1# Fuzzer for libaaudio 2 3## Plugin Design Considerations 4The fuzzer plugin for `libaaudio` are designed based on the understanding of the 5source code and tries to achieve the following: 6 7##### Maximize code coverage 8The configuration parameters are not hardcoded, but instead selected based on 9incoming data. This ensures more code paths are reached by the fuzzer. 10 11Fuzzers assigns values to the following parameters to pass on to libaaudio: 121. Device Id (parameter name: `deviceId`) 132. Sampling Rate (parameter name: `sampleRate`) 143. Number of channels (parameter name: `channelCount`) 154. Audio Travel Direction (parameter name: `direction`) 165. Audio Format (parameter name: `format`) 176. Audio Sharing Mode (parameter name: `sharingMode`) 187. Audio Usage (parameter name: `usage`) 198. Audio Content type (parameter name: `contentType`) 209. Audio Input Preset (parameter name: `inputPreset`) 2110. Audio Privacy Sensitivity (parameter name: `privacySensitive`) 2211. Buffer Capacity In Frames (parameter name: `frames`) 2312. Performance Mode (parameter name: `mode`) 2413. Allowed Capture Policy (parameter name: `allowedCapturePolicy`) 2514. Session Id (parameter name: `sessionId`) 2615. Frames per Data Callback (parameter name: `framesPerDataCallback`) 2716. MMap Policy (parameter name: `policy`) 28 29| Parameter| Valid Values| Configured Value| 30|------------- |-------------| ----- | 31| `deviceId` | Any value of type `int32_t` | Value obtained from FuzzedDataProvider | 32| `sampleRate` | Any value of type `int32_t` | Value obtained from FuzzedDataProvider | 33| `channelCount` | Any value of type `int32_t` | Value obtained from FuzzedDataProvider | 34| `direction` | 0. `AAUDIO_DIRECTION_OUTPUT` 1. `AAUDIO_DIRECTION_INPUT` | Value obtained from FuzzedDataProvider | 35| `format` | 0. `AAUDIO_FORMAT_INVALID` 1. `AAUDIO_FORMAT_UNSPECIFIED` 2. `AAUDIO_FORMAT_PCM_I16` 3. `AAUDIO_FORMAT_PCM_FLOAT` | Value obtained from FuzzedDataProvider | 36| `sharingMode` | 0. `AAUDIO_SHARING_MODE_EXCLUSIVE` 1. `AAUDIO_SHARING_MODE_SHARED` | Value obtained from FuzzedDataProvider | 37| `usage` | 0. `AAUDIO_USAGE_MEDIA` 1. `AAUDIO_USAGE_VOICE_COMMUNICATION` 2. `AAUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING` 3. `AAUDIO_USAGE_ALARM` 4. `AAUDIO_USAGE_NOTIFICATION` 5. `AAUDIO_USAGE_NOTIFICATION_RINGTONE` 6. `AAUDIO_USAGE_NOTIFICATION_EVENT` 7. `AAUDIO_USAGE_ASSISTANCE_ACCESSIBILITY` 8. `AAUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE` 9. `AAUDIO_USAGE_ASSISTANCE_SONIFICATION` 10. `AAUDIO_USAGE_GAME` 11. `AAUDIO_USAGE_ASSISTANT` 12. `AAUDIO_SYSTEM_USAGE_EMERGENCY` 13. `AAUDIO_SYSTEM_USAGE_SAFETY` 14. `AAUDIO_SYSTEM_USAGE_VEHICLE_STATUS` 15. `AAUDIO_SYSTEM_USAGE_ANNOUNCEMENT` | Value obtained from FuzzedDataProvider | 38| `contentType` | 0. `AAUDIO_CONTENT_TYPE_SPEECH` 1. `AAUDIO_CONTENT_TYPE_MUSIC` 2. `AAUDIO_CONTENT_TYPE_MOVIE` 3. `AAUDIO_CONTENT_TYPE_SONIFICATION` | Value obtained from FuzzedDataProvider | 39| `inputPreset` | 0. `AAUDIO_INPUT_PRESET_GENERIC` 1. `AAUDIO_INPUT_PRESET_CAMCORDER` 2. `AAUDIO_INPUT_PRESET_VOICE_RECOGNITION` 3. `AAUDIO_INPUT_PRESET_VOICE_COMMUNICATION` 4. `AAUDIO_INPUT_PRESET_UNPROCESSED` 5. `AAUDIO_INPUT_PRESET_VOICE_PERFORMANCE` | Value obtained from FuzzedDataProvider | 40| `privacySensitive` | 0. `true` 1. `false` | Value obtained from FuzzedDataProvider | 41| `frames` | Any value of type `int32_t` | Value obtained from FuzzedDataProvider | 42| `mode` | 0. `AAUDIO_PERFORMANCE_MODE_NONE` 1. `AAUDIO_PERFORMANCE_MODE_POWER_SAVING` 2. `AAUDIO_PERFORMANCE_MODE_LOW_LATENCY` | Value obtained from FuzzedDataProvider | 43| `allowedCapturePolicy` | 0. `AAUDIO_ALLOW_CAPTURE_BY_ALL` 1. `AAUDIO_ALLOW_CAPTURE_BY_SYSTEM` 2. `AAUDIO_ALLOW_CAPTURE_BY_NONE` | Value obtained from FuzzedDataProvider | 44| `sessionId` | 0. `AAUDIO_SESSION_ID_NONE` 1. `AAUDIO_SESSION_ID_ALLOCATE` | Value obtained from FuzzedDataProvider | 45| `framesPerDataCallback` | Any value of type `int32_t` | Value obtained from FuzzedDataProvider | 46| `policy` | 0. `AAUDIO_POLICY_NEVER` 1. `AAUDIO_POLICY_AUTO` 2. `AAUDIO_POLICY_ALWAYS` | Value obtained from FuzzedDataProvider | 47 48This also ensures that the plugin is always deterministic for any given input. 49 50##### Maximize utilization of input data 51The plugin feed the entire input data to the module. 52This ensures that the plugins tolerates any kind of input (empty, huge, 53malformed, etc) and doesn't `exit()` on any input and thereby increasing the 54chance of identifying vulnerabilities. 55 56## Build 57 58This describes steps to build libaaudio_fuzzer binary. 59 60### Android 61 62#### Steps to build 63Build the fuzzer 64``` 65 $ mm -j$(nproc) libaaudio_fuzzer 66``` 67### Steps to run 68 69To run on device 70``` 71 $ adb sync data 72 $ adb shell /data/fuzz/arm64/libaaudio_fuzzer/libaaudio_fuzzer 73``` 74 75## References: 76 * http://llvm.org/docs/LibFuzzer.html 77 * https://github.com/google/oss-fuzz 78