1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <cstddef>
17 #include <cstdint>
18 
19 #include "avsession_item.h"
20 #include "ipc_skeleton.h"
21 #include "avcontroller_callback_proxy.h"
22 #include "avsession_controller_stub.h"
23 #include "avsession_errors.h"
24 #include "system_ability_definition.h"
25 #include "audio_info.h"
26 
27 #define private public
28 #define protected public
29 #include "avsession_service.h"
30 #undef protected
31 #undef private
32 
33 #include "avsessionservice_fuzzer.h"
34 #include "client_death_proxy.h"
35 #include "client_death_stub.h"
36 #include "audio_info.h"
37 
38 using namespace std;
39 using namespace OHOS::AudioStandard;
40 namespace OHOS {
41 namespace AVSession {
42 
43 
44 static constexpr int32_t MAX_CODE_LEN  = 512;
45 static constexpr int32_t MIN_SIZE_NUM = 4;
46 static constexpr int32_t CAST_ENGINE_SA_ID = 65546;
47 static char g_testSessionTag[] = "test";
48 static char g_testAnotherBundleName[] = "testAnother.ohos.avsession";
49 static char g_testAnotherAbilityName[] = "testAnother.ability";
50 static sptr<AVSessionService> avsessionService_;
51 
52 class FuzzTestISessionListener : public ISessionListener {
53 public:
OnSessionCreate(const AVSessionDescriptor & descriptor)54     void OnSessionCreate(const AVSessionDescriptor& descriptor) override
55     {
56     };
57 
OnSessionRelease(const AVSessionDescriptor & descriptor)58     void OnSessionRelease(const AVSessionDescriptor& descriptor) override
59     {
60     };
61 
OnTopSessionChange(const AVSessionDescriptor & descriptor)62     void OnTopSessionChange(const AVSessionDescriptor& descriptor) override
63     {
64     };
65 
OnAudioSessionChecked(const int32_t uid)66     void OnAudioSessionChecked(const int32_t uid) override
67     {
68     };
69 
OnDeviceAvailable(const OutputDeviceInfo & castOutputDeviceInfo)70     void OnDeviceAvailable(const OutputDeviceInfo& castOutputDeviceInfo) override
71     {
72     };
73 
OnDeviceLogEvent(const DeviceLogEventCode eventId,const int64_t param)74     void OnDeviceLogEvent(const DeviceLogEventCode eventId, const int64_t param) override
75     {
76     };
77 
OnDeviceOffline(const std::string & deviceId)78     void OnDeviceOffline(const std::string& deviceId) override
79     {
80     };
81 
AsObject()82     sptr<IRemoteObject> AsObject() override
83     {
84         return nullptr;
85     };
86 };
87 
88 template<typename T>
89 class ResourceAutoDestroy {
90 public:
ResourceAutoDestroy(T ptr)91     explicit ResourceAutoDestroy(T ptr) : ptr_(ptr)
92     {
93     }
94 
~ResourceAutoDestroy()95     ~ResourceAutoDestroy()
96     {
97         if (ptr_) {
98             ptr_->Destroy();
99         }
100     }
101 
102 private:
103     T ptr_;
104 };
105 
AvSessionServiceExternalCallTest(const uint8_t * data,size_t size)106 void AvSessionServiceExternalCallTest(const uint8_t* data, size_t size)
107 {
108     if (avsessionService_ == nullptr) {
109         SLOGI("check service null, try create");
110         avsessionService_ = new AVSessionService(AVSESSION_SERVICE_ID);
111     }
112     if (avsessionService_ == nullptr) {
113         SLOGE("service is null, return");
114         return;
115     }
116 
117     avsessionService_->OnDump();
118     avsessionService_->OnStart();
119     avsessionService_->OnStop();
120 }
121 
AvSessionServiceCloseTest(const uint8_t * data,size_t size)122 void AvSessionServiceCloseTest(const uint8_t* data, size_t size)
123 {
124     if (avsessionService_ == nullptr) {
125         SLOGI("check service null, try create");
126         avsessionService_ = new AVSessionService(AVSESSION_SERVICE_ID);
127     }
128     if (avsessionService_ == nullptr) {
129         SLOGE("service is null, return");
130         return;
131     }
132     avsessionService_->Close();
133     avsessionService_ = nullptr;
134 }
135 
AvSessionServiceSystemAbilityTest(const uint8_t * data,size_t size,sptr<AVSessionService> service)136 void AvSessionServiceSystemAbilityTest(const uint8_t* data, size_t size,
137     sptr<AVSessionService> service)
138 {
139     static std::vector<int32_t> systemAbilityIdSet {
140         SAMGR_DUMP_SAID,
141         MULTIMODAL_INPUT_SERVICE_ID,
142         AUDIO_POLICY_SERVICE_ID,
143         APP_MGR_SERVICE_ID,
144         DISTRIBUTED_HARDWARE_DEVICEMANAGER_SA_ID,
145         BUNDLE_MGR_SERVICE_SYS_ABILITY_ID,
146         CAST_ENGINE_SA_ID,
147         BLUETOOTH_HOST_SYS_ABILITY_ID,
148         MEMORY_MANAGER_SA_ID,
149     };
150 
151     int32_t randomNumber = *(reinterpret_cast<const int32_t *>(data));
152     int32_t systemAbilityId = systemAbilityIdSet[randomNumber % systemAbilityIdSet.size()];
153     std::string deviceId(reinterpret_cast<const char *>(data), size);
154     service->OnAddSystemAbility(systemAbilityId, deviceId);
155     service->OnRemoveSystemAbility(systemAbilityId, deviceId);
156 }
157 
AvSessionServiceGetAVQueueInfosTest(const uint8_t * data,size_t size,sptr<AVSessionService> service)158 void AvSessionServiceGetAVQueueInfosTest(const uint8_t* data, size_t size,
159     sptr<AVSessionService> service)
160 {
161     int32_t maxSize = *(reinterpret_cast<const int32_t *>(data));
162     int32_t maxAppSize = *(reinterpret_cast<const int32_t *>(data));
163     std::vector<AVQueueInfo> avQueueInfos;
164     service->GetHistoricalAVQueueInfos(maxSize, maxAppSize, avQueueInfos);
165 }
166 
AvSessionServiceGetDescriptorsTest(const uint8_t * data,size_t size,sptr<AVSessionService> service)167 void AvSessionServiceGetDescriptorsTest(const uint8_t* data, size_t size,
168     sptr<AVSessionService> service)
169 {
170     std::string systemAbilityId(reinterpret_cast<const char *>(data), size);
171     std::vector<AVSessionDescriptor> descriptors;
172     AVSessionDescriptor descriptor;
173     int32_t maxSize = *(reinterpret_cast<const int32_t *>(data));
174 
175     service->GetAllSessionDescriptors(descriptors);
176     service->GetSessionDescriptorsBySessionId(systemAbilityId, descriptor);
177     service->GetHistoricalSessionDescriptors(maxSize, descriptors);
178 }
179 
AvSessionServiceAVPlaybackTest(const uint8_t * data,size_t size,sptr<AVSessionService> service)180 void AvSessionServiceAVPlaybackTest(const uint8_t* data, size_t size,
181     sptr<AVSessionService> service)
182 {
183     std::string bundleName(reinterpret_cast<const char *>(data), size);
184     std::string assetId(reinterpret_cast<const char *>(data), size);
185 
186     service->StartAVPlayback(bundleName, assetId);
187 }
188 
AvSessionServiceControllerTest(const uint8_t * data,size_t size,sptr<AVSessionService> service)189 void AvSessionServiceControllerTest(const uint8_t* data, size_t size,
190     sptr<AVSessionService> service)
191 {
192     std::string tag(reinterpret_cast<const char*>(data), size);
193     int32_t type = *reinterpret_cast<const int32_t*>(data);
194     std::string bundleName(reinterpret_cast<const char*>(data), size);
195     std::string abilityName(reinterpret_cast<const char*>(data), size);
196     AppExecFwk::ElementName elementName;
197     elementName.SetBundleName(bundleName);
198     elementName.SetAbilityName(abilityName);
199     sptr<IRemoteObject> avSessionItemObj = service->CreateSessionInner(tag, type % MIN_SIZE_NUM, elementName);
200     sptr<AVSessionItem> avSessionItem = (sptr<AVSessionItem>&)avSessionItemObj;
201     if (!avSessionItem) {
202         return;
203     }
204     ResourceAutoDestroy<sptr<AVSessionItem>> avSessionItemRelease(avSessionItem);
205     service->AddAvQueueInfoToFile(*avSessionItem);
206     sptr<IRemoteObject> avControllerItemObj;
207     std::string sessionId(reinterpret_cast<const char*>(data), size);
208     uint32_t ret = service->CreateControllerInner(avSessionItem->GetSessionId(), avControllerItemObj);
209     if (ret != AVSESSION_SUCCESS) {
210         return;
211     }
212     sptr<AVControllerItem> avControllerItem = (sptr<AVControllerItem>&)avControllerItemObj;
213     if (!avControllerItem) {
214         return;
215     }
216     ResourceAutoDestroy<sptr<AVControllerItem>> avControllerItemRelease(avControllerItem);
217     service->HandleControllerRelease(*avControllerItem);
218     service->HandleSessionRelease(avSessionItem->GetSessionId());
219 
220     SessionToken token;
221     token.sessionId = avSessionItem->GetSessionId();
222     token.pid = *(reinterpret_cast<const int32_t *>(data));
223     token.uid = *(reinterpret_cast<const int32_t *>(data));
224     int32_t uid = *(reinterpret_cast<const int32_t *>(data));
225 
226     std::vector<AudioStandard::AudioDeviceDescriptor> audioDeviceDescriptors;
227     AudioStandard::AudioDeviceDescriptor descriptor;
228     descriptor.deviceType_ = OHOS::AudioStandard::DEVICE_TYPE_WIRED_HEADSET;
229     audioDeviceDescriptors.push_back(descriptor);
230     service->CastAudio(token, audioDeviceDescriptors);
231     service->CastAudioForAll(audioDeviceDescriptors);
232     service->NotifyAudioSessionCheckTrigger(uid);
233 
234     service->CreateControllerInner("default", avControllerItemObj);
235 }
236 
AVSessionServiceSendSystemControlCommandTest(const uint8_t * data,size_t size,sptr<AVSessionService> service)237 void AVSessionServiceSendSystemControlCommandTest(const uint8_t* data, size_t size,
238     sptr<AVSessionService> service)
239 {
240     AVControlCommand command;
241     command.SetCommand(*reinterpret_cast<const int32_t*>(data));
242     service->SendSystemControlCommand(command);
243     sptr<FuzzTestISessionListener> listener = new FuzzTestISessionListener();
244     if (!listener) {
245         return;
246     }
247     service->RegisterSessionListener(listener);
248     service->RegisterSessionListenerForAllUsers(listener);
249 }
250 
AvSessionServiceClientTest(const uint8_t * data,size_t size,sptr<AVSessionService> service)251 void AvSessionServiceClientTest(const uint8_t* data, size_t size,
252     sptr<AVSessionService> service)
253 {
254     int32_t pid = *reinterpret_cast<const int32_t*>(data);
255     service->OnClientDied(pid);
256 
257     sptr<ClientDeathStub> clientDeath = new ClientDeathStub();
258     service->RegisterClientDeathObserver(clientDeath);
259 }
260 
AvSessionServiceHandleEventTest(const uint8_t * data,size_t size,sptr<AVSessionService> service)261 void AvSessionServiceHandleEventTest(const uint8_t* data, size_t size,
262     sptr<AVSessionService> service)
263 {
264     std::string sessionId(reinterpret_cast<const char*>(data), size);
265     service->HandleSessionRelease(sessionId);
266     service->HandleCallStartEvent();
267 
268     int32_t fd = *reinterpret_cast<const int32_t*>(data);
269     string strArg(reinterpret_cast<const char*>(data), size);
270     std::u16string u16strArg(strArg.begin(), strArg.end());
271     std::vector<std::u16string> args;
272     args.emplace_back(u16strArg);
273     service->Dump(fd, args);
274 }
275 
AvSessionServiceSuperLauncherTest(const uint8_t * data,size_t size,sptr<AVSessionService> service)276 void AvSessionServiceSuperLauncherTest(const uint8_t* data, size_t size,
277     sptr<AVSessionService> service)
278 {
279     vector<string> states {
280         "UNKNOWN",
281         "IDLE",
282         "CONNECTING",
283     };
284     vector<string> serviceNames {
285         "Unknown",
286         "SuperLauncher",
287         "HuaweiCast",
288     };
289     int32_t randomNumber = *(reinterpret_cast<const int32_t *>(data));
290     std::string serviceName = serviceNames[randomNumber % serviceNames.size()];
291     std::string state = states[randomNumber % states.size()];
292     std::string deviceId(reinterpret_cast<const char*>(data), size);
293     std::string extraInfo(reinterpret_cast<const char*>(data), size);
294     service->SuperLauncher(deviceId, serviceName, extraInfo, state);
295     bool on = *(reinterpret_cast<const int32_t *>(data));
296     service->SetScreenOn(on);
297     service->GetScreenOn();
298 }
299 
NotifyDeviceAvailable001(const uint8_t * data,size_t size)300 void NotifyDeviceAvailable001(const uint8_t* data, size_t size)
301 {
302     SLOGI("NotifyDeviceAvailable001 begin!");
303 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
304     SLOGI("NotifyDeviceAvailable001 in!");
305     OutputDeviceInfo outputDeviceInfo;
306     OHOS::AVSession::DeviceInfo deviceInfo;
307     deviceInfo.castCategory_ = 1;
308     deviceInfo.deviceId_ = "deviceId";
309     outputDeviceInfo.deviceInfos_.push_back(deviceInfo);
310     avsessionService_->NotifyDeviceAvailable(outputDeviceInfo);
311 #endif
312     SLOGI("NotifyDeviceAvailable001 end!");
313 }
314 
NotifyMirrorToStreamCast001(const uint8_t * data,size_t size)315 void NotifyMirrorToStreamCast001(const uint8_t* data, size_t size)
316 {
317     SLOGI("NotifyMirrorToStreamCast001 begin!");
318 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
319     SLOGI("NotifyMirrorToStreamCast001 in!");
320     avsessionService_->NotifyMirrorToStreamCast();
321 #endif
322     SLOGI("NotifyMirrorToStreamCast001 end!");
323 }
324 
NotifyMirrorToStreamCast002(const uint8_t * data,size_t size)325 void NotifyMirrorToStreamCast002(const uint8_t* data, size_t size)
326 {
327     SLOGI("NotifyMirrorToStreamCast002 begin!");
328 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
329     SLOGI("NotifyMirrorToStreamCast002 in!");
330     OHOS::AppExecFwk::ElementName elementName;
331     elementName.SetBundleName(g_testAnotherBundleName);
332     elementName.SetAbilityName(g_testAnotherAbilityName);
333     OHOS::sptr<AVSessionItem> avsessionHere_ =
334         avsessionService_->CreateSessionInner(g_testSessionTag, AVSession::SESSION_TYPE_AUDIO, false, elementName);
335     avsessionService_->UpdateTopSession(avsessionHere_);
336     avsessionService_->NotifyMirrorToStreamCast();
337     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
338 #endif
339     SLOGI("NotifyMirrorToStreamCast002 end!");
340 }
341 
NotifyMirrorToStreamCast003(const uint8_t * data,size_t size)342 void NotifyMirrorToStreamCast003(const uint8_t* data, size_t size)
343 {
344     SLOGI("NotifyMirrorToStreamCast003 begin!");
345 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
346     SLOGI("NotifyMirrorToStreamCast002 in!");
347     OHOS::AppExecFwk::ElementName elementName;
348     elementName.SetBundleName(g_testAnotherBundleName);
349     elementName.SetAbilityName(g_testAnotherAbilityName);
350     OHOS::sptr<AVSessionItem> avsessionHere_ =
351         avsessionService_->CreateSessionInner(g_testSessionTag, AVSession::SESSION_TYPE_VIDEO, false, elementName);
352     avsessionService_->UpdateTopSession(avsessionHere_);
353     avsessionService_->NotifyMirrorToStreamCast();
354     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
355 #endif
356     SLOGI("NotifyMirrorToStreamCast003 end!");
357 }
358 
RefreshFocusSessionSort001(const uint8_t * data,size_t size)359 void RefreshFocusSessionSort001(const uint8_t* data, size_t size)
360 {
361     SLOGI("RefreshFocusSessionSort001 begin!");
362     OHOS::AppExecFwk::ElementName elementName;
363     elementName.SetBundleName(g_testAnotherBundleName);
364     elementName.SetAbilityName(g_testAnotherAbilityName);
365     OHOS::sptr<AVSessionItem> avsessionHere_ =
366         avsessionService_->CreateSessionInner(g_testSessionTag, AVSession::SESSION_TYPE_AUDIO, false, elementName);
367     avsessionService_->RefreshFocusSessionSort(avsessionHere_);
368     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
369     SLOGI("RefreshFocusSessionSort001 end!");
370 }
371 
SelectSessionByUid001(const uint8_t * data,size_t size)372 void SelectSessionByUid001(const uint8_t* data, size_t size)
373 {
374     SLOGI("SelectSessionByUid001 begin!");
375     OHOS::AppExecFwk::ElementName elementName;
376     elementName.SetBundleName(g_testAnotherBundleName);
377     elementName.SetAbilityName(g_testAnotherAbilityName);
378     OHOS::sptr<AVSessionItem> avsessionHere_ =
379         avsessionService_->CreateSessionInner(g_testSessionTag, AVSession::SESSION_TYPE_AUDIO, false, elementName);
380     AudioRendererChangeInfo info = {};
381     info.clientUID = 0;
382     avsessionService_->SelectSessionByUid(info);
383     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
384     SLOGI("SelectSessionByUid001 end!");
385 }
386 
SelectSessionByUid002(const uint8_t * data,size_t size)387 void SelectSessionByUid002(const uint8_t* data, size_t size)
388 {
389     SLOGI("SelectSessionByUid002 begin!");
390     OHOS::AppExecFwk::ElementName elementName;
391     elementName.SetBundleName(g_testAnotherBundleName);
392     elementName.SetAbilityName(g_testAnotherAbilityName);
393     OHOS::sptr<AVSessionItem> avsessionHere_ =
394         avsessionService_->CreateSessionInner(g_testSessionTag, AVSession::SESSION_TYPE_AUDIO, false, elementName);
395     AudioRendererChangeInfo info = {};
396     info.clientUID = avsessionHere_->GetUid();
397     avsessionService_->SelectSessionByUid(info);
398     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
399     SLOGI("SelectSessionByUid002 end!");
400 }
401 
InitBMS001(const uint8_t * data,size_t size)402 void InitBMS001(const uint8_t* data, size_t size)
403 {
404     SLOGI("InitBMS001 begin!");
405     avsessionService_->InitBMS();
406     SLOGI("InitBMS001 end!");
407 }
408 
ReleaseCastSession001(const uint8_t * data,size_t size)409 void ReleaseCastSession001(const uint8_t* data, size_t size)
410 {
411     SLOGI("ReleaseCastSession001 begin!");
412     OHOS::AppExecFwk::ElementName elementName;
413     elementName.SetBundleName(g_testAnotherBundleName);
414     elementName.SetAbilityName(g_testAnotherAbilityName);
415     OHOS::sptr<AVSessionItem> avsessionHere_ =
416         avsessionService_->CreateSessionInner("RemoteCast", AVSession::SESSION_TYPE_AUDIO, false, elementName);
417 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
418     SLOGI("ReleaseCastSession001 in!");
419     avsessionService_->ReleaseCastSession();
420 #endif
421     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
422     SLOGI("ReleaseCastSession001 end!");
423 }
424 
CreateSessionByCast001(const uint8_t * data,size_t size)425 void CreateSessionByCast001(const uint8_t* data, size_t size)
426 {
427     SLOGI("CreateSessionByCast001 begin!");
428 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
429     SLOGI("CreateSessionByCast001 in!");
430     avsessionService_->CreateSessionByCast(0);
431     avsessionService_->ClearSessionForClientDiedNoLock(getpid());
432 #endif
433     SLOGI("CreateSessionByCast001 end!");
434 }
435 
MirrorToStreamCast001(const uint8_t * data,size_t size)436 void MirrorToStreamCast001(const uint8_t* data, size_t size)
437 {
438     SLOGI("MirrorToStreamCast001 begin!");
439 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
440     SLOGI("MirrorToStreamCast001 in!");
441     OHOS::AppExecFwk::ElementName elementName;
442     elementName.SetBundleName(g_testAnotherBundleName);
443     elementName.SetAbilityName(g_testAnotherAbilityName);
444     OHOS::sptr<AVSessionItem> avsessionHere_ =
445         avsessionService_->CreateSessionInner("RemoteCast", AVSession::SESSION_TYPE_AUDIO, false, elementName);
446     avsessionService_->is2in1_ = true;
447     avsessionService_->MirrorToStreamCast(avsessionHere_);
448     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
449 #endif
450     SLOGI("MirrorToStreamCast001 end!");
451 }
452 
MirrorToStreamCast002(const uint8_t * data,size_t size)453 void MirrorToStreamCast002(const uint8_t* data, size_t size)
454 {
455     SLOGI("MirrorToStreamCast002 begin!");
456 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
457     SLOGI("MirrorToStreamCast002 in!");
458     OHOS::AppExecFwk::ElementName elementName;
459     elementName.SetBundleName(g_testAnotherBundleName);
460     elementName.SetAbilityName(g_testAnotherAbilityName);
461     OHOS::sptr<AVSessionItem> avsessionHere_ =
462         avsessionService_->CreateSessionInner("RemoteCast", AVSession::SESSION_TYPE_AUDIO, false, elementName);
463     avsessionService_->is2in1_ = false;
464     avsessionService_->MirrorToStreamCast(avsessionHere_);
465     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
466 #endif
467     SLOGI("MirrorToStreamCast002 end!");
468 }
469 
MirrorToStreamCast003(const uint8_t * data,size_t size)470 void MirrorToStreamCast003(const uint8_t* data, size_t size)
471 {
472     SLOGI("MirrorToStreamCast003 begin!");
473 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
474     SLOGI("MirrorToStreamCast003 in!");
475     OHOS::AppExecFwk::ElementName elementName;
476     elementName.SetBundleName(g_testAnotherBundleName);
477     elementName.SetAbilityName(g_testAnotherAbilityName);
478     OHOS::sptr<AVSessionItem> avsessionHere_ =
479         avsessionService_->CreateSessionInner("RemoteCast", AVSession::SESSION_TYPE_AUDIO, false, elementName);
480     avsessionService_->is2in1_ = true;
481     avsessionService_->MirrorToStreamCast(avsessionHere_);
482     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
483 #endif
484     SLOGI("MirrorToStreamCast003 end!");
485 }
486 
RefreshSortFileOnCreateSession001(const uint8_t * data,size_t size)487 void RefreshSortFileOnCreateSession001(const uint8_t* data, size_t size)
488 {
489     SLOGI("RefreshSortFileOnCreateSession001 begin!");
490     OHOS::AppExecFwk::ElementName elementName;
491     elementName.SetBundleName(g_testAnotherBundleName);
492     elementName.SetAbilityName(g_testAnotherAbilityName);
493     OHOS::sptr<AVSessionItem> avsessionHere_ =
494         avsessionService_->CreateSessionInner("RemoteCast", AVSession::SESSION_TYPE_AUDIO, false, elementName);
495     avsessionService_->refreshSortFileOnCreateSession(avsessionHere_->GetSessionId(),
496         "audio", elementName);
497     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
498     SLOGI("RefreshSortFileOnCreateSession001 end!");
499 }
500 
GetHistoricalAVQueueInfos001(const uint8_t * data,size_t size)501 void GetHistoricalAVQueueInfos001(const uint8_t* data, size_t size)
502 {
503     SLOGI("GetHistoricalAVQueueInfos001 begin!");
504     std::vector<AVQueueInfo> avQueueInfos_;
505     avsessionService_->GetHistoricalAVQueueInfos(0, 0, avQueueInfos_);
506     SLOGI("GetHistoricalAVQueueInfos001 end!");
507 }
508 
SaveAvQueueInfo001(const uint8_t * data,size_t size)509 void SaveAvQueueInfo001(const uint8_t* data, size_t size)
510 {
511     SLOGI("SaveAvQueueInfo001 begin!");
512     OHOS::AppExecFwk::ElementName elementName;
513     elementName.SetBundleName(g_testAnotherBundleName);
514     elementName.SetAbilityName(g_testAnotherAbilityName);
515     OHOS::sptr<AVSessionItem> avsessionHere_ =
516         avsessionService_->CreateSessionInner("RemoteCast", AVSession::SESSION_TYPE_AUDIO, false, elementName);
517     AVMetaData meta = avsessionHere_->GetMetaData();
518     std::string oldContent;
519     if (!avsessionService_->LoadStringFromFileEx(avsessionService_->GetAVQueueDir(), oldContent)) {
520         SLOGE("SaveAvQueueInfo001 read avqueueinfo fail, Return!");
521         return;
522     }
523     avsessionService_->SaveAvQueueInfo(oldContent, g_testAnotherBundleName, meta,
524         avsessionService_->GetUsersManager().GetCurrentUserId());
525     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
526     SLOGI("SaveAvQueueInfo001 end!");
527 }
528 
AddAvQueueInfoToFile001(const uint8_t * data,size_t size)529 void AddAvQueueInfoToFile001(const uint8_t* data, size_t size)
530 {
531     SLOGI("AddAvQueueInfoToFile001 begin!");
532     OHOS::AppExecFwk::ElementName elementName;
533     elementName.SetBundleName(g_testAnotherBundleName);
534     elementName.SetAbilityName(g_testAnotherAbilityName);
535     OHOS::sptr<AVSessionItem> avsessionHere_ =
536         avsessionService_->CreateSessionInner("RemoteCast", AVSession::SESSION_TYPE_AUDIO, false, elementName);
537     avsessionService_->AddAvQueueInfoToFile(*avsessionHere_);
538     avsessionService_->HandleSessionRelease(avsessionHere_->GetSessionId());
539     SLOGI("AddAvQueueInfoToFile001 end!");
540 }
541 
StartAVPlayback001(const uint8_t * data,size_t size)542 void StartAVPlayback001(const uint8_t* data, size_t size)
543 {
544     SLOGI("StartAVPlayback001 begin!");
545     avsessionService_->StartAVPlayback(g_testAnotherBundleName, "FAKE_ASSET_NAME");
546     SLOGI("StartAVPlayback001 end!");
547 }
548 
GetSubNode001(const uint8_t * data,size_t size)549 void GetSubNode001(const uint8_t* data, size_t size)
550 {
551     SLOGI("GetSubNode001 begin!");
552     nlohmann::json value;
553     value["bundleName"] = g_testAnotherBundleName;
554     avsessionService_->GetSubNode(value, "FAKE_NAME");
555     SLOGI("GetSubNode001 end!");
556 }
557 
DeleteHistoricalRecord001(const uint8_t * data,size_t size)558 void DeleteHistoricalRecord001(const uint8_t* data, size_t size)
559 {
560     SLOGI("DeleteHistoricalRecord001 begin!");
561     avsessionService_->DeleteHistoricalRecord(g_testAnotherBundleName);
562     SLOGI("DeleteHistoricalRecord001 end!");
563 }
564 
Dump001(const uint8_t * data,size_t size)565 void Dump001(const uint8_t* data, size_t size)
566 {
567     SLOGI("Dump001 begin!");
568     std::vector<std::u16string> argsList;
569     avsessionService_->Dump(1, argsList);
570     SLOGI("Dump001 end!");
571 }
572 
ProcessCastAudioCommand001(const uint8_t * data,size_t size)573 void ProcessCastAudioCommand001(const uint8_t* data, size_t size)
574 {
575     SLOGI("ProcessCastAudioCommand001 begin!");
576     std::string sourceSessionInfo = "SOURCE";
577     std::string sinkSessionInfo = " SINK";
578     avsessionService_->ProcessCastAudioCommand(
579         OHOS::AVSession::AVSessionServiceStub::RemoteServiceCommand::COMMAND_CAST_AUDIO,
580         sourceSessionInfo, sinkSessionInfo);
581     SLOGI("ProcessCastAudioCommand001 end!");
582 }
583 
ProcessCastAudioCommand002(const uint8_t * data,size_t size)584 void ProcessCastAudioCommand002(const uint8_t* data, size_t size)
585 {
586     SLOGI("ProcessCastAudioCommand002 begin!");
587     std::string sourceSessionInfo = "SOURCE";
588     std::string sinkSessionInfo = " SINK";
589     avsessionService_->ProcessCastAudioCommand(
590         OHOS::AVSession::AVSessionServiceStub::RemoteServiceCommand::COMMAND_CANCEL_CAST_AUDIO,
591         sourceSessionInfo, sinkSessionInfo);
592     SLOGI("ProcessCastAudioCommand002 end!");
593 }
594 
HandleDeviceChange001(const uint8_t * data,size_t size)595 void HandleDeviceChange001(const uint8_t* data, size_t size)
596 {
597     SLOGI("HandleDeviceChange001 begin!");
598     DeviceChangeAction deviceChange;
599     deviceChange.type = static_cast<DeviceChangeType>(0);
600     deviceChange.flag = static_cast<DeviceFlag>(0);
601     avsessionService_->HandleDeviceChange(deviceChange);
602     SLOGI("HandleDeviceChange001 end!");
603 }
604 
HandleDeviceChange002(const uint8_t * data,size_t size)605 void HandleDeviceChange002(const uint8_t* data, size_t size)
606 {
607     SLOGI("HandleDeviceChange002 begin!");
608     DeviceChangeAction deviceChange;
609     std::vector<OHOS::sptr<AudioDeviceDescriptor>> audioDeviceDescriptors;
610     OHOS::sptr<AudioDeviceDescriptor> descriptor = new(std::nothrow) AudioDeviceDescriptor();
611     descriptor->deviceType_ = OHOS::AudioStandard::DEVICE_TYPE_WIRED_HEADSET;
612     deviceChange.type = static_cast<DeviceChangeType>(0);
613     deviceChange.flag = static_cast<DeviceFlag>(0);
614 
615     audioDeviceDescriptors.push_back(descriptor);
616     deviceChange.deviceDescriptors = audioDeviceDescriptors;
617     avsessionService_->HandleDeviceChange(deviceChange);
618     SLOGI("HandleDeviceChange002 end!");
619 }
620 
AvSessionServiceTest(const uint8_t * data,size_t size)621 void AvSessionServiceTest(const uint8_t* data, size_t size)
622 {
623     if ((data == nullptr) || (size > MAX_CODE_LEN) || (size < MIN_SIZE_NUM)) {
624         return;
625     }
626     if (avsessionService_ == nullptr) {
627         SLOGI("check service null, try create");
628         avsessionService_ = new AVSessionService(AVSESSION_SERVICE_ID);
629     }
630     if (avsessionService_ == nullptr) {
631         SLOGE("service is null, return");
632         return;
633     }
634     AvSessionServiceSystemAbilityTest(data, size, avsessionService_);
635     AvSessionServiceGetAVQueueInfosTest(data, size, avsessionService_);
636     AvSessionServiceGetDescriptorsTest(data, size, avsessionService_);
637     AvSessionServiceAVPlaybackTest(data, size, avsessionService_);
638     AvSessionServiceControllerTest(data, size, avsessionService_);
639     AVSessionServiceSendSystemControlCommandTest(data, size, avsessionService_);
640     AvSessionServiceClientTest(data, size, avsessionService_);
641     AvSessionServiceHandleEventTest(data, size, avsessionService_);
642     AvSessionServiceSuperLauncherTest(data, size, avsessionService_);
643     NotifyDeviceAvailable001(data, size);
644     NotifyMirrorToStreamCast001(data, size);
645     NotifyMirrorToStreamCast002(data, size);
646     NotifyMirrorToStreamCast003(data, size);
647     RefreshFocusSessionSort001(data, size);
648     SelectSessionByUid001(data, size);
649     SelectSessionByUid002(data, size);
650     InitBMS001(data, size);
651     ReleaseCastSession001(data, size);
652     CreateSessionByCast001(data, size);
653     MirrorToStreamCast001(data, size);
654     MirrorToStreamCast002(data, size);
655     MirrorToStreamCast003(data, size);
656     RefreshSortFileOnCreateSession001(data, size);
657     GetHistoricalAVQueueInfos001(data, size);
658     SaveAvQueueInfo001(data, size);
659     AddAvQueueInfoToFile001(data, size);
660     StartAVPlayback001(data, size);
661     GetSubNode001(data, size);
662     DeleteHistoricalRecord001(data, size);
663     Dump001(data, size);
664     ProcessCastAudioCommand001(data, size);
665     ProcessCastAudioCommand002(data, size);
666     HandleDeviceChange001(data, size);
667     HandleDeviceChange002(data, size);
668 }
669 
OnRemoteRequestForSessionStub(const uint8_t * data,size_t size)670 int32_t AVSessionServiceStubFuzzer::OnRemoteRequestForSessionStub(const uint8_t* data, size_t size)
671 {
672     if ((data == nullptr) || (size > MAX_CODE_LEN) || (size < MIN_SIZE_NUM)) {
673         return AVSESSION_ERROR;
674     }
675     uint32_t code = *(reinterpret_cast<const uint32_t*>(data));
676     code %= static_cast<uint32_t>(IAVSession::SESSION_CMD_MAX);
677 
678     size -= sizeof(uint32_t);
679     std::string sessionId(reinterpret_cast<const char*>(data), size);
680     std::string tag(reinterpret_cast<const char*>(data), size);
681     int32_t type = *reinterpret_cast<const int32_t*>(data);
682     std::string bundleName(reinterpret_cast<const char*>(data), size);
683     std::string abilityName(reinterpret_cast<const char*>(data), size);
684     bool isThirdPartyApp = *(reinterpret_cast<const int32_t *>(data));
685     AVSessionDescriptor descriptor;
686     AppExecFwk::ElementName elementName;
687     elementName.SetBundleName(bundleName);
688     elementName.SetAbilityName(abilityName);
689     descriptor.sessionId_ = sessionId;
690     descriptor.sessionTag_ = tag;
691     descriptor.sessionType_ = type;
692     descriptor.elementName_ = elementName;
693     descriptor.isThirdPartyApp_ = isThirdPartyApp;
694     sptr<AVSessionItem> avSessionItem = new(std::nothrow) AVSessionItem(descriptor);
695     if (!avSessionItem) {
696         SLOGI("testAVSession item is null");
697         return AVSESSION_ERROR;
698     }
699     sptr<IRemoteObject> remoteObject = nullptr;
700     std::shared_ptr<AVSessionProxyTestOnServiceFuzzer> avSessionProxy =
701         std::make_shared<AVSessionProxyTestOnServiceFuzzer>(remoteObject);
702     MessageParcel dataMessageParcelForSession;
703     if (!dataMessageParcelForSession.WriteInterfaceToken(avSessionProxy->GetDescriptor())) {
704         SLOGE("testAVSession item write interface token error");
705         return AVSESSION_ERROR;
706     }
707     dataMessageParcelForSession.WriteBuffer(data + sizeof(uint32_t), size);
708     dataMessageParcelForSession.RewindRead(0);
709     MessageParcel replyForSession;
710     MessageOption optionForSession;
711     int ret = avSessionItem->OnRemoteRequest(code, dataMessageParcelForSession,
712         replyForSession, optionForSession);
713     return ret;
714 }
715 
OnRemoteRequest(const uint8_t * data,size_t size)716 int32_t AVSessionServiceStubFuzzer::OnRemoteRequest(const uint8_t* data, size_t size)
717 {
718     if ((data == nullptr) || (size > MAX_CODE_LEN) || (size < MIN_SIZE_NUM)) {
719         return AVSESSION_ERROR;
720     }
721     uint32_t code = *(reinterpret_cast<const uint32_t*>(data));
722     code %= static_cast<uint32_t>(AvsessionSeviceInterfaceCode::SERVICE_CMD_MAX);
723 
724     size -= sizeof(uint32_t);
725     if (avsessionService_ == nullptr) {
726         SLOGI("check service null, try create");
727         avsessionService_ = new AVSessionService(AVSESSION_SERVICE_ID);
728     }
729     if (avsessionService_ == nullptr) {
730         SLOGE("service is null, return");
731         return AVSESSION_ERROR;
732     }
733     MessageParcel dataMessageParcel;
734     if (!dataMessageParcel.WriteInterfaceToken(avsessionService_->GetDescriptor())) {
735         return AVSESSION_ERROR;
736     }
737     dataMessageParcel.WriteBuffer(data + sizeof(uint32_t), size);
738     dataMessageParcel.RewindRead(0);
739     MessageParcel reply;
740     MessageOption option;
741     int32_t ret = avsessionService_->OnRemoteRequest(code, dataMessageParcel, reply, option);
742     return ret;
743 }
744 
AvSessionServiceStubRemoteRequestTest(const uint8_t * data,size_t size)745 int32_t AvSessionServiceStubRemoteRequestTest(const uint8_t* data, size_t size)
746 {
747     auto serviceStub = std::make_unique<AVSessionServiceStubFuzzer>();
748     if (serviceStub == nullptr) {
749         return 0;
750     }
751     serviceStub->OnRemoteRequest(data, size);
752     serviceStub->OnRemoteRequestForSessionStub(data, size);
753     return 0;
754 }
755 
756 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)757 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
758 {
759     /* Run your code on data */
760     AvSessionServiceCloseTest(data, size);
761     AvSessionServiceExternalCallTest(data, size);
762     AvSessionServiceTest(data, size);
763     AvSessionServiceStubRemoteRequestTest(data, size);
764     return 0;
765 }
766 } // namespace AVSession
767 } // namespace OHOS
768