, frameCount, nullptr, nullptr,
318 notificationFrames, false, sessionId,
319 fast ? AudioRecord::TRANSFER_CALLBACK : AudioRecord::TRANSFER_DEFAULT, flags,
320 getuid(), getpid(), &attributes, AUDIO_PORT_HANDLE_NONE);
321 status_t status = record->initCheck();
322 if (status != NO_ERROR) {
323 return;
324 }
325 record->latency();
326 record->format();
327 record->channelCount();
328 record->frameCount();
329 record->frameSize();
330 record->inputSource();
331 record->getNotificationPeriodInFrames();
332 record->start();
333 record->stop();
334 record->stopped();
335
336 uint32_t marker = mFdp.ConsumeIntegral<uint32_t>();
337 record->setMarkerPosition(marker);
338 record->getMarkerPosition(&marker);
339
340 uint32_t updatePeriod = mFdp.ConsumeIntegral<uint32_t>();
341 record->setPositionUpdatePeriod(updatePeriod);
342 record->getPositionUpdatePeriod(&updatePeriod);
343
344 uint32_t position;
345 record->getPosition(&position);
346
347 ExtendedTimestamp timestamp;
348 record->getTimestamp(×tamp);
349 record->getSessionId();
350 record->getCallerName();
351 android::AudioRecord::Buffer audioBuffer;
352 int32_t waitCount = mFdp.ConsumeIntegral<int32_t>();
353 size_t nonContig = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
354 audioBuffer.frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
355 record->obtainBuffer(&audioBuffer, waitCount, &nonContig);
356 bool blocking = false;
357 record->read(audioBuffer.raw, audioBuffer.size, blocking);
358 record->getInputFramesLost();
359 record->getFlags();
360
361 std::vector<media::MicrophoneInfo> activeMicrophones;
362 record->getActiveMicrophones(&activeMicrophones);
363 record->releaseBuffer(&audioBuffer);
364
365 audio_port_handle_t deviceId =
366 static_cast<audio_port_handle_t>(mFdp.ConsumeIntegral<int32_t>());
367 record->setInputDevice(deviceId);
368 record->getInputDevice();
369 record->getRoutedDeviceId();
370 record->getPortId();
371 }
372
373 struct EffectClient : public android::media::BnEffectClient {
EffectClientEffectClient374 EffectClient() {}
controlStatusChangedEffectClient375 binder::Status controlStatusChanged(bool controlGranted __unused) override {
376 return binder::Status::ok();
377 }
enableStatusChangedEffectClient378 binder::Status enableStatusChanged(bool enabled __unused) override {
379 return binder::Status::ok();
380 }
commandExecutedEffectClient381 binder::Status commandExecuted(int32_t cmdCode __unused,
382 const std::vector<uint8_t> &cmdData __unused,
383 const std::vector<uint8_t> &replyData __unused) override {
384 return binder::Status::ok();
385 }
386 };
387
invokeAudioEffect()388 status_t AudioFlingerFuzzer::invokeAudioEffect() {
389 effect_uuid_t type;
390 type.timeLow = mFdp.ConsumeIntegral<uint32_t>();
391 type.timeMid = mFdp.ConsumeIntegral<uint16_t>();
392 type.timeHiAndVersion = mFdp.ConsumeIntegral<uint16_t>();
393 type.clockSeq = mFdp.ConsumeIntegral<uint16_t>();
394 for (int i = 0; i < 6; ++i) {
395 type.node[i] = mFdp.ConsumeIntegral<uint8_t>();
396 }
397
398 effect_descriptor_t descriptor = {};
399 descriptor.type = type;
400 descriptor.uuid = *EFFECT_UUID_NULL;
401
402 sp<EffectClient> effectClient(new EffectClient());
403
404 const int32_t priority = mFdp.ConsumeIntegral<int32_t>();
405 audio_session_t sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
406 const audio_io_handle_t io = mFdp.ConsumeIntegral<int32_t>();
407 std::string opPackageName = static_cast<std::string>(mFdp.ConsumeRandomLengthString().c_str());
408 AudioDeviceTypeAddr device;
409
410 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
411 if (!af) {
412 return NO_ERROR;
413 }
414
415 media::CreateEffectRequest request{};
416 request.desc =
417 VALUE_OR_RETURN_STATUS(legacy2aidl_effect_descriptor_t_EffectDescriptor(descriptor));
418 request.client = effectClient;
419 request.priority = priority;
420 request.output = io;
421 request.sessionId = sessionId;
422 request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_AudioDeviceTypeAddress(device));
423 // TODO b/182392769: use attribution source util
424 request.attributionSource.packageName = opPackageName;
425 request.attributionSource.pid = VALUE_OR_RETURN_STATUS(legacy2aidl_pid_t_int32_t(getpid()));
426 request.probe = false;
427
428 media::CreateEffectResponse response{};
429 status_t status = af->createEffect(request, &response);
430
431 if (status != OK) {
432 return NO_ERROR;
433 }
434
435 descriptor =
436 VALUE_OR_RETURN_STATUS(aidl2legacy_EffectDescriptor_effect_descriptor_t(response.desc));
437
438 uint32_t numEffects;
439 af->queryNumberEffects(&numEffects);
440
441 uint32_t queryIndex = mFdp.ConsumeIntegral<uint32_t>();
442 af->queryEffect(queryIndex, &descriptor);
443
444 effect_descriptor_t getDescriptor;
445 uint32_t preferredTypeFlag = mFdp.ConsumeIntegral<int32_t>();
446 af->getEffectDescriptor(&descriptor.uuid, &descriptor.type, preferredTypeFlag, &getDescriptor);
447
448 sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
449 audio_io_handle_t srcOutput = mFdp.ConsumeIntegral<int32_t>();
450 audio_io_handle_t dstOutput = mFdp.ConsumeIntegral<int32_t>();
451 af->moveEffects(sessionId, srcOutput, dstOutput);
452
453 int effectId = mFdp.ConsumeIntegral<int32_t>();
454 sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
455 af->setEffectSuspended(effectId, sessionId, mFdp.ConsumeBool());
456 return NO_ERROR;
457 }
458
invokeAudioSystem()459 void AudioFlingerFuzzer::invokeAudioSystem() {
460 AudioSystem::muteMicrophone(mFdp.ConsumeBool());
461 AudioSystem::setMasterMute(mFdp.ConsumeBool());
462 AudioSystem::setMasterVolume(mFdp.ConsumeFloatingPoint<float>());
463 AudioSystem::setMasterBalance(mFdp.ConsumeFloatingPoint<float>());
464 AudioSystem::setVoiceVolume(mFdp.ConsumeFloatingPoint<float>());
465
466 float volume;
467 AudioSystem::getMasterVolume(&volume);
468
469 bool state;
470 AudioSystem::getMasterMute(&state);
471 AudioSystem::isMicrophoneMuted(&state);
472
473 audio_stream_type_t stream = getValue(&mFdp, kStreamtypes);
474 AudioSystem::setStreamMute(getValue(&mFdp, kStreamtypes), mFdp.ConsumeBool());
475
476 stream = getValue(&mFdp, kStreamtypes);
477 AudioSystem::setStreamVolume(stream, mFdp.ConsumeFloatingPoint<float>(),
478 mFdp.ConsumeIntegral<int32_t>());
479
480 audio_mode_t mode = getValue(&mFdp, kModes);
481 AudioSystem::setMode(mode);
482
483 size_t frameCount;
484 stream = getValue(&mFdp, kStreamtypes);
485 AudioSystem::getOutputFrameCount(&frameCount, stream);
486
487 uint32_t latency;
488 stream = getValue(&mFdp, kStreamtypes);
489 AudioSystem::getOutputLatency(&latency, stream);
490
491 stream = getValue(&mFdp, kStreamtypes);
492 AudioSystem::getStreamVolume(stream, &volume, mFdp.ConsumeIntegral<int32_t>());
493
494 stream = getValue(&mFdp, kStreamtypes);
495 AudioSystem::getStreamMute(stream, &state);
496
497 uint32_t samplingRate;
498 AudioSystem::getSamplingRate(mFdp.ConsumeIntegral<int32_t>(), &samplingRate);
499
500 AudioSystem::getFrameCount(mFdp.ConsumeIntegral<int32_t>(), &frameCount);
501 AudioSystem::getLatency(mFdp.ConsumeIntegral<int32_t>(), &latency);
502 AudioSystem::setVoiceVolume(mFdp.ConsumeFloatingPoint<float>());
503
504 uint32_t halFrames;
505 uint32_t dspFrames;
506 AudioSystem::getRenderPosition(mFdp.ConsumeIntegral<int32_t>(), &halFrames, &dspFrames);
507
508 AudioSystem::getInputFramesLost(mFdp.ConsumeIntegral<int32_t>());
509 AudioSystem::getInputFramesLost(mFdp.ConsumeIntegral<int32_t>());
510
511 audio_unique_id_use_t uniqueIdUse = getValue(&mFdp, kUniqueIds);
512 AudioSystem::newAudioUniqueId(uniqueIdUse);
513
514 audio_session_t sessionId = getValue(&mFdp, kSessionId);
515 pid_t pid = mFdp.ConsumeBool() ? getpid() : mFdp.ConsumeIntegral<int32_t>();
516 uid_t uid = mFdp.ConsumeBool() ? getuid() : mFdp.ConsumeIntegral<int32_t>();
517 AudioSystem::acquireAudioSessionId(sessionId, pid, uid);
518
519 pid = mFdp.ConsumeBool() ? getpid() : mFdp.ConsumeIntegral<int32_t>();
520 sessionId = getValue(&mFdp, kSessionId);
521 AudioSystem::releaseAudioSessionId(sessionId, pid);
522
523 sessionId = getValue(&mFdp, kSessionId);
524 AudioSystem::getAudioHwSyncForSession(sessionId);
525
526 AudioSystem::systemReady();
527 AudioSystem::getFrameCountHAL(mFdp.ConsumeIntegral<int32_t>(), &frameCount);
528
529 size_t buffSize;
530 uint32_t sampleRate = getSampleRate(&mFdp);
531 audio_format_t format = getValue(&mFdp, kFormats);
532 audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
533 AudioSystem::getInputBufferSize(sampleRate, format, channelMask, &buffSize);
534
535 AudioSystem::getPrimaryOutputSamplingRate();
536 AudioSystem::getPrimaryOutputFrameCount();
537 AudioSystem::setLowRamDevice(mFdp.ConsumeBool(), mFdp.ConsumeIntegral<int64_t>());
538
539 std::vector<media::MicrophoneInfo> microphones;
540 AudioSystem::getMicrophones(µphones);
541
542 std::vector<pid_t> pids;
543 pids.insert(pids.begin(), getpid());
544 for (int i = 1; i < mFdp.ConsumeIntegralInRange<int32_t>(2, MAX_ARRAY_LENGTH); ++i) {
545 pids.insert(pids.begin() + i, static_cast<pid_t>(mFdp.ConsumeIntegral<int32_t>()));
546 }
547 AudioSystem::setAudioHalPids(pids);
548 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
549 if (!af) {
550 return;
551 }
552 af->setRecordSilenced(mFdp.ConsumeIntegral<uint32_t>(), mFdp.ConsumeBool());
553
554 float balance = mFdp.ConsumeFloatingPoint<float>();
555 af->getMasterBalance(&balance);
556 af->invalidateStream(static_cast<audio_stream_type_t>(mFdp.ConsumeIntegral<uint32_t>()));
557 }
558
invokeAudioInputDevice()559 status_t AudioFlingerFuzzer::invokeAudioInputDevice() {
560 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
561 if (!af) {
562 return NO_ERROR;
563 }
564
565 audio_config_t config = {};
566 audio_module_handle_t module = mFdp.ConsumeIntegral<int32_t>();
567 audio_io_handle_t input = mFdp.ConsumeIntegral<int32_t>();
568 config.frame_count = mFdp.ConsumeIntegral<uint32_t>();
569 String8 address = static_cast<String8>(mFdp.ConsumeRandomLengthString().c_str());
570
571 config.channel_mask = getValue(&mFdp, kChannelMasks);
572 config.format = getValue(&mFdp, kFormats);
573
574 config.offload_info = AUDIO_INFO_INITIALIZER;
575 config.offload_info.bit_rate = mFdp.ConsumeIntegral<uint32_t>();
576 config.offload_info.bit_width = mFdp.ConsumeIntegral<uint32_t>();
577 config.offload_info.content_id = mFdp.ConsumeIntegral<uint32_t>();
578 config.offload_info.channel_mask = getValue(&mFdp, kChannelMasks);
579 config.offload_info.duration_us = mFdp.ConsumeIntegral<int64_t>();
580 config.offload_info.encapsulation_mode = getValue(&mFdp, kEncapsulation);
581 config.offload_info.format = getValue(&mFdp, kFormats);
582 config.offload_info.has_video = mFdp.ConsumeBool();
583 config.offload_info.is_streaming = mFdp.ConsumeBool();
584 config.offload_info.sample_rate = getSampleRate(&mFdp);
585 config.offload_info.sync_id = mFdp.ConsumeIntegral<uint32_t>();
586 config.offload_info.stream_type = getValue(&mFdp, kStreamtypes);
587 config.offload_info.usage = getValue(&mFdp, kUsages);
588
589 config.sample_rate = getSampleRate(&mFdp);
590
591 audio_devices_t device = getValue(&mFdp, kDevices);
592 audio_source_t source = getValue(&mFdp, kInputSources);
593 audio_input_flags_t flags = getValue(&mFdp, kInputFlags);
594
595 AudioDeviceTypeAddr deviceTypeAddr(device, address.c_str());
596
597 media::OpenInputRequest request{};
598 request.module = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_module_handle_t_int32_t(module));
599 request.input = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_io_handle_t_int32_t(input));
600 request.config = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_config_t_AudioConfig(config));
601 request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_AudioDeviceTypeAddress(deviceTypeAddr));
602 request.source = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_source_t_AudioSourceType(source));
603 request.flags = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_input_flags_t_int32_t_mask(flags));
604
605 media::OpenInputResponse response{};
606 status_t status = af->openInput(request, &response);
607 if (status != NO_ERROR) {
608 return NO_ERROR;
609 }
610
611 input = VALUE_OR_RETURN_STATUS(aidl2legacy_int32_t_audio_module_handle_t(response.input));
612 af->closeInput(input);
613 return NO_ERROR;
614 }
615
invokeAudioOutputDevice()616 status_t AudioFlingerFuzzer::invokeAudioOutputDevice() {
617 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
618 if (!af) {
619 return NO_ERROR;
620 }
621
622 audio_config_t config = {};
623 audio_module_handle_t module = mFdp.ConsumeIntegral<int32_t>();
624 audio_io_handle_t output = mFdp.ConsumeIntegral<int32_t>();
625 config.frame_count = mFdp.ConsumeIntegral<uint32_t>();
626 String8 address = static_cast<String8>(mFdp.ConsumeRandomLengthString().c_str());
627
628 config.channel_mask = getValue(&mFdp, kChannelMasks);
629
630 config.offload_info = AUDIO_INFO_INITIALIZER;
631 config.offload_info.bit_rate = mFdp.ConsumeIntegral<uint32_t>();
632 config.offload_info.bit_width = mFdp.ConsumeIntegral<uint32_t>();
633 config.offload_info.channel_mask = getValue(&mFdp, kChannelMasks);
634 config.offload_info.content_id = mFdp.ConsumeIntegral<uint32_t>();
635 config.offload_info.duration_us = mFdp.ConsumeIntegral<int64_t>();
636 config.offload_info.encapsulation_mode = getValue(&mFdp, kEncapsulation);
637 config.offload_info.format = getValue(&mFdp, kFormats);
638 config.offload_info.has_video = mFdp.ConsumeBool();
639 config.offload_info.is_streaming = mFdp.ConsumeBool();
640 config.offload_info.sample_rate = getSampleRate(&mFdp);
641 config.offload_info.stream_type = getValue(&mFdp, kStreamtypes);
642 config.offload_info.sync_id = mFdp.ConsumeIntegral<uint32_t>();
643 config.offload_info.usage = getValue(&mFdp, kUsages);
644
645 config.format = getValue(&mFdp, kFormats);
646 config.sample_rate = getSampleRate(&mFdp);
647
648 sp<DeviceDescriptorBase> device = new DeviceDescriptorBase(getValue(&mFdp, kDevices));
649 audio_output_flags_t flags = getValue(&mFdp, kOutputFlags);
650
651 media::OpenOutputRequest request{};
652 media::OpenOutputResponse response{};
653
654 request.module = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_module_handle_t_int32_t(module));
655 request.config = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_config_t_AudioConfig(config));
656 request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_DeviceDescriptorBase(device));
657 request.flags = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_output_flags_t_int32_t_mask(flags));
658
659 status_t status = af->openOutput(request, &response);
660 if (status != NO_ERROR) {
661 return NO_ERROR;
662 }
663 output = VALUE_OR_RETURN_STATUS(aidl2legacy_int32_t_audio_io_handle_t(response.output));
664
665 audio_io_handle_t output1 = mFdp.ConsumeIntegral<int32_t>();
666 af->openDuplicateOutput(output, output1);
667 af->suspendOutput(output);
668 af->restoreOutput(output);
669 af->closeOutput(output);
670 return NO_ERROR;
671 }
672
invokeAudioPatch()673 void AudioFlingerFuzzer::invokeAudioPatch() {
674 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
675 if (!af) {
676 return;
677 }
678 struct audio_patch patch = {};
679 audio_patch_handle_t handle = mFdp.ConsumeIntegral<int32_t>();
680
681 patch.id = mFdp.ConsumeIntegral<int32_t>();
682 patch.num_sources = mFdp.ConsumeIntegral<uint32_t>();
683 patch.num_sinks = mFdp.ConsumeIntegral<uint32_t>();
684
685 for (int i = 0; i < AUDIO_PATCH_PORTS_MAX; ++i) {
686 patch.sources[i].config_mask = mFdp.ConsumeIntegral<uint32_t>();
687 patch.sources[i].channel_mask = getValue(&mFdp, kChannelMasks);
688 patch.sources[i].format = getValue(&mFdp, kFormats);
689 patch.sources[i].gain.channel_mask = getValue(&mFdp, kChannelMasks);
690 patch.sources[i].gain.index = mFdp.ConsumeIntegral<int32_t>();
691 patch.sources[i].gain.mode = getValue(&mFdp, kGainModes);
692 patch.sources[i].gain.ramp_duration_ms = mFdp.ConsumeIntegral<uint32_t>();
693 patch.sources[i].id = static_cast<audio_format_t>(mFdp.ConsumeIntegral<int32_t>());
694 patch.sources[i].role = getValue(&mFdp, kPortRoles);
695 patch.sources[i].sample_rate = getSampleRate(&mFdp);
696 patch.sources[i].type = getValue(&mFdp, kPortTypes);
697
698 patch.sinks[i].config_mask = mFdp.ConsumeIntegral<uint32_t>();
699 patch.sinks[i].channel_mask = getValue(&mFdp, kChannelMasks);
700 patch.sinks[i].format = getValue(&mFdp, kFormats);
701 patch.sinks[i].gain.channel_mask = getValue(&mFdp, kChannelMasks);
702 patch.sinks[i].gain.index = mFdp.ConsumeIntegral<int32_t>();
703 patch.sinks[i].gain.mode = getValue(&mFdp, kGainModes);
704 patch.sinks[i].gain.ramp_duration_ms = mFdp.ConsumeIntegral<uint32_t>();
705 patch.sinks[i].id = static_cast<audio_format_t>(mFdp.ConsumeIntegral<int32_t>());
706 patch.sinks[i].role = getValue(&mFdp, kPortRoles);
707 patch.sinks[i].sample_rate = getSampleRate(&mFdp);
708 patch.sinks[i].type = getValue(&mFdp, kPortTypes);
709 }
710
711 status_t status = af->createAudioPatch(&patch, &handle);
712 if (status != NO_ERROR) {
713 return;
714 }
715
716 unsigned int num_patches = mFdp.ConsumeIntegral<uint32_t>();
717 struct audio_patch patches = {};
718 af->listAudioPatches(&num_patches, &patches);
719 af->releaseAudioPatch(handle);
720 }
721
process()722 void AudioFlingerFuzzer::process() {
723 invokeAudioEffect();
724 invokeAudioInputDevice();
725 invokeAudioOutputDevice();
726 invokeAudioPatch();
727 invokeAudioRecord();
728 invokeAudioSystem();
729 invokeAudioTrack();
730 }
731
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)732 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
733 if (size < 1) {
734 return 0;
735 }
736 AudioFlingerFuzzer audioFuzzer(data, size);
737 audioFuzzer.process();
738 return 0;
739 }
740