1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 namespace OHOS {
34 namespace AudioStandard {
35 using namespace std;
36 const int32_t LIMITSIZE = 4;
37 const int64_t LIMIT_TIME = 1;
38 const uint32_t ENUMSIZE = 4;
39 const uint64_t COMMON_UINT64_NUM = 2;
40 const int64_t COMMON_INT64_NUM = 2;
41 bool g_hasPermission = false;
42
AudioFuzzTestGetPermission()43 void AudioFuzzTestGetPermission()
44 {
45 if (!g_hasPermission) {
46 uint64_t tokenId;
47 constexpr int perNum = 10;
48 const char *perms[perNum] = {
49 "ohos.permission.MICROPHONE",
50 "ohos.permission.MANAGE_INTELLIGENT_VOICE",
51 "ohos.permission.MANAGE_AUDIO_CONFIG",
52 "ohos.permission.MICROPHONE_CONTROL",
53 "ohos.permission.MODIFY_AUDIO_SETTINGS",
54 "ohos.permission.ACCESS_NOTIFICATION_POLICY",
55 "ohos.permission.USE_BLUETOOTH",
56 "ohos.permission.CAPTURE_VOICE_DOWNLINK_AUDIO",
57 "ohos.permission.RECORD_VOICE_CALL",
58 "ohos.permission.MANAGE_SYSTEM_AUDIO_EFFECTS",
59 };
60
61 NativeTokenInfoParams infoInstance = {
62 .dcapsNum = 0,
63 .permsNum = 10,
64 .aclsNum = 0,
65 .dcaps = nullptr,
66 .perms = perms,
67 .acls = nullptr,
68 .processName = "audiofuzztest",
69 .aplStr = "system_basic",
70 };
71 tokenId = GetAccessTokenId(&infoInstance);
72 SetSelfTokenID(tokenId);
73 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
74 g_hasPermission = true;
75 }
76 }
77
GetCurNanoFuzzTest(const uint8_t* rawData, size_t size)78 void GetCurNanoFuzzTest(const uint8_t* rawData, size_t size)
79 {
80 if (rawData == nullptr || size < LIMITSIZE) {
81 return;
82 }
83
84 ClockTime::GetCurNano();
85 }
AbsoluteSleepFuzzTest(const uint8_t* rawData, size_t size)86 void AbsoluteSleepFuzzTest(const uint8_t* rawData, size_t size)
87 {
88 if (rawData == nullptr || size < LIMITSIZE) {
89 return;
90 }
91
92 int64_t nanoTime = COMMON_INT64_NUM;
93 if (nanoTime > LIMIT_TIME) {
94 nanoTime = LIMIT_TIME;
95 }
96 ClockTime::AbsoluteSleep(nanoTime);
97 }
98
RelativeSleepFuzzTest(const uint8_t* rawData, size_t size)99 void RelativeSleepFuzzTest(const uint8_t* rawData, size_t size)
100 {
101 if (rawData == nullptr || size < LIMITSIZE) {
102 return;
103 }
104
105 int64_t nanoTime = COMMON_INT64_NUM;
106 if (nanoTime > LIMIT_TIME) {
107 nanoTime = LIMIT_TIME;
108 }
109 ClockTime::RelativeSleep(nanoTime);
110 }
111
CountFuzzTest(const uint8_t* rawData, size_t size)112 void CountFuzzTest(const uint8_t* rawData, size_t size)
113 {
114 if (rawData == nullptr || size < LIMITSIZE) {
115 return;
116 }
117
118 int64_t count = COMMON_INT64_NUM;
119 const std::string value = "value";
120 Trace::Count(value, count);
121 }
122
CountVolumeFuzzTest(const uint8_t* rawData, size_t size)123 void CountVolumeFuzzTest(const uint8_t* rawData, size_t size)
124 {
125 if (rawData == nullptr || size < LIMITSIZE) {
126 return;
127 }
128
129 uint8_t data = *(reinterpret_cast<const uint8_t*>(rawData));
130 const std::string value = "value";
131 Trace::CountVolume(value, data);
132 }
133
VerifySystemPermissionFuzzTest(const uint8_t* rawData, size_t size)134 bool VerifySystemPermissionFuzzTest(const uint8_t* rawData, size_t size)
135 {
136 if (rawData == nullptr || size < LIMITSIZE) {
137 return false;
138 }
139
140 return PermissionUtil::VerifySystemPermission();
141 }
142
VerifyPermissionFuzzTest(const uint8_t *rawData, size_t size)143 void VerifyPermissionFuzzTest(const uint8_t *rawData, size_t size)
144 {
145 if (rawData == nullptr || size < LIMITSIZE) {
146 return;
147 }
148 uint32_t tokenId = *reinterpret_cast<const uint32_t *>(rawData);
149 PermissionUtil::VerifyPermission(ACCESS_NOTIFICATION_POLICY_PERMISSION, tokenId);
150 }
151
VerifyIsShellFuzzTest(const uint8_t* rawData, size_t size)152 void VerifyIsShellFuzzTest(const uint8_t* rawData, size_t size)
153 {
154 if (rawData == nullptr || size < LIMITSIZE) {
155 return;
156 }
157
158 PermissionUtil::VerifyIsShell();
159 }
160
VerifyIsSystemAppFuzzTest(const uint8_t* rawData, size_t size)161 void VerifyIsSystemAppFuzzTest(const uint8_t* rawData, size_t size)
162 {
163 if (rawData == nullptr || size < LIMITSIZE) {
164 return;
165 }
166
167 PermissionUtil::VerifyIsSystemApp();
168 }
169
170
NeedVerifyBackgroundCaptureFuzzTest(const uint8_t *rawData, size_t size)171 void NeedVerifyBackgroundCaptureFuzzTest(const uint8_t *rawData, size_t size)
172 {
173 if (rawData == nullptr || size < LIMITSIZE) {
174 return;
175 }
176 int32_t callingUid = *(reinterpret_cast<const int32_t*>(rawData));
177 SourceType sourceType = *(reinterpret_cast<const SourceType*>(rawData));
178 PermissionUtil::NeedVerifyBackgroundCapture(callingUid, sourceType);
179 }
180
VerifyBackgroundCaptureFuzzTest(const uint8_t* rawData, size_t size)181 void VerifyBackgroundCaptureFuzzTest(const uint8_t* rawData, size_t size)
182 {
183 if (rawData == nullptr || size < LIMITSIZE) {
184 return;
185 }
186 uint32_t tokenId = *(reinterpret_cast<const uint32_t*>(rawData));
187 uint64_t fullTokenId = COMMON_UINT64_NUM;
188
189 PermissionUtil::VerifyBackgroundCapture(tokenId, fullTokenId);
190 }
191
NotifyPrivacyFuzzTest(const uint8_t *rawData, size_t size)192 void NotifyPrivacyFuzzTest(const uint8_t *rawData, size_t size)
193 {
194 if (rawData == nullptr || size < LIMITSIZE) {
195 return;
196 }
197 uint32_t targetTokenId = *(reinterpret_cast<const uint32_t*>(rawData));
198 AudioPermissionState state = *(reinterpret_cast<const AudioPermissionState*>(rawData));
199
200 PermissionUtil::NotifyPrivacy(targetTokenId, state);
201 }
202
GetTimeFuzzTest(const uint8_t *rawData, size_t size)203 void GetTimeFuzzTest(const uint8_t *rawData, size_t size)
204 {
205 if (rawData == nullptr || size < LIMITSIZE) {
206 return;
207 }
208 GetTime();
209 }
210
AudioBlendFuzzTest(const uint8_t *rawData, size_t size)211 void AudioBlendFuzzTest(const uint8_t *rawData, size_t size)
212 {
213 if (rawData == nullptr || size < LIMITSIZE) {
214 return;
215 }
216 std::shared_ptr<AudioBlend> audioBlend = nullptr;
217 audioBlend = std::make_shared<AudioBlend>();
218 uint32_t blendMode_int = *reinterpret_cast<const uint32_t*>(rawData);
219 blendMode_int = blendMode_int % ENUMSIZE;
220 ChannelBlendMode blendMode = static_cast<ChannelBlendMode>(blendMode_int);
221 uint8_t format = *reinterpret_cast<const uint8_t*>(rawData);
222 format = format % ENUMSIZE;
223 uint8_t channel = *reinterpret_cast<const uint8_t*>(rawData);
224 audioBlend->SetParams(blendMode, format, channel);
225 uint8_t *buffer = new uint8_t[LIMITSIZE];
226 memcpy_s(buffer, LIMITSIZE, rawData, LIMITSIZE);
227 audioBlend->Process(buffer, LIMITSIZE);
228 delete[] buffer;
229 }
230
VolumeRampFuzzTest(const uint8_t *rawData, size_t size)231 void VolumeRampFuzzTest(const uint8_t *rawData, size_t size)
232 {
233 if (rawData == nullptr || size < LIMITSIZE) {
234 return;
235 }
236 std::shared_ptr<VolumeRamp> volumeRamp = nullptr;
237 volumeRamp = std::make_shared<VolumeRamp>();
238 float targetVolume = *reinterpret_cast<const float*>(rawData);
239 float currStreamVolume = *reinterpret_cast<const float*>(rawData);
240 int32_t duration = *reinterpret_cast<const int32_t*>(rawData);
241 volumeRamp->SetVolumeRampConfig(targetVolume, currStreamVolume, duration);
242 volumeRamp->GetRampVolume();
243 volumeRamp->IsActive();
244 volumeRamp->Terminate();
245 }
246 } // namespace AudioStandard
247 } // namesapce OHOS
248
LLVMFuzzerInitialize(const uint8_t *data, size_t size)249 extern "C" int LLVMFuzzerInitialize(const uint8_t *data, size_t size)
250 {
251 OHOS::AudioStandard::AudioFuzzTestGetPermission();
252 return 0;
253 }
254
255 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)256 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
257 {
258 /* Run your code on data */
259 OHOS::AudioStandard::GetCurNanoFuzzTest(data, size);
260 OHOS::AudioStandard::AbsoluteSleepFuzzTest(data, size);
261 OHOS::AudioStandard::RelativeSleepFuzzTest(data, size);
262 OHOS::AudioStandard::CountFuzzTest(data, size);
263 OHOS::AudioStandard::CountVolumeFuzzTest(data, size);
264 OHOS::AudioStandard::GetTimeFuzzTest(data, size);
265 OHOS::AudioStandard::AudioBlendFuzzTest(data, size);
266 OHOS::AudioStandard::VolumeRampFuzzTest(data, size);
267 return 0;
268 }
269