1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "effectcontrol_fuzzer.h"
17
18 #include <cstdlib>
19 #include "v1_0/effect_types.h"
20 #include "v1_0/ieffect_control.h"
21 #include "v1_0/ieffect_model.h"
22
23 using namespace std;
24
25 namespace OHOS {
26 namespace Audio {
27 constexpr int32_t OFFSET = 4;
28 constexpr size_t THRESHOLD = 10;
29 constexpr uint32_t GET_BUFFER_LEN = 10;
30
31 enum EffectControlCmdId {
32 EFFECT_CONTROL_EFFECT_PROCESS,
33 EFFECT_CONTROL_SEND_COMMAND,
34 EFFECT_CONTROL_GET_DESCRIPTOR,
35 EFFECT_CONTROL_EFFECT_REVERSE,
36 };
37
Convert2Uint32(const uint8_t * ptr)38 static uint32_t Convert2Uint32(const uint8_t *ptr)
39 {
40 if (ptr == nullptr) {
41 return 0;
42 }
43 /*
44 * Move the 0th digit 24 to the left, the first digit 16 to the left, the second digit 8 to the left,
45 * and the third digit no left
46 */
47 return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]);
48 }
49
EffectControlFucSwitch(struct IEffectControl * & controller,uint32_t cmd,const uint8_t * & rawData,size_t size)50 void EffectControlFucSwitch(struct IEffectControl *&controller, uint32_t cmd, const uint8_t *&rawData, size_t size)
51 {
52 uint8_t *data = const_cast<uint8_t *>(rawData);
53 switch (cmd) {
54 case EFFECT_CONTROL_EFFECT_PROCESS: {
55 struct AudioEffectBuffer output = {0};
56 controller->EffectProcess(controller, reinterpret_cast<AudioEffectBuffer *>(data), &output);
57 break;
58 }
59 case EFFECT_CONTROL_SEND_COMMAND: {
60 int8_t output[GET_BUFFER_LEN] = {0};
61 uint32_t replyLen = GET_BUFFER_LEN;
62 controller->SendCommand(controller, (*data) % AUDIO_EFFECT_COMMAND_GET_PARAM,
63 reinterpret_cast<int8_t *>(data), size, output, &replyLen);
64 break;
65 }
66 case EFFECT_CONTROL_GET_DESCRIPTOR: {
67 struct EffectControllerDescriptor desc;
68 controller->GetEffectDescriptor(controller, &desc);
69 break;
70 }
71 case EFFECT_CONTROL_EFFECT_REVERSE: {
72 struct AudioEffectBuffer output = {0};
73 controller->EffectReverse(controller, reinterpret_cast<struct AudioEffectBuffer *>(data), &output);
74 break;
75 }
76 default:
77 return;
78 }
79 }
80
DoSomethingInterestingWithMyAPI(const uint8_t * rawData,size_t size)81 bool DoSomethingInterestingWithMyAPI(const uint8_t *rawData, size_t size)
82 {
83 if (rawData == nullptr) {
84 return false;
85 }
86 uint32_t cmd = Convert2Uint32(rawData) % EFFECT_CONTROL_EFFECT_REVERSE;
87 rawData = rawData + OFFSET;
88
89 struct IEffectModel *model = IEffectModelGet(true);
90 if (model == nullptr) {
91 return false;
92 }
93
94 char *libName = strdup("libmock_effect_lib");
95 char *effectId = strdup("aaaabbbb-8888-9999-6666-aabbccdd9966ff");
96 struct EffectInfo info = {
97 .libName = libName,
98 .effectId = effectId,
99 .ioDirection = 1,
100 };
101 struct IEffectControl *controller = nullptr;
102 struct ControllerId contollerId;
103
104 int32_t ret = model->CreateEffectController(model, &info, &controller, &contollerId);
105 if (ret != HDF_SUCCESS) {
106 return false;
107 }
108 if (controller == nullptr) {
109 return false;
110 }
111
112 EffectControlFucSwitch(controller, cmd, rawData, size);
113
114 if (libName != nullptr) {
115 free(libName);
116 libName = nullptr;
117 }
118 if (effectId != nullptr) {
119 free(effectId);
120 effectId = nullptr;
121 }
122
123 ret = model->DestroyEffectController(model, &contollerId);
124 if (ret != HDF_SUCCESS) {
125 return false;
126 }
127 IEffectModelRelease(model, true);
128 return true;
129 }
130 }
131 }
132
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)133 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
134 {
135 if (size < OHOS::Audio::THRESHOLD) {
136 return 0;
137 }
138 OHOS::Audio::DoSomethingInterestingWithMyAPI(data, size);
139 return 0;
140 }