1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_policy_server.h"
20 #include "message_parcel.h"
21 #include "accesstoken_kit.h"
22 #include "nativetoken_kit.h"
23 #include "token_setproc.h"
24 #include "access_token.h"
25 using namespace std;
26 
27 namespace OHOS {
28 namespace AudioStandard {
29 bool g_hasPermission = false;
30 constexpr int32_t OFFSET = 4;
31 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
32 const int32_t SYSTEM_ABILITY_ID = 3009;
33 const bool RUN_ON_CREATE = false;
34 const int32_t LIMITSIZE = 4;
35 const int32_t SHIFT_LEFT_8 = 8;
36 const int32_t SHIFT_LEFT_16 = 16;
37 const int32_t SHIFT_LEFT_24 = 24;
38 const uint32_t LIMIT_ONE = 0;
39 const uint32_t LIMIT_TWO = 30;
40 const uint32_t LIMIT_THREE = 60;
41 const uint32_t LIMIT_FOUR = static_cast<uint32_t>(AudioPolicyInterfaceCode::AUDIO_POLICY_MANAGER_CODE_MAX);
42 bool g_hasServerInit = false;
43 
GetServerPtr()44 AudioPolicyServer* GetServerPtr()
45 {
46     static AudioPolicyServer server(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
47     if (!g_hasServerInit) {
48         server.OnStart();
49         server.OnAddSystemAbility(AUDIO_DISTRIBUTED_SERVICE_ID, "");
50 #ifdef FEATURE_MULTIMODALINPUT_INPUT
51         server.OnAddSystemAbility(MULTIMODAL_INPUT_SERVICE_ID, "");
52 #endif
53         server.OnAddSystemAbility(DISTRIBUTED_KV_DATA_SERVICE_ABILITY_ID, "");
54         server.OnAddSystemAbility(BLUETOOTH_HOST_SYS_ABILITY_ID, "");
55         server.OnAddSystemAbility(ACCESSIBILITY_MANAGER_SERVICE_ID, "");
56         server.OnAddSystemAbility(POWER_MANAGER_SERVICE_ID, "");
57         server.OnAddSystemAbility(SUBSYS_ACCOUNT_SYS_ABILITY_ID_BEGIN, "");
58         server.audioPolicyService_.SetDefaultDeviceLoadFlag(true);
59         g_hasServerInit = true;
60     }
61     return &server;
62 }
63 
Convert2Uint32(const uint8_t * ptr)64 uint32_t Convert2Uint32(const uint8_t *ptr)
65 {
66     if (ptr == nullptr) {
67         return 0;
68     }
69     /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits,
70        the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */
71     return (ptr[0] << SHIFT_LEFT_24) | (ptr[1] << SHIFT_LEFT_16) | (ptr[2] << SHIFT_LEFT_8) | (ptr[3]);
72 }
73 
AudioFuzzTestGetPermission()74 void AudioFuzzTestGetPermission()
75 {
76     if (!g_hasPermission) {
77         uint64_t tokenId;
78         constexpr int perNum = 10;
79         const char *perms[perNum] = {
80             "ohos.permission.MICROPHONE",
81             "ohos.permission.MANAGE_INTELLIGENT_VOICE",
82             "ohos.permission.MANAGE_AUDIO_CONFIG",
83             "ohos.permission.MICROPHONE_CONTROL",
84             "ohos.permission.MODIFY_AUDIO_SETTINGS",
85             "ohos.permission.ACCESS_NOTIFICATION_POLICY",
86             "ohos.permission.USE_BLUETOOTH",
87             "ohos.permission.CAPTURE_VOICE_DOWNLINK_AUDIO",
88             "ohos.permission.RECORD_VOICE_CALL",
89             "ohos.permission.MANAGE_SYSTEM_AUDIO_EFFECTS",
90         };
91 
92         NativeTokenInfoParams infoInstance = {
93             .dcapsNum = 0,
94             .permsNum = 10,
95             .aclsNum = 0,
96             .dcaps = nullptr,
97             .perms = perms,
98             .acls = nullptr,
99             .processName = "audiofuzztest",
100             .aplStr = "system_basic",
101         };
102         tokenId = GetAccessTokenId(&infoInstance);
103         SetSelfTokenID(tokenId);
104         OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
105         g_hasPermission = true;
106     }
107 }
108 
AudioPolicyFuzzFirstLimitTest(const uint8_t * rawData,size_t size)109 void AudioPolicyFuzzFirstLimitTest(const uint8_t *rawData, size_t size)
110 {
111     if (rawData == nullptr || size < LIMITSIZE) {
112         return;
113     }
114     uint32_t code = Convert2Uint32(rawData) % (LIMIT_TWO - LIMIT_ONE + 1) + LIMIT_ONE;
115 
116     rawData = rawData + OFFSET;
117     size = size - OFFSET;
118 
119     MessageParcel data;
120     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
121     data.WriteBuffer(rawData, size);
122     data.RewindRead(0);
123 
124     MessageParcel reply;
125     MessageOption option;
126 
127     GetServerPtr()->OnRemoteRequest(code, data, reply, option);
128 }
129 
AudioPolicyFuzzSecondLimitTest(const uint8_t * rawData,size_t size)130 void AudioPolicyFuzzSecondLimitTest(const uint8_t *rawData, size_t size)
131 {
132     if (rawData == nullptr || size < LIMITSIZE) {
133         return;
134     }
135     uint32_t code = Convert2Uint32(rawData) % (LIMIT_THREE - LIMIT_TWO + 1) + LIMIT_TWO;
136 
137     rawData = rawData + OFFSET;
138     size = size - OFFSET;
139 
140     MessageParcel data;
141     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
142     data.WriteBuffer(rawData, size);
143     data.RewindRead(0);
144 
145     MessageParcel reply;
146     MessageOption option;
147 
148     GetServerPtr()->OnRemoteRequest(code, data, reply, option);
149 }
150 
AudioPolicyFuzzThirdLimitTest(const uint8_t * rawData,size_t size)151 void AudioPolicyFuzzThirdLimitTest(const uint8_t *rawData, size_t size)
152 {
153     if (rawData == nullptr || size < LIMITSIZE) {
154         return;
155     }
156     uint32_t code = Convert2Uint32(rawData) % (LIMIT_FOUR - LIMIT_THREE + 1) + LIMIT_THREE;
157 
158     rawData = rawData + OFFSET;
159     size = size - OFFSET;
160 
161     MessageParcel data;
162     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
163     data.WriteBuffer(rawData, size);
164     data.RewindRead(0);
165 
166     MessageParcel reply;
167     MessageOption option;
168     if (code == static_cast<uint32_t>(AudioPolicyInterfaceCode::ADD_AUDIO_INTERRUPT_ZONE_PIDS)) {
169         return;
170     }
171 
172     GetServerPtr()->OnRemoteRequest(code, data, reply, option);
173 }
174 } // namespace AudioStandard
175 } // namesapce OHOS
176 
LLVMFuzzerInitialize(const uint8_t * data,size_t size)177 extern "C" int LLVMFuzzerInitialize(const uint8_t *data, size_t size)
178 {
179     OHOS::AudioStandard::AudioFuzzTestGetPermission();
180     return 0;
181 }
182 
183 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)184 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
185 {
186     /* Run your code on data */
187     OHOS::AudioStandard::AudioPolicyFuzzFirstLimitTest(data, size);
188     OHOS::AudioStandard::AudioPolicyFuzzSecondLimitTest(data, size);
189     OHOS::AudioStandard::AudioPolicyFuzzThirdLimitTest(data, size);
190     return 0;
191 }
192