1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstddef>
17 #include <cstdint>
18 #include <iostream>
19 #include <memory>
20
21 #include "avsession_item.h"
22 #include "iav_session.h"
23 #include "iremote_stub.h"
24 #include "avsession_stub.h"
25 #include "avsession_callback_proxy.h"
26 #include "avsession_controller_stub.h"
27 #include "avsession_service.h"
28 #include "avsession_errors.h"
29 #include "system_ability_definition.h"
30 #include "avcontrol_command.h"
31 #include "avsessionitem_fuzzer.h"
32
33 using namespace std;
34 namespace OHOS {
35 namespace AVSession {
36 const int32_t MAX_CODE_TEST = 24;
37 const int32_t MAX_CODE_LEN = 512;
38 const int32_t MIN_SIZE_NUM = 4;
39
AvSessionItemFuzzerTest(uint8_t * data,size_t size)40 void AvSessionItemFuzzer::AvSessionItemFuzzerTest(uint8_t* data, size_t size)
41 {
42 if ((data == nullptr) || (size > MAX_CODE_LEN) || (size < MIN_SIZE_NUM)) {
43 return;
44 }
45 uint32_t code = *(reinterpret_cast<const uint32_t*>(data));
46 if (code >= MAX_CODE_TEST) {
47 return;
48 }
49 std::string tag(reinterpret_cast<const char*>(data), size);
50 int32_t type = *reinterpret_cast<const int32_t*>(data);
51 std::string bundleName(reinterpret_cast<const char*>(data), size);
52 std::string abilityName(reinterpret_cast<const char*>(data), size);
53
54 AppExecFwk::ElementName elementName;
55 elementName.SetBundleName(bundleName);
56 elementName.SetAbilityName(abilityName);
57
58 sptr<AVSessionService> service = new AVSessionService(AVSESSION_SERVICE_ID);
59 if (!service) {
60 SLOGI("service is null");
61 return;
62 }
63 sptr<IRemoteObject> avSessionItemObj = service->CreateSessionInner(tag, type, elementName);
64 sptr<AVSessionItem> avSessionItem = (sptr<AVSessionItem>&)avSessionItemObj;
65 if (!avSessionItem) {
66 SLOGI("avSessionItem is null");
67 return;
68 }
69 MessageParcel dataMessageParcel;
70 MessageParcel reply;
71 MessageOption option;
72 if (!dataMessageParcel.WriteInterfaceToken(IAVSession::GetDescriptor())) {
73 return;
74 }
75 size -= sizeof(uint32_t);
76 dataMessageParcel.WriteBuffer(data + sizeof(uint32_t), size);
77 dataMessageParcel.RewindRead(0);
78 avSessionItem->OnRemoteRequest(code, dataMessageParcel, reply, option);
79 }
80
AvSessionItemTest(uint8_t * data,size_t size)81 void AvSessionItemTest(uint8_t *data, size_t size)
82 {
83 if ((data == nullptr) || (size > MAX_CODE_LEN) || (size < MIN_SIZE_NUM)) {
84 return;
85 }
86 sptr<AVSessionService> service = new AVSessionService(AVSESSION_SERVICE_ID);
87 if (!service) {
88 SLOGI("service is null");
89 return;
90 }
91 std::string tag("audio");
92 int32_t type = 0;
93 AppExecFwk::ElementName elementName;
94 elementName.SetBundleName("bundleName");
95 elementName.SetAbilityName("abilityName");
96 sptr<IRemoteObject> avSessionItemObj = service->CreateSessionInner(tag, type, elementName);
97 sptr<AVSessionItem> avSessionItem = (sptr<AVSessionItem>&)avSessionItemObj;
98 if (!avSessionItem) {
99 SLOGI("avSessionItem is null");
100 return;
101 }
102 AvSessionItemTestImpl(avSessionItem, data, size);
103 }
104
AvSessionItemTestImpl(sptr<AVSessionItem> avSessionItem,const uint8_t * data,size_t size)105 void AvSessionItemTestImpl(sptr<AVSessionItem> avSessionItem, const uint8_t* data, size_t size)
106 {
107 AVPlaybackState avState;
108 int32_t state = *(reinterpret_cast<const int32_t *>(data));
109 avState.SetState(state);
110
111 AVMetaData metaData;
112 std::string assetId(reinterpret_cast<const char *>(data), size);
113 metaData.SetAssetId(assetId);
114
115 std::vector<int32_t> cmds;
116 int32_t fuzzCmds = *(reinterpret_cast<const int32_t *>(data));
117 cmds.push_back(fuzzCmds);
118
119 bool top = *(reinterpret_cast<const bool *>(data));
120
121 AVControlCommand controlCommand;
122 int32_t cmd = *(reinterpret_cast<const int32_t *>(data));
123 if ((cmd < AVControlCommand::SESSION_CMD_INVALID) || (cmd > AVControlCommand::SESSION_CMD_MAX)) {
124 return;
125 }
126 controlCommand.SetCommand(cmd);
127
128 OutputDeviceInfo info;
129 DeviceInfo deviceInfo;
130 deviceInfo.castCategory_ = 0;
131 std::string deviceId(reinterpret_cast<const char *>(data), size);
132 deviceInfo.deviceId_= deviceId;
133 std::string deviceName(reinterpret_cast<const char *>(data), size);
134 deviceInfo.deviceName_ = deviceName;
135 info.deviceInfos_.push_back(deviceInfo);
136
137 avSessionItem->ExecuteControllerCommand(controlCommand);
138 avSessionItem->SetTop(top);
139 avSessionItem->SetOutputDevice(info);
140 avSessionItem->GetOutputDevice(info);
141 avSessionItem->AddSupportCommand(controlCommand.GetCommand());
142 avSessionItem->DeleteSupportCommand(controlCommand.GetCommand());
143 avSessionItem->GetSessionId();
144 avSessionItem->GetAVMetaData(metaData);
145 avSessionItem->SetAVMetaData(metaData);
146 avSessionItem->GetAVPlaybackState(avState);
147 avSessionItem->Activate();
148 avSessionItem->Deactivate();
149 avSessionItem->IsActive();
150 avSessionItem->Destroy();
151 avSessionItem->SetAVPlaybackState(avState);
152 avSessionItem->GetPlaybackState();
153 avSessionItem->GetMetaData();
154 avSessionItem->GetSupportCommand();
155 avSessionItem->GetPid();
156 avSessionItem->GetUid();
157 avSessionItem->GetAbilityName();
158 avSessionItem->GetRemoteSource();
159 }
160
AvSessionItemOnRemoteRequest(uint8_t * data,size_t size)161 void AvSessionItemOnRemoteRequest(uint8_t *data, size_t size)
162 {
163 auto avSessionItem = std::make_unique<AvSessionItemFuzzer>();
164 if (avSessionItem == nullptr) {
165 SLOGI("avSessionItem is null");
166 return;
167 }
168 avSessionItem->AvSessionItemFuzzerTest(data, size);
169 }
170
171 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)172 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
173 {
174 /* Run your code on data */
175 AvSessionItemOnRemoteRequest(const_cast<uint8_t*>(data), size);
176 AvSessionItemTest(const_cast<uint8_t*>(data), size);
177 return 0;
178 }
179 } // namespace AVSession
180 } // namespace OHOS
181