1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #include "audiocapture_fuzzer.h"
16 #include "hdi_service_common.h"
17 using namespace std;
18 namespace OHOS {
19 namespace Audio {
20 constexpr size_t THRESHOLD = 200;
21 constexpr int32_t OFFSET = 4;
22 struct AudioSceneDescriptor g_scene;
23 enum CaptureCmdId {
24     AUDIO_CAPTURE_SET_SAMPLE_ATTR,
25     AUDIO_CAPTURE_CHECK_SCENE_CAPABILITY,
26     AUDIO_CAPTURE_SELECT_SCENE,
27     AUDIO_CAPTURE_SET_VOLUME,
28     AUDIO_CAPTURE_SET_GAIN,
29     AUDIO_CAPTURE_CAPTURE_FRAME,
30     AUDIO_CAPTURE_SET_EXTRA_PARAMS,
31     AUDIO_CAPTURE_REQ_MMAP_BUFFER,
32     AUDIO_CAPTURE_DEV_DUMP,
33 };
34 
Convert2Uint32(const uint8_t * ptr)35 static uint32_t Convert2Uint32(const uint8_t *ptr)
36 {
37     if (ptr == nullptr) {
38         return 0;
39     }
40     /*
41      * Move the 0th digit 24 to the left, the first digit 16 to the left, the second digit 8 to the left,
42      * and the third digit no left
43      */
44     return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]);
45 }
46 
InitScene(const struct AudioSceneDescriptor * scene)47 static int32_t InitScene(const struct AudioSceneDescriptor *scene)
48 {
49     if (scene == nullptr) {
50         return HDF_FAILURE;
51     }
52 
53     g_scene.scene = {0};
54     g_scene.desc.portId = scene->desc.portId;
55     g_scene.desc.pins = scene->desc.pins;
56     g_scene.desc.desc = NULL;
57     return HDF_SUCCESS;
58 }
59 
AudioCaptureReqMmapBuffer(struct IAudioCapture * & capture,uint8_t * & data)60 void AudioCaptureReqMmapBuffer(struct IAudioCapture *&capture, uint8_t *&data)
61 {
62     int32_t temp = *(reinterpret_cast<int32_t *>(data));
63     struct AudioMmapBufferDescriptor desc = {
64         .memoryAddress = reinterpret_cast<int8_t *>(data),
65         .memoryAddressLen = *(reinterpret_cast<uint32_t *>(data)),
66         .memoryFd = temp,
67         .totalBufferFrames = temp,
68         .transferFrameSize = temp,
69         .isShareable = temp,
70         .offset = temp,
71         .filePath = reinterpret_cast<char *>(data),
72     };
73     capture->ReqMmapBuffer(capture, temp, &desc);
74 }
75 
CaptureFucSwitch(struct IAudioCapture * & capture,uint32_t cmd,const uint8_t * & rawData)76 void CaptureFucSwitch(struct IAudioCapture *&capture, uint32_t cmd, const uint8_t *&rawData)
77 {
78     uint8_t *data = const_cast<uint8_t *>(rawData);
79     switch (cmd) {
80         case AUDIO_CAPTURE_SET_SAMPLE_ATTR:
81             capture->SetSampleAttributes(capture, reinterpret_cast<const struct AudioSampleAttributes *>(rawData));
82             break;
83         case AUDIO_CAPTURE_CHECK_SCENE_CAPABILITY: {
84             bool supported = false;
85             InitScene((const struct AudioSceneDescriptor *)(rawData));
86             capture->CheckSceneCapability(capture, &g_scene, &supported);
87             break;
88         }
89         case AUDIO_CAPTURE_SELECT_SCENE:
90             InitScene((const struct AudioSceneDescriptor *)(rawData));
91             capture->SelectScene(capture, &g_scene);
92             break;
93         case AUDIO_CAPTURE_SET_VOLUME:
94             capture->SetVolume(capture, *(reinterpret_cast<float *>(data)));
95             break;
96         case AUDIO_CAPTURE_SET_GAIN:
97             capture->SetGain(capture, *(reinterpret_cast<float *>(data)));
98             break;
99         case AUDIO_CAPTURE_CAPTURE_FRAME: {
100             uint32_t frameLen = 0;
101             uint64_t replyBytes = 0;
102             int8_t frame[BUFFER_LENTH] = {0};
103             capture->CaptureFrame(capture, frame, &frameLen, &replyBytes);
104             break;
105         }
106         case AUDIO_CAPTURE_SET_EXTRA_PARAMS:
107             capture->SetExtraParams(capture, reinterpret_cast<const char *>(rawData));
108             break;
109         case AUDIO_CAPTURE_REQ_MMAP_BUFFER: {
110             AudioCaptureReqMmapBuffer(capture, data);
111             break;
112         }
113         case AUDIO_CAPTURE_DEV_DUMP: {
114             int32_t temp = *(reinterpret_cast<int32_t *>(data));
115             capture->AudioDevDump(capture, temp, temp);
116         }
117             break;
118         default:
119             return;
120     }
121 }
122 
DoSomethingInterestingWithMyAPI(const uint8_t * rawData,size_t size)123 bool DoSomethingInterestingWithMyAPI(const uint8_t *rawData, size_t size)
124 {
125     if (rawData == nullptr) {
126         return false;
127     }
128     struct IAudioAdapter *adapter = nullptr;
129     struct IAudioCapture *capture = nullptr;
130     uint32_t captureId = 0;
131     uint32_t cmd = Convert2Uint32(rawData);
132 
133     rawData = rawData + OFFSET;
134     struct IAudioManager *manager = IAudioManagerGet(false);
135     if (manager == nullptr) {
136         return false;
137     }
138     int32_t ret = AudioCreateCapture(manager, PIN_IN_MIC, ADAPTER_NAME, &adapter, &capture, &captureId);
139     if (ret != HDF_SUCCESS) {
140         return false;
141     }
142     CaptureFucSwitch(capture, cmd, rawData);
143     adapter->DestroyCapture(adapter, captureId);
144     manager->UnloadAdapter(manager, ADAPTER_NAME.c_str());
145     IAudioManagerRelease(manager, false);
146     return true;
147 }
148 }
149 }
150 
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)151 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
152 {
153     if (size < OHOS::Audio::THRESHOLD) {
154         return 0;
155     }
156     OHOS::Audio::DoSomethingInterestingWithMyAPI(data, size);
157     return 0;
158 }