diff --git a/test/fuzztest/bluetoothdevicemanager_fuzzer/BUILD.gn b/test/fuzztest/bluetoothdevicemanager_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..2d3a392b468d131f1679e6bf96670ddc19a0c5d7 --- /dev/null +++ b/test/fuzztest/bluetoothdevicemanager_fuzzer/BUILD.gn @@ -0,0 +1,67 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/test.gni") +import("../../../config.gni") + +ohos_fuzztest("BluetoothDeviceManagerFuzzTest") { + module_out_path = "audio_framework/audio_framework_route" + fuzz_config_file = "../bluetoothdevicemanager_fuzzer" + + include_dirs = [ + "../../../frameworks/native/bluetoothclient", + ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + "-fno-access-control", + ] + + sources = [ + "bluetooth_device_manager_fuzzer.cpp", + "../../../frameworks/native/bluetoothclient/bluetooth_device_manager.cpp", + "../../../frameworks/native/bluetoothclient/bluetooth_device_utils.cpp", + ] + + configs = [ "../../../services/audio_service:audio_service_config" ] + cflags_cc = [ "-std=c++20" ] + + deps = [ + "../../../frameworks/native/bluetoothclient:audio_bluetooth_client", + "../../../services/audio_policy:audio_foundation", + "../../../frameworks/native/audioutils:audio_utils", + ] + external_deps = [ + "access_token:libaccesstoken_sdk", + "bluetooth:btframework", + "c_utils:utils", + "hilog:libhilog", + "ipc:ipc_single", + "qos_manager:concurrent_task_client", + "safwk:system_ability_fwk", + ] + + defines = [] + if (use_libfuzzer || use_clang_coverage) { + defines += [ "TEST_COVERAGE" ] + } +} + +group("fuzztest") { + testonly = true + deps = [ ":BluetoothDeviceManagerFuzzTest" ] +} diff --git a/test/fuzztest/bluetoothdevicemanager_fuzzer/bluetooth_device_manager_fuzzer.cpp b/test/fuzztest/bluetoothdevicemanager_fuzzer/bluetooth_device_manager_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..176ff30fdbfd27a5eee19ad23ddb876ccac99951 --- /dev/null +++ b/test/fuzztest/bluetoothdevicemanager_fuzzer/bluetooth_device_manager_fuzzer.cpp @@ -0,0 +1,295 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include "bluetooth_device_manager.h" +#include "bluetooth_device_utils.h" +#include "audio_info.h" +#include "audio_engine_log.h" +#include "idevice_status_observer.h" +#include "../fuzz_utils.h" + +namespace OHOS { +namespace AudioStandard { +using namespace std; +using namespace Bluetooth; + +FuzzUtils &g_fuzzUtils = FuzzUtils::GetInstance(); +const size_t FUZZ_INPUT_SIZE_THRESHOLD = 10; +const int32_t TRANSPORT = 2; + +typedef void (*TestFuncs)(); + +class DummyDeviceStatusObserver : public IDeviceStatusObserver { +public: + void OnDeviceStatusUpdated(DeviceType devType, bool isConnected, + const std::string &macAddress, const std::string &deviceName, + const AudioStreamInfo &streamInfo, DeviceRole role = DEVICE_ROLE_NONE, bool hasPair = false) override {} + + void OnMicrophoneBlockedUpdate(DeviceType devType, DeviceBlockStatus status) override {} + + void OnPnpDeviceStatusUpdated(AudioDeviceDescriptor &desc, bool isConnected) override {} + + void OnDeviceConfigurationChanged(DeviceType deviceType, + const std::string &macAddress, const std::string &deviceName, + const AudioStreamInfo &streamInfo) override {} + + void OnDeviceStatusUpdated(DStatusInfo statusInfo, bool isStop = false) override {} + + void OnServiceConnected(AudioServiceIndex serviceIndex) override {} + + void OnServiceDisconnected(AudioServiceIndex serviceIndex) override {} + + void OnForcedDeviceSelected(DeviceType devType, const std::string &macAddress) override {} + + void OnDeviceStatusUpdated(AudioDeviceDescriptor &desc, bool isConnected) override {} + + void OnDeviceInfoUpdated(AudioDeviceDescriptor &desc, const DeviceInfoUpdateCommand updateCommand) override {} +}; + +void RegisterDeviceObserverFuzzTest() +{ + DummyDeviceStatusObserver observer; + RegisterDeviceObserver(observer); + UnregisterDeviceObserver(); +} + +void SetMediaStackFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + int32_t action = g_fuzzUtils.GetData(); + + MediaBluetoothDeviceManager deviceManager; + deviceManager.SetMediaStack(device, action); +} + +void SendUserSelectionEventFuzzTest() +{ + DeviceType devType = g_fuzzUtils.GetData(); + std::string macAddress = "00:11:22:33:44:55"; + int32_t eventType = g_fuzzUtils.GetData(); + SendUserSelectionEvent(devType, macAddress, eventType); +} + +void NotifyToUpdateAudioDeviceFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + AudioDeviceDescriptor desc; + DeviceStatus status = g_fuzzUtils.GetData(); + MediaBluetoothDeviceManager deviceManager; + deviceManager.NotifyToUpdateAudioDevice(device, desc, status); +} + +void IsA2dpBluetoothDeviceConnectingFuzzTest() +{ + MediaBluetoothDeviceManager deviceManager; + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + bool isConnect = g_fuzzUtils.GetData(); + int32_t action = g_fuzzUtils.GetData(); + if (isConnect) { + deviceManager.SetMediaStack(device, action); + } + deviceManager.IsA2dpBluetoothDeviceConnecting("00:11:22:33:44:55"); +} + +void UpdateA2dpDeviceConfigurationFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + AudioStreamInfo streamInfo; + MediaBluetoothDeviceManager deviceManager; + deviceManager.UpdateA2dpDeviceConfiguration(device, streamInfo); + deviceManager.GetAllA2dpBluetoothDevice(); + deviceManager.GetA2dpVirtualDeviceList(); + deviceManager.ClearAllA2dpBluetoothDevice(); +} + +void SetA2dpInStackFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + int32_t action = g_fuzzUtils.GetData(); + + AudioStreamInfo streamInfo; + + A2dpInBluetoothDeviceManager deviceManager; + deviceManager.SetA2dpInStack(device, streamInfo, action); +} + +void A2dpInNotifyToUpdateAudioDeviceFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + AudioStreamInfo streamInfo; + AudioDeviceDescriptor desc; + DeviceStatus status = g_fuzzUtils.GetData(); + A2dpInBluetoothDeviceManager deviceManager; + deviceManager.NotifyToUpdateAudioDevice(device, streamInfo, desc, status); +} + +void GetA2dpInDeviceStreamInfoFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + std::vector macAddresses = { + "00:11:22:33:44:55", + "AA:BB:CC:DD:EE:FF", + "12:34:56:78:9A:BC" + }; + size_t idx = g_fuzzUtils.GetData() % macAddresses.size(); + + AudioStreamInfo streamInfo; + A2dpInBluetoothDeviceManager deviceManager; + int32_t action = g_fuzzUtils.GetData(); + deviceManager.SetA2dpInStack(device, streamInfo, action); + + deviceManager.GetA2dpInDeviceStreamInfo(macAddresses[idx], streamInfo); +} + +void GetAllA2dpInBluetoothDeviceFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + AudioStreamInfo streamInfo; + A2dpInBluetoothDeviceManager deviceManager; + deviceManager.GetAllA2dpInBluetoothDevice(); + deviceManager.ClearAllA2dpInBluetoothDevice(); + deviceManager.ClearAllA2dpInStreamInfo(); +} + +void SetHfpStackFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + int32_t action = g_fuzzUtils.GetData(); + + HfpBluetoothDeviceManager deviceManager; + deviceManager.SetHfpStack(device, action); +} + +void HfpNotifyToUpdateAudioDeviceFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + AudioDeviceDescriptor desc; + DeviceStatus status = g_fuzzUtils.GetData(); + HfpBluetoothDeviceManager deviceManager; + deviceManager.NotifyToUpdateAudioDevice(device, desc, status); +} + +void IsHfpBluetoothDeviceConnectingFuzzTest() +{ + HfpBluetoothDeviceManager deviceManager; + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + bool isConnect = g_fuzzUtils.GetData(); + int32_t action = g_fuzzUtils.GetData(); + if (isConnect) { + deviceManager.SetHfpStack(device, action); + } + + deviceManager.IsHfpBluetoothDeviceConnecting("00:11:22:33:44:55"); +} + +void GetConnectedHfpBluetoothDeviceFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + std::vector macAddresses = { + "00:11:22:33:44:55", + "AA:BB:CC:DD:EE:FF", + "12:34:56:78:9A:BC" + }; + size_t idx = g_fuzzUtils.GetData() % macAddresses.size(); + + HfpBluetoothDeviceManager deviceManager; + int32_t action = g_fuzzUtils.GetData(); + deviceManager.SetHfpStack(device, action); + deviceManager.GetConnectedHfpBluetoothDevice(macAddresses[idx], device); +} + +void GetAllHfpBluetoothDeviceFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + HfpBluetoothDeviceManager deviceManager; + deviceManager.GetAllHfpBluetoothDevice(); + deviceManager.GetHfpVirtualDeviceList(); + deviceManager.ClearAllHfpBluetoothDevice(); +} + +void OnScoStateChangedFuzzTest() +{ + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + HfpBluetoothDeviceManager deviceManager; + bool isScoConnected = g_fuzzUtils.GetData(); + int32_t reason = g_fuzzUtils.GetData(); + deviceManager.OnScoStateChanged(device, isScoConnected, reason); +} + +void RegisterDisconnectScoFuncFuzzTest() +{ + HfpBluetoothDeviceManager deviceManager; + deviceManager.RegisterDisconnectScoFunc(nullptr); +} + +void TryDisconnectScoAsyncFuzzTest() +{ + HfpBluetoothDeviceManager deviceManager; + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + deviceManager.TryDisconnectScoAsync(device); +} + +void OnDeviceCategoryUpdatedFuzzTest() +{ + HfpBluetoothDeviceManager deviceManager; + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + AudioDeviceDescriptor desc; + deviceManager.OnDeviceCategoryUpdated(device, desc); +} + +void OnDeviceEnableUpdatedFuzzTest() +{ + HfpBluetoothDeviceManager deviceManager; + BluetoothRemoteDevice device("00:11:22:33:44:55", TRANSPORT); + AudioDeviceDescriptor desc; + deviceManager.OnDeviceEnableUpdated(device, desc); +} +vector g_testFuncs = { + RegisterDeviceObserverFuzzTest, + SetMediaStackFuzzTest, + SendUserSelectionEventFuzzTest, + NotifyToUpdateAudioDeviceFuzzTest, + IsA2dpBluetoothDeviceConnectingFuzzTest, + UpdateA2dpDeviceConfigurationFuzzTest, + SetA2dpInStackFuzzTest, + A2dpInNotifyToUpdateAudioDeviceFuzzTest, + GetA2dpInDeviceStreamInfoFuzzTest, + GetAllA2dpInBluetoothDeviceFuzzTest, + SetHfpStackFuzzTest, + HfpNotifyToUpdateAudioDeviceFuzzTest, + IsHfpBluetoothDeviceConnectingFuzzTest, + GetConnectedHfpBluetoothDeviceFuzzTest, + GetAllHfpBluetoothDeviceFuzzTest, + OnScoStateChangedFuzzTest, + RegisterDisconnectScoFuncFuzzTest, + TryDisconnectScoAsyncFuzzTest, + OnDeviceCategoryUpdatedFuzzTest, + OnDeviceEnableUpdatedFuzzTest, +}; + +} // namespace AudioStandard +} // namesapce OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + if (size < OHOS::AudioStandard::FUZZ_INPUT_SIZE_THRESHOLD) { + return 0; + } + + OHOS::AudioStandard::g_fuzzUtils.fuzzTest(data, size, OHOS::AudioStandard::g_testFuncs); + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/bluetoothdevicemanager_fuzzer/project.xml b/test/fuzztest/bluetoothdevicemanager_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..afd90798db45dd3853b00cf9c476ad4b245107e1 --- /dev/null +++ b/test/fuzztest/bluetoothdevicemanager_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + \ No newline at end of file