1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_policy_server.h"
20 #include "message_parcel.h"
21 #include "accesstoken_kit.h"
22 #include "nativetoken_kit.h"
23 #include "token_setproc.h"
24 #include "access_token.h"
25 using namespace std;
26 
27 namespace OHOS {
28 namespace AudioStandard {
29 bool g_hasPermission = false;
30 constexpr int32_t OFFSET = 4;
31 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
32 const int32_t SYSTEM_ABILITY_ID = 3009;
33 const bool RUN_ON_CREATE = false;
34 const int32_t LIMITSIZE = 4;
35 const int32_t SHIFT_LEFT_8 = 8;
36 const int32_t SHIFT_LEFT_16 = 16;
37 const int32_t SHIFT_LEFT_24 = 24;
38 const uint32_t LIMIT_ONE = 0;
39 const uint32_t LIMIT_TWO = 30;
40 const uint32_t LIMIT_THREE = 60;
41 const uint32_t LIMIT_FOUR = 90;
42 const uint32_t LIMIT_FIVE = static_cast<uint32_t>(AudioPolicyInterfaceCode::AUDIO_POLICY_MANAGER_CODE_MAX);
43 bool g_hasServerInit = false;
44 
GetServerPtr()45 AudioPolicyServer* GetServerPtr()
46 {
47     static AudioPolicyServer server(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
48     if (!g_hasServerInit) {
49         server.OnStart();
50         server.OnAddSystemAbility(AUDIO_DISTRIBUTED_SERVICE_ID, "");
51 #ifdef FEATURE_MULTIMODALINPUT_INPUT
52         server.OnAddSystemAbility(MULTIMODAL_INPUT_SERVICE_ID, "");
53 #endif
54         server.OnAddSystemAbility(BLUETOOTH_HOST_SYS_ABILITY_ID, "");
55         server.OnAddSystemAbility(POWER_MANAGER_SERVICE_ID, "");
56         server.OnAddSystemAbility(SUBSYS_ACCOUNT_SYS_ABILITY_ID_BEGIN, "");
57         server.audioPolicyService_.SetDefaultDeviceLoadFlag(true);
58         g_hasServerInit = true;
59     }
60     return &server;
61 }
62 
Convert2Uint32(const uint8_t *ptr)63 uint32_t Convert2Uint32(const uint8_t *ptr)
64 {
65     if (ptr == nullptr) {
66         return 0;
67     }
68     /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits,
69        the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */
70     return (ptr[0] << SHIFT_LEFT_24) | (ptr[1] << SHIFT_LEFT_16) | (ptr[2] << SHIFT_LEFT_8) | (ptr[3]);
71 }
72 
AudioFuzzTestGetPermission()73 void AudioFuzzTestGetPermission()
74 {
75     if (!g_hasPermission) {
76         uint64_t tokenId;
77         constexpr int perNum = 10;
78         const char *perms[perNum] = {
79             "ohos.permission.MICROPHONE",
80             "ohos.permission.MANAGE_INTELLIGENT_VOICE",
81             "ohos.permission.MANAGE_AUDIO_CONFIG",
82             "ohos.permission.MICROPHONE_CONTROL",
83             "ohos.permission.MODIFY_AUDIO_SETTINGS",
84             "ohos.permission.ACCESS_NOTIFICATION_POLICY",
85             "ohos.permission.USE_BLUETOOTH",
86             "ohos.permission.CAPTURE_VOICE_DOWNLINK_AUDIO",
87             "ohos.permission.RECORD_VOICE_CALL",
88             "ohos.permission.MANAGE_SYSTEM_AUDIO_EFFECTS",
89         };
90 
91         NativeTokenInfoParams infoInstance = {
92             .dcapsNum = 0,
93             .permsNum = 10,
94             .aclsNum = 0,
95             .dcaps = nullptr,
96             .perms = perms,
97             .acls = nullptr,
98             .processName = "audiofuzztest",
99             .aplStr = "system_basic",
100         };
101         tokenId = GetAccessTokenId(&infoInstance);
102         SetSelfTokenID(tokenId);
103         OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
104         g_hasPermission = true;
105     }
106 }
107 
AudioPolicyFuzzFirstLimitTest(const uint8_t *rawData, size_t size)108 void AudioPolicyFuzzFirstLimitTest(const uint8_t *rawData, size_t size)
109 {
110     if (rawData == nullptr || size < LIMITSIZE) {
111         return;
112     }
113     uint32_t code = Convert2Uint32(rawData) % (LIMIT_TWO - LIMIT_ONE + 1) + LIMIT_ONE;
114 
115     rawData = rawData + OFFSET;
116     size = size - OFFSET;
117 
118     MessageParcel data;
119     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
120     data.WriteBuffer(rawData, size);
121     data.RewindRead(0);
122 
123     MessageParcel reply;
124     MessageOption option;
125 
126     GetServerPtr()->OnRemoteRequest(code, data, reply, option);
127 }
128 
AudioPolicyFuzzSecondLimitTest(const uint8_t *rawData, size_t size)129 void AudioPolicyFuzzSecondLimitTest(const uint8_t *rawData, size_t size)
130 {
131     if (rawData == nullptr || size < LIMITSIZE) {
132         return;
133     }
134     uint32_t code = Convert2Uint32(rawData) % (LIMIT_THREE - LIMIT_TWO + 1) + LIMIT_TWO;
135 
136     rawData = rawData + OFFSET;
137     size = size - OFFSET;
138 
139     MessageParcel data;
140     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
141     data.WriteBuffer(rawData, size);
142     data.RewindRead(0);
143 
144     MessageParcel reply;
145     MessageOption option;
146 
147     GetServerPtr()->OnRemoteRequest(code, data, reply, option);
148 }
149 
AudioPolicyFuzzThirdLimitTest(const uint8_t *rawData, size_t size)150 void AudioPolicyFuzzThirdLimitTest(const uint8_t *rawData, size_t size)
151 {
152     if (rawData == nullptr || size < LIMITSIZE) {
153         return;
154     }
155     uint32_t code = Convert2Uint32(rawData) % (LIMIT_FOUR - LIMIT_THREE + 1) + LIMIT_THREE;
156 
157     rawData = rawData + OFFSET;
158     size = size - OFFSET;
159 
160     MessageParcel data;
161     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
162     data.WriteBuffer(rawData, size);
163     data.RewindRead(0);
164 
165     MessageParcel reply;
166     MessageOption option;
167     if (code == static_cast<uint32_t>(AudioPolicyInterfaceCode::ADD_AUDIO_INTERRUPT_ZONE_PIDS)) {
168         return;
169     }
170 
171     GetServerPtr()->OnRemoteRequest(code, data, reply, option);
172 }
173 
AudioPolicyFuzzFouthLimitTest(const uint8_t *rawData, size_t size)174 void AudioPolicyFuzzFouthLimitTest(const uint8_t *rawData, size_t size)
175 {
176     if (rawData == nullptr || size < LIMITSIZE) {
177         return;
178     }
179     uint32_t code = Convert2Uint32(rawData) % (LIMIT_FIVE - LIMIT_FOUR + 1) + LIMIT_FOUR;
180 
181     rawData = rawData + OFFSET;
182     size = size - OFFSET;
183 
184     MessageParcel data;
185     data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
186     data.WriteBuffer(rawData, size);
187     data.RewindRead(0);
188 
189     MessageParcel reply;
190     MessageOption option;
191     if (code == static_cast<uint32_t>(AudioPolicyInterfaceCode::IS_ALLOWED_PLAYBACK)) {
192         return;
193     }
194 
195     GetServerPtr()->OnRemoteRequest(code, data, reply, option);
196 }
197 } // namespace AudioStandard
198 } // namesapce OHOS
199 
LLVMFuzzerInitialize(const uint8_t *data, size_t size)200 extern "C" int LLVMFuzzerInitialize(const uint8_t *data, size_t size)
201 {
202     OHOS::AudioStandard::AudioFuzzTestGetPermission();
203     return 0;
204 }
205 
206 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)207 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
208 {
209     /* Run your code on data */
210     OHOS::AudioStandard::AudioPolicyFuzzFirstLimitTest(data, size);
211     OHOS::AudioStandard::AudioPolicyFuzzSecondLimitTest(data, size);
212     OHOS::AudioStandard::AudioPolicyFuzzThirdLimitTest(data, size);
213     OHOS::AudioStandard::AudioPolicyFuzzFouthLimitTest(data, size);
214     return 0;
215 }
216