1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #undef private
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_interrupt_service.h"
23 using namespace std;
24
25 namespace OHOS {
26 namespace AudioStandard {
27 using namespace std;
28 const int32_t LIMITSIZE = 4;
29 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
30
InitFuzzTest(const uint8_t * rawData,size_t size)31 void InitFuzzTest(const uint8_t *rawData, size_t size)
32 {
33 if (rawData == nullptr || size < LIMITSIZE) {
34 return;
35 }
36 sptr<AudioPolicyServer> server = nullptr;
37 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
38
39 interruptService->Init(server);
40 }
41
AddDumpInfoFuzzTest(const uint8_t * rawData,size_t size)42 void AddDumpInfoFuzzTest(const uint8_t *rawData, size_t size)
43 {
44 if (rawData == nullptr || size < LIMITSIZE) {
45 return;
46 }
47
48 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
49 std::unordered_map<int32_t, std::shared_ptr<AudioInterruptZone>> audioInterruptZonesMapDump;
50
51 interruptService->AddDumpInfo(audioInterruptZonesMapDump);
52 }
53
SetCallbackHandlerFuzzTest(const uint8_t * rawData,size_t size)54 void SetCallbackHandlerFuzzTest(const uint8_t *rawData, size_t size)
55 {
56 if (rawData == nullptr || size < LIMITSIZE) {
57 return;
58 }
59
60 std::shared_ptr<AudioPolicyServerHandler> handler = DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
61 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
62
63 interruptService->SetCallbackHandler(handler);
64 }
65
SetAudioManagerInterruptCallbackFuzzTest(const uint8_t * rawData,size_t size)66 void SetAudioManagerInterruptCallbackFuzzTest(const uint8_t *rawData, size_t size)
67 {
68 if (rawData == nullptr || size < LIMITSIZE) {
69 return;
70 }
71
72 MessageParcel data;
73 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
74 data.WriteBuffer(rawData, size);
75 data.RewindRead(0);
76
77 sptr<IRemoteObject> object = data.ReadRemoteObject();
78 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
79
80 interruptService->SetAudioManagerInterruptCallback(object);
81 }
82
DeactivateAudioInterruptFuzzTest(const uint8_t * rawData,size_t size)83 void DeactivateAudioInterruptFuzzTest(const uint8_t *rawData, size_t size)
84 {
85 if (rawData == nullptr || size < LIMITSIZE) {
86 return;
87 }
88
89 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
90
91 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
92 AudioInterrupt audioInterrupt;
93 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
94 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
95 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
96
97 interruptService->DeactivateAudioInterrupt(zoneId, audioInterrupt);
98 }
99
CreateAudioInterruptZoneFuzzTest(const uint8_t * rawData,size_t size)100 void CreateAudioInterruptZoneFuzzTest(const uint8_t *rawData, size_t size)
101 {
102 if (rawData == nullptr || size < LIMITSIZE) {
103 return;
104 }
105
106 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
107
108 MessageParcel data;
109 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
110 data.WriteBuffer(rawData, size);
111 data.RewindRead(0);
112 std::set<int32_t> pids;
113 pids.insert(data.ReadInt32());
114 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
115
116 interruptService->CreateAudioInterruptZone(zoneId, pids);
117 }
118
ReleaseAudioInterruptZoneFuzzTest(const uint8_t * rawData,size_t size)119 void ReleaseAudioInterruptZoneFuzzTest(const uint8_t *rawData, size_t size)
120 {
121 if (rawData == nullptr || size < LIMITSIZE) {
122 return;
123 }
124
125 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
126
127 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
128
129 interruptService->ReleaseAudioInterruptZone(zoneId);
130 }
131
RemoveAudioInterruptZonePidsFuzzTest(const uint8_t * rawData,size_t size)132 void RemoveAudioInterruptZonePidsFuzzTest(const uint8_t *rawData, size_t size)
133 {
134 if (rawData == nullptr || size < LIMITSIZE) {
135 return;
136 }
137
138 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
139
140 MessageParcel data;
141 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
142 data.WriteBuffer(rawData, size);
143 data.RewindRead(0);
144 std::set<int32_t> pids;
145 pids.insert(data.ReadInt32());
146 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
147
148 interruptService->RemoveAudioInterruptZonePids(zoneId, pids);
149 }
150
GetStreamInFocusFuzzTest(const uint8_t * rawData,size_t size)151 void GetStreamInFocusFuzzTest(const uint8_t *rawData, size_t size)
152 {
153 if (rawData == nullptr || size < LIMITSIZE) {
154 return;
155 }
156
157 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
158
159 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
160
161 interruptService->GetStreamInFocus(zoneId);
162 }
163
GetSessionInfoInFocusFuzzTest(const uint8_t * rawData,size_t size)164 void GetSessionInfoInFocusFuzzTest(const uint8_t *rawData, size_t size)
165 {
166 if (rawData == nullptr || size < LIMITSIZE) {
167 return;
168 }
169
170 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
171
172 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
173 AudioInterrupt audioInterrupt;
174 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
175 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
176 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
177
178 interruptService->GetSessionInfoInFocus(audioInterrupt, zoneId);
179 }
180
DispatchInterruptEventWithSessionIdFuzzTest(const uint8_t * rawData,size_t size)181 void DispatchInterruptEventWithSessionIdFuzzTest(const uint8_t *rawData, size_t size)
182 {
183 if (rawData == nullptr || size < LIMITSIZE) {
184 return;
185 }
186
187 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
188
189 uint32_t sessionId = *reinterpret_cast<const uint32_t *>(rawData);
190 InterruptEventInternal interruptEvent = {};
191 interruptEvent.eventType = *reinterpret_cast<const InterruptType *>(rawData);
192 interruptEvent.forceType = *reinterpret_cast<const InterruptForceType *>(rawData);
193 interruptEvent.hintType = *reinterpret_cast<const InterruptHint *>(rawData);
194 interruptEvent.duckVolume = 0;
195
196 interruptService->DispatchInterruptEventWithSessionId(sessionId, interruptEvent);
197 }
198
RequestAudioFocusFuzzTest(const uint8_t * rawData,size_t size)199 void RequestAudioFocusFuzzTest(const uint8_t *rawData, size_t size)
200 {
201 if (rawData == nullptr || size < LIMITSIZE) {
202 return;
203 }
204
205 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
206
207 int32_t clientId = *reinterpret_cast<const int32_t *>(rawData);
208 AudioInterrupt audioInterrupt;
209 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
210 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
211 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
212
213 interruptService->RequestAudioFocus(clientId, audioInterrupt);
214 }
215
AbandonAudioFocusFuzzTest(const uint8_t * rawData,size_t size)216 void AbandonAudioFocusFuzzTest(const uint8_t *rawData, size_t size)
217 {
218 if (rawData == nullptr || size < LIMITSIZE) {
219 return;
220 }
221
222 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
223
224 int32_t clientId = *reinterpret_cast<const int32_t *>(rawData);
225 AudioInterrupt audioInterrupt;
226 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
227 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
228 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
229
230 interruptService->AbandonAudioFocus(clientId, audioInterrupt);
231 }
232
SetAudioInterruptCallbackFuzzTest(const uint8_t * rawData,size_t size)233 void SetAudioInterruptCallbackFuzzTest(const uint8_t *rawData, size_t size)
234 {
235 if (rawData == nullptr || size < LIMITSIZE) {
236 return;
237 }
238
239 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
240
241 MessageParcel data;
242 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
243 data.WriteBuffer(rawData, size);
244 data.RewindRead(0);
245 sptr<IRemoteObject> object = data.ReadRemoteObject();
246
247 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
248 uint32_t sessionId = *reinterpret_cast<const uint32_t *>(rawData);
249 uint32_t uid = *reinterpret_cast<const uint32_t *>(rawData);
250
251 interruptService->SetAudioInterruptCallback(zoneId, sessionId, object, uid);
252 }
253
UnsetAudioInterruptCallback(const uint8_t * rawData,size_t size)254 void UnsetAudioInterruptCallback(const uint8_t *rawData, size_t size)
255 {
256 if (rawData == nullptr || size < LIMITSIZE) {
257 return;
258 }
259
260 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
261
262 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
263 uint32_t sessionId = *reinterpret_cast<const uint32_t *>(rawData);
264
265 interruptService->UnsetAudioInterruptCallback(zoneId, sessionId);
266 }
267 } // namespace AudioStandard
268 } // namesapce OHOS
269
270 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)271 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
272 {
273 /* Run your code on data */
274 OHOS::AudioStandard::InitFuzzTest(data, size);
275 OHOS::AudioStandard::AddDumpInfoFuzzTest(data, size);
276 OHOS::AudioStandard::SetCallbackHandlerFuzzTest(data, size);
277 OHOS::AudioStandard::SetAudioManagerInterruptCallbackFuzzTest(data, size);
278 OHOS::AudioStandard::DeactivateAudioInterruptFuzzTest(data, size);
279 OHOS::AudioStandard::CreateAudioInterruptZoneFuzzTest(data, size);
280 OHOS::AudioStandard::ReleaseAudioInterruptZoneFuzzTest(data, size);
281 OHOS::AudioStandard::RemoveAudioInterruptZonePidsFuzzTest(data, size);
282 OHOS::AudioStandard::GetStreamInFocusFuzzTest(data, size);
283 OHOS::AudioStandard::GetSessionInfoInFocusFuzzTest(data, size);
284 OHOS::AudioStandard::DispatchInterruptEventWithSessionIdFuzzTest(data, size);
285 OHOS::AudioStandard::RequestAudioFocusFuzzTest(data, size);
286 OHOS::AudioStandard::AbandonAudioFocusFuzzTest(data, size);
287 OHOS::AudioStandard::SetAudioInterruptCallbackFuzzTest(data, size);
288 OHOS::AudioStandard::UnsetAudioInterruptCallback(data, size);
289 return 0;
290 }