1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "playerservicestub_fuzzer.h"
17 #include <iostream>
18 #include "i_standard_media_listener.h"
19 #include "i_standard_media_service.h"
20 #include "iservice_registry.h"
21 #include "system_ability_definition.h"
22
23 using namespace std;
24 using namespace OHOS;
25 using namespace OHOS::Media;
26
27 namespace OHOS {
28 namespace Media {
29 class PlayerServiceListenerStubFuzzer : public IRemoteStub<IStandardMediaListener>, public NoCopyable {
30 public:
31 PlayerServiceListenerStubFuzzer() = default;
32 ~PlayerServiceListenerStubFuzzer() = default;
33 };
34
35 class MediaServiceProxyFuzzer : public IRemoteProxy<IStandardMediaService>, public NoCopyable {
36 public:
MediaServiceProxyFuzzer(const sptr<IRemoteObject> & impl)37 explicit MediaServiceProxyFuzzer(const sptr<IRemoteObject> &impl) : IRemoteProxy<IStandardMediaService>(impl) {}
~MediaServiceProxyFuzzer()38 virtual ~MediaServiceProxyFuzzer() {}
39
GetSubSystemAbility(IStandardMediaService::MediaSystemAbility subSystemId,const sptr<IRemoteObject> & listener)40 sptr<IRemoteObject> GetSubSystemAbility(IStandardMediaService::MediaSystemAbility subSystemId,
41 const sptr<IRemoteObject> &listener)
42 {
43 MessageParcel data;
44 MessageParcel reply;
45 MessageOption option;
46
47 bool token = data.WriteInterfaceToken(MediaServiceProxyFuzzer::GetDescriptor());
48 if (!token) {
49 cout << "Failed to write descriptor!" << endl;
50 return nullptr;
51 }
52 (void)data.WriteInt32(static_cast<int32_t>(subSystemId));
53 (void)data.WriteRemoteObject(listener);
54 (void)Remote()->SendRequest(MediaServiceMsg::GET_SUBSYSTEM, data, reply, option);
55 return reply.ReadRemoteObject();
56 }
57
58 private:
59 static inline BrokerDelegator<MediaServiceProxyFuzzer> delegator_;
60 };
61
PlayerServiceStubFuzzer()62 PlayerServiceStubFuzzer::PlayerServiceStubFuzzer()
63 {
64 }
65
~PlayerServiceStubFuzzer()66 PlayerServiceStubFuzzer::~PlayerServiceStubFuzzer()
67 {
68 }
69
FuzzServiceStub(uint8_t * data,size_t size)70 bool PlayerServiceStubFuzzer::FuzzServiceStub(uint8_t *data, size_t size)
71 {
72 constexpr int32_t subSystemIdList = 8;
73 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
74 sptr<IRemoteObject> object = samgr->GetSystemAbility(OHOS::PLAYER_DISTRIBUTED_SERVICE_ID);
75 if (object == nullptr) {
76 cout << "media object is nullptr." << endl;
77 return false;
78 }
79 sptr<IStandardMediaService> mediaProxy_ = nullptr;
80 mediaProxy_ = iface_cast<IStandardMediaService>(object);
81 if (mediaProxy_ == nullptr) {
82 cout << "media proxy is nullptr." << endl;
83 return false;
84 }
85 sptr<IRemoteObject> listenerStub_ = nullptr;
86 listenerStub_ = new(std::nothrow) PlayerServiceListenerStubFuzzer();
87
88 IStandardMediaService::MediaSystemAbility subSystemId[subSystemIdList] {
89 IStandardMediaService::MediaSystemAbility::MEDIA_PLAYER,
90 IStandardMediaService::MediaSystemAbility::MEDIA_RECORDER,
91 IStandardMediaService::MediaSystemAbility::MEDIA_CODEC,
92 IStandardMediaService::MediaSystemAbility::MEDIA_AVMETADATAHELPER,
93 IStandardMediaService::MediaSystemAbility::MEDIA_CODECLIST,
94 IStandardMediaService::MediaSystemAbility::MEDIA_AVCODEC,
95 IStandardMediaService::MediaSystemAbility::RECORDER_PROFILES,
96 };
97 int32_t systemId = *reinterpret_cast<int32_t *>(data) % (subSystemIdList);
98 mediaProxy_->GetSubSystemAbility(subSystemId[systemId], listenerStub_);
99 return true;
100 }
101 }
102
FuzzPlayerServiceStub(uint8_t * data,size_t size)103 bool FuzzPlayerServiceStub(uint8_t *data, size_t size)
104 {
105 if ((data == nullptr) || (size < sizeof(int32_t))) {
106 return true;
107 }
108 PlayerServiceStubFuzzer player;
109 return player.FuzzServiceStub(data, size);
110 }
111 }
112
113 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)114 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
115 {
116 /* Run your code on data */
117 OHOS::FuzzPlayerServiceStub(data, size);
118 return 0;
119 }
120