1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_info.h"
20 #include "audio_policy_server.h"
21 #include "audio_manager_listener_stub.h"
22 #include "message_parcel.h"
23 #include "audio_policy_client.h"
24 
25 using namespace std;
26 
27 namespace OHOS {
28 namespace AudioStandard {
29 bool g_hasServerInit = false;
30 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
31 const int32_t SYSTEM_ABILITY_ID = 3009;
32 const bool RUN_ON_CREATE = false;
33 const int32_t LIMITSIZE = 4;
34 
GetServerPtr()35 AudioPolicyServer* GetServerPtr()
36 {
37     static AudioPolicyServer server(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
38     if (!g_hasServerInit) {
39         server.OnStart();
40         server.OnAddSystemAbility(AUDIO_DISTRIBUTED_SERVICE_ID, "");
41 #ifdef FEATURE_MULTIMODALINPUT_INPUT
42         server.OnAddSystemAbility(MULTIMODAL_INPUT_SERVICE_ID, "");
43 #endif
44         server.OnAddSystemAbility(DISTRIBUTED_KV_DATA_SERVICE_ABILITY_ID, "");
45         server.OnAddSystemAbility(BLUETOOTH_HOST_SYS_ABILITY_ID, "");
46         server.OnAddSystemAbility(ACCESSIBILITY_MANAGER_SERVICE_ID, "");
47         server.OnAddSystemAbility(POWER_MANAGER_SERVICE_ID, "");
48         server.OnAddSystemAbility(SUBSYS_ACCOUNT_SYS_ABILITY_ID_BEGIN, "");
49         server.audioPolicyService_.SetDefaultDeviceLoadFlag(true);
50         g_hasServerInit = true;
51     }
52     return &server;
53 }
54 
AudioVolumeFuzzTest(const uint8_t * rawData,size_t size)55 void AudioVolumeFuzzTest(const uint8_t *rawData, size_t size)
56 {
57     if (rawData == nullptr || size < LIMITSIZE) {
58         return;
59     }
60 
61     AudioStreamType streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
62     int32_t volume = *reinterpret_cast<const int32_t *>(rawData);
63     int32_t streamId = *reinterpret_cast<const int32_t *>(rawData);
64     bool mute = *reinterpret_cast<const bool *>(rawData);
65     GetServerPtr()->SetSystemVolumeLevel(streamType, volume);
66     GetServerPtr()->GetSystemVolumeLevel(streamType);
67     GetServerPtr()->SetLowPowerVolume(streamId, volume);
68     GetServerPtr()->GetLowPowerVolume(streamId);
69     GetServerPtr()->GetSingleStreamVolume(streamId);
70     GetServerPtr()->SetStreamMute(streamType, mute);
71     GetServerPtr()->GetStreamMute(streamType);
72     GetServerPtr()->IsStreamActive(streamType);
73 
74     ContentType contentType = *reinterpret_cast<const ContentType *>(rawData);
75     StreamUsage streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
76     int32_t rendererFlags = *reinterpret_cast<const int32_t *>(rawData);
77     std::string sceneType(reinterpret_cast<const char*>(rawData), size - 1);
78     bool spatializationEnabled = *reinterpret_cast<const bool *>(rawData);
79     bool headTrackingEnabled = *reinterpret_cast<const bool *>(rawData);
80     int32_t originalFlag = *reinterpret_cast<const int32_t *>(rawData);
81 
82     AudioRendererInfo rendererInfo = {
83         contentType,
84         streamUsage,
85         rendererFlags,
86         sceneType,
87         spatializationEnabled,
88         headTrackingEnabled,
89         originalFlag
90     };
91     GetServerPtr()->GetPreferredOutputStreamType(rendererInfo);
92 
93     SourceType sourceType = *reinterpret_cast<const SourceType *>(rawData);
94     int32_t capturerFlags = *reinterpret_cast<const int32_t *>(rawData);
95     AudioCapturerInfo capturerInfo = {
96         sourceType,
97         capturerFlags
98     };
99     GetServerPtr()->GetPreferredInputStreamType(capturerInfo);
100 }
101 
AudioDeviceFuzzTest(const uint8_t * rawData,size_t size)102 void AudioDeviceFuzzTest(const uint8_t *rawData, size_t size)
103 {
104     if (rawData == nullptr || size < LIMITSIZE) {
105         return;
106     }
107 
108     MessageParcel data;
109     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
110     data.WriteBuffer(rawData, size);
111     data.RewindRead(0);
112 
113     InternalDeviceType deviceType = *reinterpret_cast<const InternalDeviceType *>(rawData);
114     bool active = *reinterpret_cast<const bool *>(rawData);
115     GetServerPtr()->SetDeviceActive(deviceType, active);
116     GetServerPtr()->IsDeviceActive(deviceType);
117 
118     AudioRingerMode ringMode = *reinterpret_cast<const AudioRingerMode *>(rawData);
119     GetServerPtr()->SetRingerMode(ringMode);
120 
121 #ifdef FEATURE_DTMF_TONE
122     int32_t ltonetype = *reinterpret_cast<const int32_t *>(rawData);
123     GetServerPtr()->GetToneConfig(ltonetype);
124 #endif
125 
126     AudioScene audioScene = *reinterpret_cast<const AudioScene *>(rawData);
127     GetServerPtr()->SetAudioScene(audioScene);
128 
129     bool mute = *reinterpret_cast<const bool *>(rawData);
130     GetServerPtr()->SetMicrophoneMute(mute);
131     GetServerPtr()->SetMicrophoneMutePersistent(mute, PolicyType::PRIVACY_POLCIY_TYPE);
132     GetServerPtr()->GetPersistentMicMuteState();
133 
134     const sptr<AudioStandard::AudioDeviceDescriptor> deviceDescriptor = new AudioStandard::AudioDeviceDescriptor();
135     CastType type = *reinterpret_cast<const CastType *>(rawData);
136     sptr<IRemoteObject> object = data.ReadRemoteObject();
137     GetServerPtr()->ConfigDistributedRoutingRole(deviceDescriptor, type);
138     GetServerPtr()->SetDistributedRoutingRoleCallback(object);
139     GetServerPtr()->UnsetDistributedRoutingRoleCallback();
140     GetServerPtr()->SetAudioDeviceRefinerCallback(object);
141     GetServerPtr()->UnsetAudioDeviceRefinerCallback();
142     GetServerPtr()->TriggerFetchDevice();
143 }
144 
AudioInterruptFuzzTest(const uint8_t * rawData,size_t size)145 void AudioInterruptFuzzTest(const uint8_t *rawData, size_t size)
146 {
147     if (rawData == nullptr || size < LIMITSIZE) {
148         return;
149     }
150 
151     MessageParcel data;
152     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
153     data.WriteBuffer(rawData, size);
154     data.RewindRead(0);
155 
156     sptr<IRemoteObject> object = data.ReadRemoteObject();
157     uint32_t sessionID = *reinterpret_cast<const uint32_t *>(rawData);
158     uint32_t clientUid = *reinterpret_cast<const uint32_t *>(rawData);
159     GetServerPtr()->SetAudioInterruptCallback(sessionID, object, clientUid);
160     GetServerPtr()->UnsetAudioInterruptCallback(sessionID);
161 
162     int32_t clientId = *reinterpret_cast<const uint32_t *>(rawData);
163     GetServerPtr()->SetAudioManagerInterruptCallback(clientId, object);
164 
165     AudioInterrupt audioInterrupt;
166     audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
167     audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
168     audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
169     GetServerPtr()->RequestAudioFocus(clientId, audioInterrupt);
170     GetServerPtr()->AbandonAudioFocus(clientId, audioInterrupt);
171 
172     std::list<std::pair<AudioInterrupt, AudioFocuState>> focusInfoList = {};
173     std::pair<AudioInterrupt, AudioFocuState> focusInfo = {};
174     focusInfo.first.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
175     focusInfo.first.contentType = *reinterpret_cast<const ContentType *>(rawData);
176     focusInfo.first.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
177     focusInfo.first.audioFocusType.sourceType = *reinterpret_cast<const SourceType *>(rawData);
178     focusInfo.first.audioFocusType.isPlay = *reinterpret_cast<const bool *>(rawData);
179     focusInfo.first.sessionId = *reinterpret_cast<const int32_t *>(rawData);
180     focusInfo.first.pauseWhenDucked = *reinterpret_cast<const bool *>(rawData);
181     focusInfo.first.pid = *reinterpret_cast<const int32_t *>(rawData);
182     focusInfo.first.mode = *reinterpret_cast<const InterruptMode *>(rawData);
183     focusInfo.second = *reinterpret_cast<const AudioFocuState *>(rawData);
184     focusInfoList.push_back(focusInfo);
185     GetServerPtr()->GetAudioFocusInfoList(focusInfoList);
186 }
187 
AudioPolicyFuzzTest(const uint8_t * rawData,size_t size)188 void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size)
189 {
190     if (rawData == nullptr || size < LIMITSIZE) {
191         return;
192     }
193 
194     MessageParcel data;
195     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
196     data.WriteBuffer(rawData, size);
197     data.RewindRead(0);
198 
199     sptr<IRemoteObject> object = data.ReadRemoteObject();
200     GetServerPtr()->RegisterPolicyCallbackClient(object);
201 
202     uint32_t sessionID = *reinterpret_cast<const uint32_t *>(rawData);
203     GetServerPtr()->OnAudioStreamRemoved(sessionID);
204 
205     AudioPolicyServer::DeathRecipientId id =
206         *reinterpret_cast<const AudioPolicyServer::DeathRecipientId *>(rawData);
207     GetServerPtr()->RegisterClientDeathRecipient(object, id);
208 }
209 
AudioPolicyOtherFuzzTest(const uint8_t * rawData,size_t size)210 void AudioPolicyOtherFuzzTest(const uint8_t *rawData, size_t size)
211 {
212     if (rawData == nullptr || size < LIMITSIZE) {
213         return;
214     }
215 
216     int pid = *reinterpret_cast<const int *>(rawData);
217     GetServerPtr()->RegisteredTrackerClientDied(pid);
218 
219     AudioStreamInfo audioStreamInfo = {};
220     audioStreamInfo.samplingRate = *reinterpret_cast<const AudioSamplingRate *>(rawData);
221     audioStreamInfo.channels = *reinterpret_cast<const AudioChannel *>(rawData);
222     audioStreamInfo.format = *reinterpret_cast<const AudioSampleFormat *>(rawData);
223     audioStreamInfo.encoding = *reinterpret_cast<const AudioEncodingType *>(rawData);
224     GetServerPtr()->IsAudioRendererLowLatencySupported(audioStreamInfo);
225 
226     int32_t clientUid = *reinterpret_cast<const int32_t *>(rawData);
227     StreamSetState streamSetState = *reinterpret_cast<const StreamSetState *>(rawData);
228     StreamUsage streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
229     GetServerPtr()->UpdateStreamState(clientUid, streamSetState, streamUsage);
230 
231     int32_t sessionId = *reinterpret_cast<const int32_t *>(rawData);
232     GetServerPtr()->GetAudioCapturerMicrophoneDescriptors(sessionId);
233 
234     AudioPipeType type = *reinterpret_cast<const AudioPipeType *>(rawData);
235     GetServerPtr()->MoveToNewPipe(sessionId, type);
236 
237     sptr<AudioStandard::AudioDeviceDescriptor> deviceDescriptor = new AudioStandard::AudioDeviceDescriptor();
238     deviceDescriptor->deviceType_ = *reinterpret_cast<const DeviceType *>(rawData);
239     deviceDescriptor->deviceRole_ = *reinterpret_cast<const DeviceRole *>(rawData);
240     GetServerPtr()->GetHardwareOutputSamplingRate(deviceDescriptor);
241 
242     GetServerPtr()->GetAvailableMicrophones();
243 
244     std::string macAddress(reinterpret_cast<const char*>(rawData), size - 1);
245     bool support = *reinterpret_cast<const bool *>(rawData);
246     int32_t volume = *reinterpret_cast<const int32_t *>(rawData);
247     bool updateUi = *reinterpret_cast<const bool *>(rawData);
248     GetServerPtr()->SetDeviceAbsVolumeSupported(macAddress, support);
249     GetServerPtr()->SetA2dpDeviceVolume(macAddress, volume, updateUi);
250 
251     bool state = *reinterpret_cast<const bool *>(rawData);
252     GetServerPtr()->SetCaptureSilentState(state);
253 
254     GetServerPtr()->IsHighResolutionExist();
255     bool highResExist = *reinterpret_cast<const bool *>(rawData);
256     GetServerPtr()->SetHighResolutionExist(highResExist);
257 
258     std::string networkId(reinterpret_cast<const char*>(rawData), size - 1);
259     InterruptEvent event = {};
260     event.eventType = *reinterpret_cast<const InterruptType *>(rawData);
261     event.forceType = *reinterpret_cast<const InterruptForceType *>(rawData);
262     event.hintType = *reinterpret_cast<const InterruptHint *>(rawData);
263     GetServerPtr()->InjectInterruption(networkId, event);
264 }
265 
AudioSessionFuzzTest(const uint8_t * rawData,size_t size)266 void AudioSessionFuzzTest(const uint8_t *rawData, size_t size)
267 {
268     if (rawData == nullptr || size < LIMITSIZE) {
269         return;
270     }
271 
272     AudioSessionStrategy sessionStrategy;
273     sessionStrategy.concurrencyMode = *reinterpret_cast<const AudioConcurrencyMode *>(rawData);
274     GetServerPtr()->ActivateAudioSession(sessionStrategy);
275 }
276 
AudioConcurrencyFuzzTest(const uint8_t * rawData,size_t size)277 void AudioConcurrencyFuzzTest(const uint8_t *rawData, size_t size)
278 {
279     if (rawData == nullptr || size < LIMITSIZE) {
280         return;
281     }
282 
283     MessageParcel data;
284     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
285     data.WriteBuffer(rawData, size);
286     data.RewindRead(0);
287 
288     sptr<IRemoteObject> object = data.ReadRemoteObject();
289     uint32_t sessionID = *reinterpret_cast<const uint32_t *>(rawData);
290     GetServerPtr()->SetAudioConcurrencyCallback(sessionID, object);
291     GetServerPtr()->UnsetAudioConcurrencyCallback(sessionID);
292     AudioPipeType pipeType = *reinterpret_cast<const AudioPipeType *>(rawData);
293     GetServerPtr()->ActivateAudioConcurrency(pipeType);
294 }
295 
AudioVolumeKeyCallbackStub(const uint8_t * rawData,size_t size)296 void AudioVolumeKeyCallbackStub(const uint8_t *rawData, size_t size)
297 {
298     if (rawData == nullptr || size < LIMITSIZE) {
299         return;
300     }
301     sptr<AudioPolicyClientStub> listener =
302         static_cast<sptr<AudioPolicyClientStub>>(new(std::nothrow) AudioPolicyClientStubImpl());
303     VolumeEvent volumeEvent = {};
304     volumeEvent.volumeType =  *reinterpret_cast<const AudioStreamType *>(rawData);
305     volumeEvent.volume = *reinterpret_cast<const int32_t *>(rawData);
306     volumeEvent.updateUi = *reinterpret_cast<const bool *>(rawData);
307     volumeEvent.volumeGroupId = *reinterpret_cast<const int32_t *>(rawData);
308     std::string id(reinterpret_cast<const char*>(rawData), size - 1);
309     volumeEvent.networkId = id;
310 
311     MessageParcel data;
312     data.WriteInt32(static_cast<int32_t>(AudioPolicyClientCode::ON_VOLUME_KEY_EVENT));
313     data.WriteInt32(static_cast<int32_t>(volumeEvent.volumeType));
314     data.WriteInt32(volumeEvent.volume);
315     data.WriteBool(volumeEvent.updateUi);
316     data.WriteInt32(volumeEvent.volumeGroupId);
317     data.WriteString(volumeEvent.networkId);
318     MessageParcel reply;
319     MessageOption option;
320     listener->OnRemoteRequest(static_cast<uint32_t>(UPDATE_CALLBACK_CLIENT), data, reply, option);
321 }
322 
323 } // namespace AudioStandard
324 } // namesapce OHOS
325 
LLVMFuzzerInitialize(const uint8_t * data,size_t size)326 extern "C" int LLVMFuzzerInitialize(const uint8_t *data, size_t size)
327 {
328     OHOS::AudioStandard::GetServerPtr();
329     return 0;
330 }
331 
332 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)333 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
334 {
335     /* Run your code on data */
336     OHOS::AudioStandard::AudioVolumeFuzzTest(data, size);
337     OHOS::AudioStandard::AudioDeviceFuzzTest(data, size);
338     OHOS::AudioStandard::AudioInterruptFuzzTest(data, size);
339     OHOS::AudioStandard::AudioPolicyFuzzTest(data, size);
340     OHOS::AudioStandard::AudioPolicyOtherFuzzTest(data, size);
341     OHOS::AudioStandard::AudioVolumeKeyCallbackStub(data, size);
342     return 0;
343 }
344 
345