1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "audiocapture_fuzzer.h"
16 #include "hdi_service_common.h"
17 using namespace std;
18 namespace OHOS {
19 namespace Audio {
20 constexpr size_t THRESHOLD = 10;
21 constexpr int32_t OFFSET = 4;
22
23 enum CaptureCmdId {
24 AUDIO_CAPTURE_SET_SAMPLE_ATTR,
25 AUDIO_CAPTURE_CHECK_SCENE_CAPABILITY,
26 AUDIO_CAPTURE_SELECT_SCENE,
27 AUDIO_CAPTURE_SET_VOLUME,
28 AUDIO_CAPTURE_SET_GAIN,
29 AUDIO_CAPTURE_CAPTURE_FRAME,
30 AUDIO_CAPTURE_SET_EXTRA_PARAMS,
31 AUDIO_CAPTURE_REQ_MMAP_BUFFER,
32 AUDIO_CAPTURE_DEV_DUMP,
33 };
34
Convert2Uint32(const uint8_t * ptr)35 static uint32_t Convert2Uint32(const uint8_t *ptr)
36 {
37 if (ptr == nullptr) {
38 return 0;
39 }
40 /*
41 * Move the 0th digit 24 to the left, the first digit 16 to the left, the second digit 8 to the left,
42 * and the third digit no left
43 */
44 return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]);
45 }
46
AudioCaptureReqMmapBuffer(struct IAudioCapture * & capture,uint8_t * & data)47 void AudioCaptureReqMmapBuffer(struct IAudioCapture *&capture, uint8_t *&data)
48 {
49 int32_t temp = *(reinterpret_cast<int32_t *>(data));
50 struct AudioMmapBufferDescriptor desc = {
51 .memoryAddress = reinterpret_cast<int8_t *>(data),
52 .memoryAddressLen = *(reinterpret_cast<uint32_t *>(data)),
53 .memoryFd = temp,
54 .totalBufferFrames = temp,
55 .transferFrameSize = temp,
56 .isShareable = temp,
57 .offset = temp,
58 .filePath = reinterpret_cast<char *>(data),
59 };
60 capture->ReqMmapBuffer(capture, temp, &desc);
61 }
62
CaptureFucSwitch(struct IAudioCapture * & capture,uint32_t cmd,const uint8_t * & rawData)63 void CaptureFucSwitch(struct IAudioCapture *&capture, uint32_t cmd, const uint8_t *&rawData)
64 {
65 uint8_t *data = const_cast<uint8_t *>(rawData);
66 switch (cmd) {
67 case AUDIO_CAPTURE_SET_SAMPLE_ATTR:
68 capture->SetSampleAttributes(capture, reinterpret_cast<const struct AudioSampleAttributes *>(rawData));
69 break;
70 case AUDIO_CAPTURE_CHECK_SCENE_CAPABILITY: {
71 bool supported = false;
72 capture->CheckSceneCapability(capture, reinterpret_cast<const struct AudioSceneDescriptor *>(rawData),
73 &supported);
74 break;
75 }
76 case AUDIO_CAPTURE_SELECT_SCENE:
77 capture->SelectScene(capture, reinterpret_cast<const struct AudioSceneDescriptor *>(rawData));
78 break;
79 case AUDIO_CAPTURE_SET_VOLUME:
80 capture->SetVolume(capture, *(reinterpret_cast<float *>(data)));
81 break;
82 case AUDIO_CAPTURE_SET_GAIN:
83 capture->SetGain(capture, *(reinterpret_cast<float *>(data)));
84 break;
85 case AUDIO_CAPTURE_CAPTURE_FRAME: {
86 uint32_t frameLen = 0;
87 uint64_t replyBytes = 0;
88 int8_t frame[BUFFER_LENTH] = {0};
89 capture->CaptureFrame(capture, frame, &frameLen, &replyBytes);
90 break;
91 }
92 case AUDIO_CAPTURE_SET_EXTRA_PARAMS:
93 capture->SetExtraParams(capture, reinterpret_cast<const char *>(rawData));
94 break;
95 case AUDIO_CAPTURE_REQ_MMAP_BUFFER: {
96 AudioCaptureReqMmapBuffer(capture, data);
97 break;
98 }
99 case AUDIO_CAPTURE_DEV_DUMP: {
100 int32_t temp = *(reinterpret_cast<int32_t *>(data));
101 capture->AudioDevDump(capture, temp, temp);
102 }
103 break;
104 default:
105 return;
106 }
107 }
108
DoSomethingInterestingWithMyAPI(const uint8_t * rawData,size_t size)109 bool DoSomethingInterestingWithMyAPI(const uint8_t *rawData, size_t size)
110 {
111 if (rawData == nullptr) {
112 return false;
113 }
114 struct IAudioAdapter *adapter = nullptr;
115 struct IAudioCapture *capture = nullptr;
116 uint32_t captureId = 0;
117 uint32_t cmd = Convert2Uint32(rawData);
118
119 rawData = rawData + OFFSET;
120 struct IAudioManager *manager = IAudioManagerGet(true);
121 if (manager == nullptr) {
122 return false;
123 }
124 int32_t ret = AudioCreateCapture(manager, PIN_IN_MIC, ADAPTER_NAME, &adapter, &capture, &captureId);
125 if (ret != HDF_SUCCESS) {
126 return false;
127 }
128 CaptureFucSwitch(capture, cmd, rawData);
129 adapter->DestroyCapture(adapter, captureId);
130 manager->UnloadAdapter(manager, ADAPTER_NAME.c_str());
131 IAudioManagerRelease(manager, true);
132 return true;
133 }
134 }
135 }
136
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)137 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
138 {
139 if (size < OHOS::Audio::THRESHOLD) {
140 return 0;
141 }
142 OHOS::Audio::DoSomethingInterestingWithMyAPI(data, size);
143 return 0;
144 }