From c4b2fdac0b1ab7ba00a1e37692b9b6abbf1b7f0d Mon Sep 17 00:00:00 2001 From: BrainL Date: Thu, 19 Jun 2025 22:19:08 +0800 Subject: [PATCH 1/6] add FUZZ Signed-off-by: BrainL --- .../sinkserviceinitsink_fuzzer/BUILD.gn | 2 + .../sinkserviceinitsink_fuzzer.cpp | 68 +++++++++++++++++++ .../sinkstubdaudiosinkstub_fuzzer.cpp | 47 +++++++++++++ .../sourceservicedaudionotify_fuzzer/BUILD.gn | 2 + .../sourceservicedaudionotify_fuzzer.cpp | 67 ++++++++++++++++++ 5 files changed, 186 insertions(+) diff --git a/services/audiomanager/test/fuzztest/sinkserviceinitsink_fuzzer/BUILD.gn b/services/audiomanager/test/fuzztest/sinkserviceinitsink_fuzzer/BUILD.gn index 3e39547c..e355c13d 100644 --- a/services/audiomanager/test/fuzztest/sinkserviceinitsink_fuzzer/BUILD.gn +++ b/services/audiomanager/test/fuzztest/sinkserviceinitsink_fuzzer/BUILD.gn @@ -27,6 +27,8 @@ ohos_fuzztest("SinkServiceInitSinkFuzzTest") { "-O0", "-Wno-unused-variable", "-fno-omit-frame-pointer", + "-Dprivate=public", + "-Dprotected=public", ] sources = [ "sinkserviceinitsink_fuzzer.cpp" ] diff --git a/services/audiomanager/test/fuzztest/sinkserviceinitsink_fuzzer/sinkserviceinitsink_fuzzer.cpp b/services/audiomanager/test/fuzztest/sinkserviceinitsink_fuzzer/sinkserviceinitsink_fuzzer.cpp index 37088a4e..72d70e2b 100644 --- a/services/audiomanager/test/fuzztest/sinkserviceinitsink_fuzzer/sinkserviceinitsink_fuzzer.cpp +++ b/services/audiomanager/test/fuzztest/sinkserviceinitsink_fuzzer/sinkserviceinitsink_fuzzer.cpp @@ -19,6 +19,7 @@ #include #include +#include "daudio_constants.h" #include "daudio_sink_service.h" #include "daudio_sink_ipc_callback.h" #include "if_system_ability_manager.h" @@ -42,6 +43,69 @@ void SinkServiceInitSinkFuzzTest(const uint8_t* data, size_t size) dAudioSinkService->InitSink(params, dAudioSinkIpcCallback); } + +void SinkServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size < sizeof(int32_t)) { + return; + } + + FuzzedDataProvider fdp(data, size); + int32_t saId = fdp.ConsumeIntegral(); + bool runOnCreate = fdp.ConsumeBool(); + + auto dAudioSinkService = std::make_shared(saId, runOnCreate); + dAudioSinkService->OnStart(); +} + +void SinkServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size < sizeof(int32_t)) { + return; + } + + FuzzedDataProvider fdp(data, size); + int32_t saId = fdp.ConsumeIntegral(); + bool runOnCreate = fdp.ConsumeBool(); + + auto dAudioSinkService = std::make_shared(saId, runOnCreate); + dAudioSinkService->OnStop(); +} + +void SinkServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size < sizeof(int32_t)) { + return; + } + + FuzzedDataProvider fdp(data, size); + int32_t saId = fdp.ConsumeIntegral(); + bool runOnCreate = fdp.ConsumeBool(); + + auto dAudioSinkService = std::make_shared(saId, runOnCreate); + dAudioSinkService->Init(); +} + +void SinkServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size == 0) { + return; + } + + FuzzedDataProvider fdp(data, size); + int32_t fd = fdp.ConsumeIntegral(); + size_t argsCount = fdp.ConsumeIntegralInRange(0, 10); + std::vector args; + + for (size_t i = 0; i < argsCount; ++i) { + std::string utf8Str = fdp.ConsumeRandomLengthString(100); + std::u16string utf16Str(utf8Str.begin(), utf8Str.end()); + args.emplace_back(utf16Str); + } + + auto dAudioSinkService = std::make_shared(DISTRIBUTED_HARDWARE_AUDIO_SINK_SA_ID, true); + dAudioSinkService->Dump(fd, args); +} } } @@ -50,6 +114,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::SinkServiceInitSinkFuzzTest(data, size); + OHOS::DistributedHardware::SinkServiceOnStartFuzzTest(data, size); + OHOS::DistributedHardware::SinkServiceOnStopFuzzTest(data, size); + OHOS::DistributedHardware::SinkServiceInitFuzzTest(data, size); + OHOS::DistributedHardware::SinkServiceDumpFuzzTest(data, size); return 0; } diff --git a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp index cc87dd16..b736a0f1 100644 --- a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp +++ b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp @@ -20,6 +20,7 @@ #include #include +#include "daudio_sink_ipc_callback_proxy.h" #include "daudio_sink_stub.h" #include "daudio_sink_service.h" @@ -27,6 +28,7 @@ #include "if_system_ability_manager.h" #include "iservice_registry.h" +#define CONSUME_RANDOM_STRING(fdp, maxLength) fdp.ConsumeRandomLengthString(maxLength) namespace OHOS { namespace DistributedHardware { void SinkStubDaudioSinkStubFuzzTest(const uint8_t* data, size_t size) @@ -227,6 +229,49 @@ void SinkStubStopDistributedHardwareInnerFuzzTest(const uint8_t* data, size_t si pdata.WriteString(resultData); dAudioSinkService->StopDistributedHardwareInner(pdata, reply, option); } + +void SinkStubInitSinkInnerFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < (sizeof(int32_t)))) { + return; + } + FuzzedDataProvider fdp(data, size); + + int32_t saId = fdp.ConsumeIntegral(); + bool runOnCreate = fdp.ConsumeBool(); + auto dAudioSinkService = std::make_shared(saId, runOnCreate); + + MessageParcel pdata; + MessageParcel reply; + MessageOption option; + + std::string param = fdp.ConsumeRandomLengthString(100); + sptr remoteObject = nullptr; + pdata.WriteString(param); + pdata.WriteRemoteObject(remoteObject); + dAudioSinkService->InitSinkInner(pdata, reply, option); +} + +void SinkStubReleaseSinkInnerFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size == 0) { + return; + } + FuzzedDataProvider fdp(data, size); + + int32_t saId = fdp.ConsumeIntegral(); + bool runOnCreate = fdp.ConsumeBool(); + auto dAudioSinkService = std::make_shared(saId, runOnCreate); + + MessageParcel pdata; + MessageParcel reply; + MessageOption option; + + std::string dummyData = CONSUME_RANDOM_STRING(fdp, 100); + pdata.WriteString(dummyData); + + dAudioSinkService->ReleaseSinkInner(pdata, reply, option); +} } } @@ -241,5 +286,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) OHOS::DistributedHardware::SinkStubPauseDistributedHardwareInnerFuzzTest(data, size); OHOS::DistributedHardware::SinkStubResumeDistributedHardwareInnerFuzzTest(data, size); OHOS::DistributedHardware::SinkStubStopDistributedHardwareInnerFuzzTest(data, size); + OHOS::DistributedHardware::SinkStubInitSinkInnerFuzzTest(data, size); + OHOS::DistributedHardware::SinkStubReleaseSinkInnerFuzzTest(data, size); return 0; } diff --git a/services/audiomanager/test/fuzztest/sourceservicedaudionotify_fuzzer/BUILD.gn b/services/audiomanager/test/fuzztest/sourceservicedaudionotify_fuzzer/BUILD.gn index b9723e07..9f64632c 100644 --- a/services/audiomanager/test/fuzztest/sourceservicedaudionotify_fuzzer/BUILD.gn +++ b/services/audiomanager/test/fuzztest/sourceservicedaudionotify_fuzzer/BUILD.gn @@ -27,6 +27,8 @@ ohos_fuzztest("SourceServiceDAudioNotifyFuzzTest") { "-O0", "-Wno-unused-variable", "-fno-omit-frame-pointer", + "-Dprivate=public", + "-Dprotected=public", ] sources = [ "sourceservicedaudionotify_fuzzer.cpp" ] diff --git a/services/audiomanager/test/fuzztest/sourceservicedaudionotify_fuzzer/sourceservicedaudionotify_fuzzer.cpp b/services/audiomanager/test/fuzztest/sourceservicedaudionotify_fuzzer/sourceservicedaudionotify_fuzzer.cpp index 4500a3c5..925e883a 100644 --- a/services/audiomanager/test/fuzztest/sourceservicedaudionotify_fuzzer/sourceservicedaudionotify_fuzzer.cpp +++ b/services/audiomanager/test/fuzztest/sourceservicedaudionotify_fuzzer/sourceservicedaudionotify_fuzzer.cpp @@ -19,6 +19,7 @@ #include #include +#include "daudio_constants.h" #include "daudio_source_service.h" #include "if_system_ability_manager.h" #include "iservice_registry.h" @@ -43,6 +44,68 @@ void SourceServiceDAudioNotifyFuzzTest(const uint8_t* data, size_t size) dAudioSourceService->DAudioNotify(devId, dhId, eventType, eventContent); } + +void SourceServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size < sizeof(int32_t)) { + return; + } + FuzzedDataProvider fdp(data, size); + + int32_t saId = fdp.ConsumeIntegral(); + bool runOnCreate = fdp.ConsumeBool(); + + auto dAudioSourceService = std::make_shared(saId, runOnCreate); + dAudioSourceService->OnStart(); +} + +void SourceServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size < sizeof(int32_t)) { + return; + } + FuzzedDataProvider fdp(data, size); + + int32_t saId = fdp.ConsumeIntegral(); + bool runOnCreate = fdp.ConsumeBool(); + + auto dAudioSourceService = std::make_shared(saId, runOnCreate); + dAudioSourceService->OnStop(); +} + +void SourceServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size < sizeof(int32_t)) { + return; + } + FuzzedDataProvider fdp(data, size); + + int32_t saId = fdp.ConsumeIntegral(); + bool runOnCreate = fdp.ConsumeBool(); + + auto dAudioSourceService = std::make_shared(saId, runOnCreate); + dAudioSourceService->Init(); +} + +void SourceServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size == 0) { + return; + } + FuzzedDataProvider fdp(data, size); + + int32_t fd = fdp.ConsumeIntegral(); + size_t argsCount = fdp.ConsumeIntegralInRange(0, 10); + std::vector args; + for (size_t i = 0; i < argsCount; ++i) { + std::string utf8Str = fdp.ConsumeRandomLengthString(100); + std::u16string utf16Str(utf8Str.begin(), utf8Str.end()); + args.emplace_back(utf16Str); + } + + auto dAudioSourceService = std::make_shared(DISTRIBUTED_HARDWARE_AUDIO_SOURCE_SA_ID, true); + dAudioSourceService->Dump(fd, args); +} } } @@ -51,6 +114,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::SourceServiceDAudioNotifyFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceOnStartFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceOnStopFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceInitFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceDumpFuzzTest(data, size); return 0; } -- Gitee From 745a1db08c4d2260398bc2ecc9c8930b075fda9a Mon Sep 17 00:00:00 2001 From: BrainL Date: Thu, 19 Jun 2025 22:27:28 +0800 Subject: [PATCH 2/6] add FUZZ Signed-off-by: BrainL --- .../sinkstubdaudiosinkstub_fuzzer.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp index b736a0f1..d51662b0 100644 --- a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp +++ b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp @@ -28,7 +28,7 @@ #include "if_system_ability_manager.h" #include "iservice_registry.h" -#define CONSUME_RANDOM_STRING(fdp, maxLength) fdp.ConsumeRandomLengthString(maxLength) +#define CONSUME_RANDOM_STRING(fdp, maxLength) (fdp.ConsumeRandomLengthString(maxLength)) namespace OHOS { namespace DistributedHardware { void SinkStubDaudioSinkStubFuzzTest(const uint8_t* data, size_t size) -- Gitee From e00dc3f0a33e0edb80cd1a60c03e8e54acf04241 Mon Sep 17 00:00:00 2001 From: BrainL Date: Thu, 19 Jun 2025 22:36:37 +0800 Subject: [PATCH 3/6] add FUZZ Signed-off-by: BrainL --- .../sinkstubdaudiosinkstub_fuzzer.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp index d51662b0..be19e441 100644 --- a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp +++ b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp @@ -28,7 +28,7 @@ #include "if_system_ability_manager.h" #include "iservice_registry.h" -#define CONSUME_RANDOM_STRING(fdp, maxLength) (fdp.ConsumeRandomLengthString(maxLength)) +#define CONSUME_RANDOM_STRING(fdp, maxLength) (fdp.ConsumeRandomLengthString((maxLength))) namespace OHOS { namespace DistributedHardware { void SinkStubDaudioSinkStubFuzzTest(const uint8_t* data, size_t size) -- Gitee From 857b2fa97f89c806cd558e54c0db7bdb367b98a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9F=A6=E5=9B=BD=E5=BA=86?= Date: Sat, 21 Jun 2025 10:53:16 +0800 Subject: [PATCH 4/6] add FUZZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 韦国庆 --- .../sinkstubdaudiosinkstub_fuzzer.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp index be19e441..60d6af21 100644 --- a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp +++ b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp @@ -28,7 +28,9 @@ #include "if_system_ability_manager.h" #include "iservice_registry.h" -#define CONSUME_RANDOM_STRING(fdp, maxLength) (fdp.ConsumeRandomLengthString((maxLength))) +inline std::string ConsumeRandomString(FuzzDataProcessor& fdp, size_t maxLength) { + return fdp.ConsumeRandomLengthString(maxLength); +} namespace OHOS { namespace DistributedHardware { void SinkStubDaudioSinkStubFuzzTest(const uint8_t* data, size_t size) @@ -267,7 +269,7 @@ void SinkStubReleaseSinkInnerFuzzTest(const uint8_t* data, size_t size) MessageParcel reply; MessageOption option; - std::string dummyData = CONSUME_RANDOM_STRING(fdp, 100); + std::string dummyData = ConsumeRandomString(fdp, 100); pdata.WriteString(dummyData); dAudioSinkService->ReleaseSinkInner(pdata, reply, option); -- Gitee From 2883621a1286e13c17525029816e60d9b277259e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9F=A6=E5=9B=BD=E5=BA=86?= Date: Sat, 21 Jun 2025 11:28:17 +0800 Subject: [PATCH 5/6] addFUZZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 韦国庆 --- .../sinkstubdaudiosinkstub_fuzzer.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp index 60d6af21..c0bcf076 100644 --- a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp +++ b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp @@ -28,7 +28,7 @@ #include "if_system_ability_manager.h" #include "iservice_registry.h" -inline std::string ConsumeRandomString(FuzzDataProcessor& fdp, size_t maxLength) { +inline std::string ConsumeRandomString(FuzzedDataProvider& fdp, size_t maxLength) { return fdp.ConsumeRandomLengthString(maxLength); } namespace OHOS { -- Gitee From 410f7d96f51b5ad1e8af2bd77636588730430eb8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9F=A6=E5=9B=BD=E5=BA=86?= Date: Sat, 21 Jun 2025 11:40:14 +0800 Subject: [PATCH 6/6] add FUZZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 韦国庆 --- .../sinkstubdaudiosinkstub_fuzzer.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp index c0bcf076..21f6bc24 100644 --- a/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp +++ b/services/audiomanager/test/fuzztest/sinkstubdaudiosinkstub_fuzzer/sinkstubdaudiosinkstub_fuzzer.cpp @@ -28,7 +28,8 @@ #include "if_system_ability_manager.h" #include "iservice_registry.h" -inline std::string ConsumeRandomString(FuzzedDataProvider& fdp, size_t maxLength) { +inline std::string ConsumeRandomString(FuzzedDataProvider& fdp, size_t maxLength) +{ return fdp.ConsumeRandomLengthString(maxLength); } namespace OHOS { -- Gitee