From c205786df7b5e4eff2f7e96fe21e55aac11b916b Mon Sep 17 00:00:00 2001 From: zhangwenting Date: Fri, 22 Aug 2025 14:18:15 +0800 Subject: [PATCH] Add audio framework fuzz test Signed-off-by: zhangwenting Change-Id: I64088695054fc33cade6481bf4b701090a2a11a4 --- test/BUILD.gn | 3 + .../audiocapturersession_fuzzer/BUILD.gn | 77 ++++ .../audio_capturer_session_fuzzer.cpp | 174 +++++++++ .../audiocapturersession_fuzzer/project.xml | 25 ++ .../audio_core_service_private_fuzzer.cpp | 294 +++++++++++++++- .../audio_effect_fuzzer.cpp | 3 +- .../audiopolicyconfigmanager_fuzzer/BUILD.gn | 66 ++++ .../audio_policy_config_manager_fuzzer.cpp | 240 +++++++++++++ .../corpus/init | 13 + .../project.xml | 25 ++ .../audio_service_common_enhance_fuzzer.cpp | 14 +- test/fuzztest/audiosession_fuzzer/BUILD.gn | 52 +++ .../audio_session_fuzzer.cpp | 329 ++++++++++++++++++ test/fuzztest/audiosession_fuzzer/corpus/init | 13 + test/fuzztest/audiosession_fuzzer/project.xml | 25 ++ .../format_converter_fuzzer.cpp | 2 +- .../hpaecapturermanager_fuzzer.cpp | 223 ++++++++++++ 17 files changed, 1568 insertions(+), 10 deletions(-) create mode 100644 test/fuzztest/audiocapturersession_fuzzer/BUILD.gn create mode 100644 test/fuzztest/audiocapturersession_fuzzer/audio_capturer_session_fuzzer.cpp create mode 100644 test/fuzztest/audiocapturersession_fuzzer/project.xml create mode 100644 test/fuzztest/audiopolicyconfigmanager_fuzzer/BUILD.gn create mode 100644 test/fuzztest/audiopolicyconfigmanager_fuzzer/audio_policy_config_manager_fuzzer.cpp create mode 100644 test/fuzztest/audiopolicyconfigmanager_fuzzer/corpus/init create mode 100644 test/fuzztest/audiopolicyconfigmanager_fuzzer/project.xml create mode 100644 test/fuzztest/audiosession_fuzzer/BUILD.gn create mode 100644 test/fuzztest/audiosession_fuzzer/audio_session_fuzzer.cpp create mode 100644 test/fuzztest/audiosession_fuzzer/corpus/init create mode 100644 test/fuzztest/audiosession_fuzzer/project.xml diff --git a/test/BUILD.gn b/test/BUILD.gn index c2f59bb340..315081d37e 100644 --- a/test/BUILD.gn +++ b/test/BUILD.gn @@ -203,6 +203,7 @@ group("audio_fuzz_test") { "fuzztest/audioaffinitymanager_fuzzer:fuzztest", "fuzztest/audiobackgroundmanager_fuzzer:fuzztest", "fuzztest/audiobufferbase_fuzzer:fuzztest", + "fuzztest/audiocapturersession_fuzzer:fuzztest", "fuzztest/audioclienttrackercallbacklistener_fuzzer:fuzztest", "fuzztest/audiocollaborativeservice_fuzzer:fuzztest", "fuzztest/audioconnecteddevice_fuzzer:fuzztest", @@ -239,6 +240,7 @@ group("audio_fuzz_test") { # "fuzztest/audiopolicyanother_fuzzer:fuzztest", # "fuzztest/audiopolicyclient_fuzzer:fuzztest", + "fuzztest/audiopolicyconfigmanager_fuzzer:fuzztest", "fuzztest/audiopolicymanager_fuzzer:fuzztest", "fuzztest/audiopolicymanagerlistenerstubimpl_fuzzer:fuzztest", @@ -270,6 +272,7 @@ group("audio_fuzz_test") { "fuzztest/audioserviceserversrc_fuzzer:fuzztest", "fuzztest/audioserviceserversrcenhance_fuzzer:fuzztest", "fuzztest/audioservicestub_fuzzer:fuzztest", + "fuzztest/audiosession_fuzzer:fuzztest", "fuzztest/audiosessionservice_fuzzer:fuzztest", "fuzztest/audiosocketthread_fuzzer:fuzztest", "fuzztest/audiospatializationservice_fuzzer:fuzztest", diff --git a/test/fuzztest/audiocapturersession_fuzzer/BUILD.gn b/test/fuzztest/audiocapturersession_fuzzer/BUILD.gn new file mode 100644 index 0000000000..3adc856a53 --- /dev/null +++ b/test/fuzztest/audiocapturersession_fuzzer/BUILD.gn @@ -0,0 +1,77 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/test.gni") + +ohos_fuzztest("AudioCapturerSessionFuzzTest") { + module_out_path = "audio_framework/audio_framework_route" + fuzz_config_file = "../audiocapturersession_fuzzer" + + include_dirs = [ + "../../../frameworks/native/audioadapter/include", + "../../../services/audio_policy/server/infra/datashare/include", + "../../../services/audio_policy/server/infra/async_action_handler/include", + "../../../services/audio_policy/server/domain/device/include", + "../../../services/audio_policy/server/domain/router", + "../../../services/audio_policy/server/domain/stream", + "../../../services/audio_policy/server/infra/config/parser/include", + "../../../services/audio_policy/server/infra/ipc_proxy/include", + "../../../services/audio_policy/server/domain/device/src/a2dp", + "../../../services/audio_policy/server/infra/state_monitor", + "../../../frameworks/native/bluetoothclient", + ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + "-fno-access-control", + ] + + sources = [ + "audio_capturer_session_fuzzer.cpp" + ] + + configs = [ "../../../services/audio_service:audio_service_config" ] + + deps = [ + "../../../services/audio_service:audio_common", + "../../../services/audio_service:audio_service", + "../../../services/audio_policy:audio_policy_service_static", + ] + + external_deps = [ + "ability_base:want", + "access_token:libaccesstoken_sdk", + "bounds_checking_function:libsec_shared", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "hilog:libhilog", + "ipc:ipc_single", + "data_share:datashare_consumer", + "kv_store:distributeddata_inner", + "ffrt:libffrt", + "os_account:os_account_innerkits", + "power_manager:powermgr_client", + "bluetooth:btframework", + "eventhandler:libeventhandler", + ] +} + +group("fuzztest") { + testonly = true + deps = [ ":AudioCapturerSessionFuzzTest" ] +} diff --git a/test/fuzztest/audiocapturersession_fuzzer/audio_capturer_session_fuzzer.cpp b/test/fuzztest/audiocapturersession_fuzzer/audio_capturer_session_fuzzer.cpp new file mode 100644 index 0000000000..47eefbf920 --- /dev/null +++ b/test/fuzztest/audiocapturersession_fuzzer/audio_capturer_session_fuzzer.cpp @@ -0,0 +1,174 @@ +/* + * Copyright (c) 2024-2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "audio_log.h" +#include "audio_capturer_session.h" +#include "../fuzz_utils.h" + +namespace OHOS { +namespace AudioStandard { +using namespace std; +FuzzUtils &g_fuzzUtils = FuzzUtils::GetInstance(); + +typedef void (*TestFuncs)(); + +void LoadInnerCapturerSinkFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + std::string moduleName = "moduleName"; + AudioStreamInfo streamInfo; + session.LoadInnerCapturerSink(moduleName, streamInfo); +} + +void UnloadInnerCapturerSinkFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + std::string moduleName = "moduleName"; + session.UnloadInnerCapturerSink(moduleName); +} + +void HandleRemoteCastDeviceFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioStreamInfo streamInfo; + bool isConnected = g_fuzzUtils.GetData(); + session.HandleRemoteCastDevice(isConnected, streamInfo); +} + +void FindRunningNormalSessionFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioStreamDescriptor runningSessionInfo; + uint32_t sessionId = g_fuzzUtils.GetData(); + session.FindRunningNormalSession(sessionId, runningSessionInfo); +} + +void ConstructWakeupAudioModuleInfoFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioStreamInfo streamInfo; + AudioModuleInfo audioModuleInfo; + session.ConstructWakeupAudioModuleInfo(streamInfo, audioModuleInfo); +} + +void SetWakeUpAudioCapturerFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + InternalAudioCapturerOptions options; + session.SetWakeUpAudioCapturer(options); +} + +void SetWakeUpAudioCapturerFromAudioServerFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioProcessConfig config; + session.SetWakeUpAudioCapturerFromAudioServer(config); +} + +void CloseWakeUpAudioCapturerFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + session.CloseWakeUpAudioCapturer(); +} + +void FillWakeupStreamPropInfoFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioStreamInfo streamInfo; + AudioModuleInfo audioModuleInfo; + std::shared_ptr pipeInfo; + session.FillWakeupStreamPropInfo(streamInfo, pipeInfo, audioModuleInfo); +} + +void IsVoipDeviceChangedFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioDeviceDescriptor inputDevice; + AudioDeviceDescriptor outputDevice; + session.IsVoipDeviceChanged(inputDevice, outputDevice); +} + +void SetInputDeviceTypeForReloadFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioDeviceDescriptor inputDevice; + session.SetInputDeviceTypeForReload(inputDevice); +} + +void GetInputDeviceTypeForReloadFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + session.GetInputDeviceTypeForReload(); +} + +void GetEnhancePropByNameV3FuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioEffectPropertyArrayV3 propertyArray; + std::string propName = "propName"; + session.GetEnhancePropByNameV3(propertyArray, propName); +} + +void ReloadSourceForEffectFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioEffectPropertyArrayV3 propertyArray; + AudioEffectPropertyArrayV3 newPropertyArray; + session.ReloadSourceForEffect(propertyArray, newPropertyArray); +} + +void GetEnhancePropByNameFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioEnhancePropertyArray propertyArray; + std::string propName = "propName"; + session.GetEnhancePropByName(propertyArray, propName); +} + +void ReloadSourceForEffectDifferentArgsFuzzTest() +{ + AudioCapturerSession& session = AudioCapturerSession::GetInstance(); + AudioEnhancePropertyArray oldPropertyArray; + AudioEnhancePropertyArray newPropertyArray; + session.ReloadSourceForEffect(oldPropertyArray, newPropertyArray); +} + +vector g_testFuncs = { + LoadInnerCapturerSinkFuzzTest, + UnloadInnerCapturerSinkFuzzTest, + HandleRemoteCastDeviceFuzzTest, + FindRunningNormalSessionFuzzTest, + ConstructWakeupAudioModuleInfoFuzzTest, + SetWakeUpAudioCapturerFuzzTest, + SetWakeUpAudioCapturerFromAudioServerFuzzTest, + CloseWakeUpAudioCapturerFuzzTest, + FillWakeupStreamPropInfoFuzzTest, + IsVoipDeviceChangedFuzzTest, + SetInputDeviceTypeForReloadFuzzTest, + GetInputDeviceTypeForReloadFuzzTest, + GetEnhancePropByNameV3FuzzTest, + ReloadSourceForEffectFuzzTest, + GetEnhancePropByNameFuzzTest, + ReloadSourceForEffectDifferentArgsFuzzTest, +}; +} // namespace AudioStandard +} // namesapce OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + OHOS::AudioStandard::g_fuzzUtils.fuzzTest(data, size, OHOS::AudioStandard::g_testFuncs); + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/audiocapturersession_fuzzer/project.xml b/test/fuzztest/audiocapturersession_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/audiocapturersession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/audiocoreserviceprivate_fuzzer/audio_core_service_private_fuzzer.cpp b/test/fuzztest/audiocoreserviceprivate_fuzzer/audio_core_service_private_fuzzer.cpp index e989cc26d8..5f94ea9619 100644 --- a/test/fuzztest/audiocoreserviceprivate_fuzzer/audio_core_service_private_fuzzer.cpp +++ b/test/fuzztest/audiocoreserviceprivate_fuzzer/audio_core_service_private_fuzzer.cpp @@ -43,6 +43,7 @@ static size_t g_dataSize = 0; static size_t g_pos; const size_t THRESHOLD = 10; static int32_t NUM_2 = 2; +static const int32_t MEDIA_SERVICE_UID = 1013; typedef void (*TestFuncs)(); @@ -151,6 +152,14 @@ const vector g_testDeviceRoles = { DEVICE_ROLE_MAX, }; +vector AudioStreamStatusVec = { + STREAM_STATUS_NEW, + STREAM_STATUS_STARTED, + STREAM_STATUS_PAUSED, + STREAM_STATUS_STOPPED, + STREAM_STATUS_RELEASED, +}; + void AudioCoreServicePrivateFetchRendererPipesAndExecuteFuzzTest() { auto audioCoreService = std::make_shared(); @@ -160,6 +169,10 @@ void AudioCoreServicePrivateFetchRendererPipesAndExecuteFuzzTest() std::vector> streamDescs; AudioStreamDeviceChangeReasonExt::ExtEnum extEnum = GetData(); AudioStreamDeviceChangeReasonExt reason(extEnum); + audioCoreService->audioA2dpOffloadManager_ = std::make_shared(); + if (audioCoreService->audioA2dpOffloadManager_ == nullptr) { + return; + } audioCoreService->FetchRendererPipesAndExecute(streamDescs, reason); } @@ -233,6 +246,10 @@ void AudioCoreServicePrivateOnDeviceStatusUpdatedFuzzTest() if (audioCoreService == nullptr) { return; } + audioCoreService->audioA2dpOffloadManager_ = std::make_shared(); + if (audioCoreService->audioA2dpOffloadManager_ == nullptr) { + return; + } AudioDeviceDescriptor desc; bool isConnect = GetData() % NUM_2; audioCoreService->OnDeviceStatusUpdated(desc, isConnect); @@ -765,6 +782,7 @@ void AudioCoreServicePrivateMoveToRemoteOutputDeviceFuzzTest() sinkInputIds.push_back(sinkInputId); std::shared_ptr pipeInfo = std::make_shared(); std::shared_ptr remoteDeviceDescriptor = std::make_shared(); + remoteDeviceDescriptor->networkId_ = LOCAL_NETWORK_ID; audioCoreService->MoveToRemoteOutputDevice(sinkInputIds, pipeInfo, remoteDeviceDescriptor); } @@ -777,6 +795,7 @@ void AudioCoreServicePrivateMoveToRemoteInputDeviceFuzzTest() std::vector sourceOutputs; SourceOutput sourceOutput; std::shared_ptr remoteDeviceDescriptor = std::make_shared(); + remoteDeviceDescriptor->networkId_ = LOCAL_NETWORK_ID; audioCoreService->MoveToRemoteInputDevice(sourceOutputs, remoteDeviceDescriptor); } @@ -871,9 +890,10 @@ void AudioCoreServicePrivateHandleStreamStatusToCapturerStateFuzzTest() if (audioCoreService == nullptr || testAudioStreamStatus.size() == 0) { return; } - - AudioStreamStatus status = testAudioStreamStatus[GetData() % testAudioStreamStatus.size()]; - audioCoreService->HandleStreamStatusToCapturerState(status); + for (size_t i = 0; i < testAudioStreamStatus.size(); i++) { + AudioStreamStatus status = testAudioStreamStatus[i]; + audioCoreService->HandleStreamStatusToCapturerState(status); + } } void AudioCoreServicePrivateIsPaRouteFuzzTest() @@ -1345,6 +1365,261 @@ void AudioCoreServicePrivateSwitchActiveHearingAidDeviceFuzzTest() audioCoreService->SwitchActiveHearingAidDevice(audioDeviceDescriptor); } +void AudioCoreServiceUpdateActiveDeviceAndVolumeBeforeMoveSessionFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::shared_ptr audioStreamDescriptor = std::make_shared(); + if (audioStreamDescriptor == nullptr) { + return; + } + uint32_t index = GetData() % AudioStreamStatusVec.size(); + audioStreamDescriptor->streamStatus_ = AudioStreamStatusVec[index]; + std::shared_ptr audioDeviceDescriptor = std::make_shared(); + if (audioDeviceDescriptor == nullptr) { + return; + } + std::vector insertList1 = {"00:00:00:00:00:00", "abc"}; + uint32_t insertListCount = GetData() % insertList1.size(); + std::string macAddress = insertList1[insertListCount]; + audioDeviceDescriptor->macAddress_ = macAddress; + audioDeviceDescriptor->deviceRole_ = g_testDeviceRoles[GetData() % g_testDeviceRoles.size()]; + uint32_t deviceTypeCount = GetData() % DeviceTypeVec.size(); + audioDeviceDescriptor->deviceType_ = DeviceTypeVec[deviceTypeCount]; + audioStreamDescriptor->newDeviceDescs_.clear(); + audioStreamDescriptor->newDeviceDescs_.push_back(audioDeviceDescriptor); + audioStreamDescriptor->oldDeviceDescs_.clear(); + audioStreamDescriptor->oldDeviceDescs_.push_back(audioDeviceDescriptor); + std::vector> streamDescs; + streamDescs.push_back(audioStreamDescriptor); + AudioStreamDeviceChangeReasonExt::ExtEnum extEnum = GetData(); + AudioStreamDeviceChangeReasonExt reason(extEnum); + audioCoreService->UpdateActiveDeviceAndVolumeBeforeMoveSession(streamDescs, reason); +} + +void AudioCoreServiceUpdateModemRouteFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::shared_ptr audioStreamDescriptor = std::make_shared(); + if (audioStreamDescriptor == nullptr) { + return; + } + std::shared_ptr audioDeviceDescriptor = std::make_shared(); + if (audioDeviceDescriptor == nullptr) { + return; + } + std::vector> descs; + descs.push_back(audioDeviceDescriptor); + std::vector> streamDescs; + streamDescs.push_back(audioStreamDescriptor); + audioCoreService->pipeManager_ = std::make_shared(); + if (audioCoreService->pipeManager_ == nullptr) { + return; + } + std::shared_ptr streamDesc = std::make_shared(); + if (streamDesc == nullptr) { + return; + } + audioCoreService->pipeManager_->modemCommunicationIdMap_.insert(std::make_pair(0, streamDesc)); + audioCoreService->UpdateModemRoute(descs); +} + +void AudioCoreServicePrivateUpdateOffloadStateFuzzTest() +{ + auto audioCoreService = std::make_shared(); + std::shared_ptr pipeInfo = std::make_shared(); + if (audioCoreService == nullptr || pipeInfo == nullptr) { + return; + } + std::shared_ptr audioStreamDescriptor = std::make_shared(); + if (audioStreamDescriptor == nullptr) { + return; + } + int32_t streamActionCount = static_cast(AudioStreamAction::AUDIO_STREAM_ACTION_RECREATE) + 1; + audioStreamDescriptor->streamAction_ = static_cast(GetData() % streamActionCount); + pipeInfo->streamDescriptors_.push_back(audioStreamDescriptor); + pipeInfo->moduleInfo_.name = OFFLOAD_PRIMARY_SPEAKER; + pipeInfo->moduleInfo_.className == "remote_offload"; + audioCoreService->UpdateOffloadState(pipeInfo); +} + +void AudioCoreServicePrivateNotifyRouteUpdateFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::shared_ptr audioStreamDescriptor = std::make_shared(); + if (audioStreamDescriptor == nullptr) { + return; + } + audioStreamDescriptor->newDeviceDescs_.clear(); + std::shared_ptr audioDeviceDescriptor = std::make_shared(); + if (audioDeviceDescriptor == nullptr) { + return; + } + std::vector networkIdList = {"abc", "networkId"}; + uint32_t roleListCount = GetData() % networkIdList.size(); + audioDeviceDescriptor->networkId_ = networkIdList[roleListCount]; + audioStreamDescriptor->newDeviceDescs_.push_back(audioDeviceDescriptor); + std::vector> streamDescs; + streamDescs.push_back(audioStreamDescriptor); + audioCoreService->NotifyRouteUpdate(streamDescs); +} + +void AudioCoreServicePrivateFetchRendererPipesAndExecuteFuzzTest2() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::shared_ptr audioStreamDescriptor = std::make_shared(); + if (audioStreamDescriptor == nullptr) { + return; + } + uint32_t index = GetData() % AudioStreamStatusVec.size(); + audioStreamDescriptor->streamStatus_ = AudioStreamStatusVec[index]; + std::shared_ptr audioDeviceDescriptor = std::make_shared(); + if (audioDeviceDescriptor == nullptr) { + return; + } + std::vector insertList1 = {"00:00:00:00:00:00", "abc"}; + uint32_t insertListCount = GetData() % insertList1.size(); + std::string macAddress = insertList1[insertListCount]; + audioDeviceDescriptor->macAddress_ = macAddress; + audioDeviceDescriptor->deviceRole_ = g_testDeviceRoles[GetData() % g_testDeviceRoles.size()]; + uint32_t deviceTypeCount = GetData() % DeviceTypeVec.size(); + audioDeviceDescriptor->deviceType_ = DeviceTypeVec[deviceTypeCount]; + audioStreamDescriptor->newDeviceDescs_.clear(); + audioStreamDescriptor->newDeviceDescs_.push_back(audioDeviceDescriptor); + audioStreamDescriptor->oldDeviceDescs_.clear(); + audioStreamDescriptor->oldDeviceDescs_.push_back(audioDeviceDescriptor); + std::vector> streamDescs; + streamDescs.push_back(audioStreamDescriptor); + AudioStreamDeviceChangeReasonExt::ExtEnum extEnum = GetData(); + AudioStreamDeviceChangeReasonExt reason(extEnum); + audioCoreService->audioA2dpOffloadManager_ = std::make_shared(); + if (audioCoreService->audioA2dpOffloadManager_ == nullptr) { + return; + } + audioCoreService->FetchRendererPipesAndExecute(streamDescs, reason); +} + +void AudioCoreServicePrivateUpdateRemoteOffloadModuleNameFuzzTest() +{ + auto audioCoreService = std::make_shared(); + std::shared_ptr pipeInfo = std::make_shared(); + if (audioCoreService == nullptr || pipeInfo == nullptr) { + return; + } + pipeInfo->moduleInfo_.className == "remote_offload"; + pipeInfo->moduleInfo_.name = OFFLOAD_PRIMARY_SPEAKER; + std::string moduleName; + audioCoreService->UpdateRemoteOffloadModuleName(pipeInfo, moduleName); +} + +void AudioCoreServicePrivateGetRealPidFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::shared_ptr streamDesc = std::make_shared(); + if (streamDesc == nullptr) { + return; + } + streamDesc->callerUid_ = MEDIA_SERVICE_UID; + audioCoreService->GetRealPid(streamDesc); + streamDesc->callerUid_ = GetData(); + audioCoreService->GetRealPid(streamDesc); +} + +void AudioCoreServicePrivateSetWakeUpAudioCapturerFromAudioServerFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + AudioProcessConfig config; + audioCoreService->SetWakeUpAudioCapturerFromAudioServer(config); +} + +void AudioCoreServicePrivateWriteCapturerConcurrentEventFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + auto result = std::make_unique(); + audioCoreService->WriteCapturerConcurrentEvent(result); +} + +void AudioCoreServicePrivateLogCapturerConcurrentResultFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + auto result = std::make_unique(); + audioCoreService->LogCapturerConcurrentResult(result); +} + +void AudioCoreServicePrivateWriteCapturerConcurrentMsgFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + auto result = std::make_unique(); + std::shared_ptr audioStreamDescriptor = std::make_shared(); + if (audioStreamDescriptor == nullptr) { + return; + } + std::shared_ptr audioDeviceDescriptor = std::make_shared(); + if (audioDeviceDescriptor == nullptr) { + return; + } + uint32_t deviceTypeCount = GetData() % DeviceTypeVec.size(); + audioDeviceDescriptor->deviceType_ = DeviceTypeVec[deviceTypeCount]; + audioStreamDescriptor->newDeviceDescs_.clear(); + audioStreamDescriptor->newDeviceDescs_.push_back(audioDeviceDescriptor); + audioCoreService->WriteCapturerConcurrentMsg(audioStreamDescriptor, result); +} + +void AudioCoreServicePrivateLoadHearingAidModuleFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + uint32_t deviceTypeCount = GetData() % DeviceTypeVec.size(); + DeviceType deviceType = DeviceTypeVec[deviceTypeCount]; + AudioStreamInfo audioStreamInfo; + std::vector networkIdList = {"abc", "networkId"}; + uint32_t roleListCount = GetData() % networkIdList.size(); + std::string networkId = networkIdList[roleListCount]; + std::string sinkName = "sinkName"; + SourceType sourceType = g_testSourceTypes[GetData() % g_testSourceTypes.size()]; + audioCoreService->LoadHearingAidModule(deviceType, audioStreamInfo, networkId, sinkName, sourceType); +} + +void AudioCoreServicePrivateIsFastAllowedFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::vector bundleNameList = {"abc", "bundleName"}; + uint32_t count = GetData() % bundleNameList.size(); + std::string bundleName = bundleNameList[count]; + audioCoreService->IsFastAllowed(bundleName); +} + TestFuncs g_testFuncs[] = { AudioCoreServicePrivateFetchRendererPipesAndExecuteFuzzTest, AudioCoreServicePrivateUpdateActiveDeviceAndVolumeBeforeMoveSessionFuzzTest, @@ -1435,6 +1710,19 @@ TestFuncs g_testFuncs[] = { AudioCoreServicePrivateGetDisableFastStreamParamFuzzTest, AudioCoreServicePrivateActivateNearlinkDeviceFuzzTest, AudioCoreServicePrivateSwitchActiveHearingAidDeviceFuzzTest, + AudioCoreServiceUpdateActiveDeviceAndVolumeBeforeMoveSessionFuzzTest, + AudioCoreServiceUpdateModemRouteFuzzTest, + AudioCoreServicePrivateUpdateOffloadStateFuzzTest, + AudioCoreServicePrivateNotifyRouteUpdateFuzzTest, + AudioCoreServicePrivateFetchRendererPipesAndExecuteFuzzTest2, + AudioCoreServicePrivateUpdateRemoteOffloadModuleNameFuzzTest, + AudioCoreServicePrivateGetRealPidFuzzTest, + AudioCoreServicePrivateSetWakeUpAudioCapturerFromAudioServerFuzzTest, + AudioCoreServicePrivateWriteCapturerConcurrentEventFuzzTest, + AudioCoreServicePrivateLogCapturerConcurrentResultFuzzTest, + AudioCoreServicePrivateWriteCapturerConcurrentMsgFuzzTest, + AudioCoreServicePrivateLoadHearingAidModuleFuzzTest, + AudioCoreServicePrivateIsFastAllowedFuzzTest, }; bool FuzzTest(const uint8_t* rawData, size_t size) diff --git a/test/fuzztest/audioeffect_fuzzer/audio_effect_fuzzer.cpp b/test/fuzztest/audioeffect_fuzzer/audio_effect_fuzzer.cpp index 02612cc733..c66135a67b 100644 --- a/test/fuzztest/audioeffect_fuzzer/audio_effect_fuzzer.cpp +++ b/test/fuzztest/audioeffect_fuzzer/audio_effect_fuzzer.cpp @@ -179,7 +179,8 @@ void UpdateSpatializationStateFuzzTest() bool headTrackingEnabled = GetData(); AudioSpatializationState spatializationState = {spatializationEnabled, headTrackingEnabled}; - + AudioEffectChainManager::GetInstance()->headTrackingEnabled_ = true; + AudioEffectChainManager::GetInstance()->btOffloadEnabled_ = true; AudioEffectChainManager::GetInstance()->UpdateSpatializationState(spatializationState); AudioEffectChainManager::GetInstance()->ResetInfo(); } diff --git a/test/fuzztest/audiopolicyconfigmanager_fuzzer/BUILD.gn b/test/fuzztest/audiopolicyconfigmanager_fuzzer/BUILD.gn new file mode 100644 index 0000000000..e71f837474 --- /dev/null +++ b/test/fuzztest/audiopolicyconfigmanager_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") + +ohos_fuzztest("AudioPolicyConfigManagerFuzzTest") { + module_out_path = "audio_framework/audio_framework_route" + fuzz_config_file = "../audiopolicyconfigmanager_fuzzer" + + include_dirs = [ + "../../../interfaces/inner_api/native/audiocommon/include", + "../../../services/audio_policy/server/domain/pipe/include", + "../../../services/audio_policy/server/common/include", + "../../../services/audio_service/client/include", + "../../../frameworks/native/audioutils/include", + ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + "-fno-access-control", + ] + + sources = [ "audio_policy_config_manager_fuzzer.cpp", ] + + cflags_cc = [ "-std=c++20" ] + + deps = [ + "../../../services/audio_policy:audio_policy_service_static", + "../../../services/audio_service/idl:audio_framework_interface", + ] + + external_deps = [ + "c_utils:utils", + "hilog:libhilog", + "ipc:ipc_single", + "kv_store:distributeddata_inner", + "os_account:os_account_innerkits", + "data_share:datashare_consumer", + "bluetooth:btframework", + "eventhandler:libeventhandler", + ] + + if (is_emulator) { + defines += [ "IS_EMULATOR" ] + } +} + +group("fuzztest") { + testonly = true + deps = [ ":AudioPolicyConfigManagerFuzzTest" ] +} diff --git a/test/fuzztest/audiopolicyconfigmanager_fuzzer/audio_policy_config_manager_fuzzer.cpp b/test/fuzztest/audiopolicyconfigmanager_fuzzer/audio_policy_config_manager_fuzzer.cpp new file mode 100644 index 0000000000..dc7354f422 --- /dev/null +++ b/test/fuzztest/audiopolicyconfigmanager_fuzzer/audio_policy_config_manager_fuzzer.cpp @@ -0,0 +1,240 @@ +/* +* Copyright (c) 2025 Huawei Device Co., Ltd. +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +#include "audio_policy_config_manager.h" +#include "audio_ec_manager.h" +#include "iaudio_policy_client.h" +#include "../fuzz_utils.h" + +namespace OHOS { +namespace AudioStandard { +using namespace std; + +FuzzUtils &g_fuzzUtils = FuzzUtils::GetInstance(); +typedef void (*TestFuncs)(); + +void UpdateAndClearStreamPropInfoFuzztest() +{ + std::string adapterName = "adapterName"; + std::string pipeName = "pipeName"; + std::list deviceStreamInfo; + DeviceStreamInfo streamInfo = { SAMPLE_RATE_48000, ENCODING_PCM, SAMPLE_S16LE, CH_LAYOUT_STEREO }; + deviceStreamInfo.push_back(streamInfo); + std::list supportDevices; + supportDevices.push_back("supportDevices"); + AudioPolicyConfigManager::GetInstance().UpdateStreamPropInfo(adapterName, pipeName, + deviceStreamInfo, supportDevices); + AudioPolicyConfigManager::GetInstance().ClearStreamPropInfo(adapterName, pipeName); +} + +void UpdateDynamicCapturerConfigFuzztest() +{ + AudioModuleInfo moduleInfo; + AudioPolicyConfigManager::GetInstance().GetAdapterInfoFlag(); + AudioPolicyConfigManager::GetInstance().UpdateDynamicCapturerConfig(g_fuzzUtils.GetData(), moduleInfo); +} + +void GetMaxCapturersInstancesFuzzTest() +{ + PolicyGlobalConfigs globalConfigs; + PolicyConfigInfo policyConfigInfo; + if (g_fuzzUtils.GetData()) { + policyConfigInfo.name_ = "maxCapturers"; + policyConfigInfo.value_ = "-0"; + } + globalConfigs.commonConfigs_.push_back(policyConfigInfo); + AudioPolicyConfigManager::GetInstance().OnGlobalConfigsParsed(globalConfigs); + AudioPolicyConfigManager::GetInstance().GetMaxCapturersInstances(); +} + +void GetMaxFastRenderersInstancesFuzzTest() +{ + PolicyGlobalConfigs globalConfigs; + PolicyConfigInfo policyConfigInfo; + if (g_fuzzUtils.GetData()) { + policyConfigInfo.name_ = "maxFastRenderers"; + policyConfigInfo.value_ = "-0"; + } + globalConfigs.commonConfigs_.push_back(policyConfigInfo); + AudioPolicyConfigManager::GetInstance().OnGlobalConfigsParsed(globalConfigs); + AudioPolicyConfigManager::GetInstance().GetMaxFastRenderersInstances(); +} + +void GetVoipRendererFlagFuzzTest() +{ + AudioPolicyConfigManager::GetInstance().SetNormalVoipFlag(g_fuzzUtils.GetData()); + AudioPolicyConfigManager::GetInstance().GetNormalVoipFlag(); + AudioPolicyConfigManager::GetInstance().OnVoipConfigParsed(g_fuzzUtils.GetData()); + AudioPolicyConfigManager::GetInstance().GetVoipConfig(); + AudioPolicyConfigManager::GetInstance().GetVoipRendererFlag("Speaker", "LocalDevice", + g_fuzzUtils.GetData()); +} + +void SetAndGetAudioLatencyFromXmlFuzzTest() +{ + AudioPolicyConfigManager::GetInstance().OnAudioLatencyParsed(g_fuzzUtils.GetData()); + AudioPolicyConfigManager::GetInstance().GetAudioLatencyFromXml(); +} + +void GetAdapterInfoByTypeFuzzTest() +{ + std::shared_ptr info = nullptr; + AudioPolicyConfigManager::GetInstance().GetAdapterInfoByType(g_fuzzUtils.GetData(), info); +} + +void GetStreamPropInfoSizeFuzzTest() +{ + AudioPolicyConfigManager::GetInstance().GetStreamPropInfoSize("primary", ""); +} + +void GetTargetSourceTypeAndMatchingFlagFuzzTest() +{ + bool useMatchingPropInfo = false; + AudioPolicyConfigManager::GetInstance().GetTargetSourceTypeAndMatchingFlag(g_fuzzUtils.GetData(), + useMatchingPropInfo); +} + +void ParseFormatFuzzTest() +{ + std::string format = ""; + if (g_fuzzUtils.GetData()) { + format = "s16le"; + } + AudioPolicyConfigManager::GetInstance().ParseFormat(format); +} + +void CheckDynamicCapturerConfigFuzzTest() +{ + std::shared_ptr desc = std::make_shared(); + CHECK_AND_RETURN(desc != nullptr); + std::shared_ptr deviceDesc = + std::make_shared(DEVICE_TYPE_USB_ARM_HEADSET); + desc->newDeviceDescs_.push_back(deviceDesc); + std::shared_ptr info = std::make_shared(); + AudioPolicyConfigManager::GetInstance().CheckDynamicCapturerConfig(desc, info); +} + +void GetStreamPropInfoForRecordFuzzTest() +{ + std::shared_ptr desc = std::make_shared(); + CHECK_AND_RETURN(desc != nullptr); + desc->SetAudioFlag(AUDIO_OUTPUT_FLAG_NORMAL); + desc->streamInfo_.format = g_fuzzUtils.GetData(); + desc->streamInfo_.samplingRate = g_fuzzUtils.GetData(); + desc->capturerInfo_.sourceType = g_fuzzUtils.GetData(); + std::shared_ptr adapterPipeInfo = std::make_shared(); + CHECK_AND_RETURN(adapterPipeInfo != nullptr); + std::shared_ptr info = nullptr; + adapterPipeInfo->dynamicStreamPropInfos_.push_back(info); + adapterPipeInfo->streamPropInfos_.push_back(info); + AudioChannel tempChannel = g_fuzzUtils.GetData(); + AudioEcManager::GetInstance().Init(g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + AudioPolicyConfigManager::GetInstance().OnUpdateRouteSupport(g_fuzzUtils.GetData()); + AudioPolicyConfigManager::GetInstance().GetStreamPropInfoForRecord(desc, adapterPipeInfo, info, tempChannel); +} + +void GetNormalRecordAdapterInfoFuzzTest() +{ + std::shared_ptr desc = std::make_shared(); + CHECK_AND_RETURN(desc != nullptr); + std::shared_ptr device = std::make_shared(); + desc->AddNewDevice(device); + std::shared_ptr info = AudioPolicyConfigManager::GetInstance().GetNormalRecordAdapterInfo(desc); +} + +void UpdateBasicStreamInfoFuzzTest() +{ + std::shared_ptr desc = nullptr; + std::shared_ptr pipeInfo = nullptr; + AudioStreamInfo streamInfo; + streamInfo.format = g_fuzzUtils.GetData(); + AudioPolicyConfigManager::GetInstance().UpdateBasicStreamInfo(desc, pipeInfo, streamInfo); + desc = std::make_shared(); + CHECK_AND_RETURN(desc != nullptr); + pipeInfo = std::make_shared(); + CHECK_AND_RETURN(pipeInfo != nullptr); + std::vector routeFlag = { + (AUDIO_INPUT_FLAG_VOIP | AUDIO_INPUT_FLAG_FAST), + (AUDIO_OUTPUT_FLAG_VOIP | AUDIO_OUTPUT_FLAG_FAST), + AUDIO_INPUT_FLAG_FAST, + AUDIO_OUTPUT_FLAG_FAST, + }; + desc->SetRoute(routeFlag[g_fuzzUtils.GetData() % routeFlag.size()]); + if (g_fuzzUtils.GetData()) { + std::shared_ptr streamPropInfo = std::make_shared(); + pipeInfo->streamPropInfos_.push_back(g_fuzzUtils.GetData() ? streamPropInfo : nullptr); + } + AudioPolicyConfigManager::GetInstance().UpdateBasicStreamInfo(desc, pipeInfo, streamInfo); +} + +void GetDynamicStreamPropInfoFromPipeFuzzTest() +{ + std::shared_ptr info = std::make_shared(); + CHECK_AND_RETURN(info != nullptr); + std::shared_ptr pipeStreamPropInfo = std::make_shared(); + CHECK_AND_RETURN(pipeStreamPropInfo != nullptr); + pipeStreamPropInfo->sampleRate_ = g_fuzzUtils.GetData(); + std::list> streamProps = {pipeStreamPropInfo}; + info->UpdateDynamicStreamProps(streamProps); + AudioSampleFormat format = g_fuzzUtils.GetData(); + uint32_t sampleRate = g_fuzzUtils.GetData(); + AudioChannel channels = g_fuzzUtils.GetData(); + AudioPolicyConfigManager::GetInstance().SupportImplicitConversion(g_fuzzUtils.GetData()); + std::shared_ptr ret = + AudioPolicyConfigManager::GetInstance().GetDynamicStreamPropInfoFromPipe(info, format, sampleRate, channels); +} + +void IsStreamPropMatchFuzzTest() +{ + AudioStreamInfo streamInfo; + streamInfo.format = AudioSampleFormat::SAMPLE_F32LE; + streamInfo.samplingRate = AudioSamplingRate::SAMPLE_RATE_11025; + streamInfo.channels = AudioChannel::STEREO; + std::list> infos; + if (g_fuzzUtils.GetData()) { + std::shared_ptr streamPropInfo = std::make_shared(); + streamPropInfo->format_ = AudioSampleFormat::SAMPLE_F32LE; + streamPropInfo->sampleRate_ = AudioSamplingRate::SAMPLE_RATE_11025; + streamPropInfo->channels_ = AudioChannel::STEREO; + infos.push_back(streamPropInfo); + } + AudioPolicyConfigManager::GetInstance().IsStreamPropMatch(streamInfo, infos); +} + +vector g_testFuncs = { + UpdateAndClearStreamPropInfoFuzztest, + UpdateDynamicCapturerConfigFuzztest, + GetMaxCapturersInstancesFuzzTest, + GetMaxFastRenderersInstancesFuzzTest, + GetVoipRendererFlagFuzzTest, + SetAndGetAudioLatencyFromXmlFuzzTest, + GetAdapterInfoByTypeFuzzTest, + GetStreamPropInfoSizeFuzzTest, + CheckDynamicCapturerConfigFuzzTest, + GetStreamPropInfoForRecordFuzzTest, + GetNormalRecordAdapterInfoFuzzTest, + GetDynamicStreamPropInfoFromPipeFuzzTest, + IsStreamPropMatchFuzzTest, +}; + +} // namespace AudioStandard +} // namesapce OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + OHOS::AudioStandard::g_fuzzUtils.fuzzTest(data, size, OHOS::AudioStandard::g_testFuncs); + return 0; +} diff --git a/test/fuzztest/audiopolicyconfigmanager_fuzzer/corpus/init b/test/fuzztest/audiopolicyconfigmanager_fuzzer/corpus/init new file mode 100644 index 0000000000..8f37f09254 --- /dev/null +++ b/test/fuzztest/audiopolicyconfigmanager_fuzzer/corpus/init @@ -0,0 +1,13 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +FUZZ \ No newline at end of file diff --git a/test/fuzztest/audiopolicyconfigmanager_fuzzer/project.xml b/test/fuzztest/audiopolicyconfigmanager_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/audiopolicyconfigmanager_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/audioservicecommonenhance_fuzzer/audio_service_common_enhance_fuzzer.cpp b/test/fuzztest/audioservicecommonenhance_fuzzer/audio_service_common_enhance_fuzzer.cpp index 97d0959a5e..9d845a1a73 100644 --- a/test/fuzztest/audioservicecommonenhance_fuzzer/audio_service_common_enhance_fuzzer.cpp +++ b/test/fuzztest/audioservicecommonenhance_fuzzer/audio_service_common_enhance_fuzzer.cpp @@ -48,6 +48,8 @@ static const uint8_t *RAW_DATA = nullptr; static size_t g_dataSize = 0; static size_t g_pos; const size_t THRESHOLD = 10; +const int32_t TEST_MAX_REQUEST = 7680; +const int32_t NUM_10 = 10; /* * describe: get data from outside untrusted data(RAW_DATA) which size is according to sizeof(T) @@ -127,13 +129,15 @@ void AudioDownMixStereoFuzzTest() std::shared_ptr audioDownMixStereo = std::make_shared(); AudioChannelLayout mode = GetData(); - int32_t channels = GetData(); + int32_t channels = (GetData() % NUM_10) + 1; audioDownMixStereo->InitMixer(mode, channels); - int32_t frameLength = GetData(); - float *input = GetData(); - float *output = GetData(); - audioDownMixStereo->Apply(frameLength, input, output); + int32_t frameLen = TEST_MAX_REQUEST / SAMPLE_F32LE; + std::vector inBufferVector(frameLen, 0); + std::vector outBufferVector(frameLen, 0); + float *input = inBufferVector.data(); + float *output = outBufferVector.data(); + audioDownMixStereo->Apply(NUM_10, input, output); } void AudioLogUtilsFuzzTest() diff --git a/test/fuzztest/audiosession_fuzzer/BUILD.gn b/test/fuzztest/audiosession_fuzzer/BUILD.gn new file mode 100644 index 0000000000..b11dfd010b --- /dev/null +++ b/test/fuzztest/audiosession_fuzzer/BUILD.gn @@ -0,0 +1,52 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/test.gni") +import("../../../config.gni") + +ohos_fuzztest("AudioSessionFuzzTest") { + module_out_path = "audio_framework/audio_framework_route" + fuzz_config_file = "../audiosession_fuzzer" + + include_dirs = [ "../../../services/audio_policy/server/domain/session/include" ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + "-fno-access-control", + ] + + sources = [ "audio_session_fuzzer.cpp" ] + + configs = [ "../../../services/audio_service:audio_service_config" ] + cflags_cc = [ "-std=c++20" ] + + deps = [ + "../../../services/audio_service/idl:audio_framework_interface", + "../../../services/audio_policy:audio_policy_service_static", + ] + external_deps = [ + "c_utils:utils", + "hilog:libhilog", + "eventhandler:libeventhandler", + "ipc:ipc_single", + ] +} + +group("fuzztest") { + testonly = true + deps = [ ":AudioSessionFuzzTest" ] +} diff --git a/test/fuzztest/audiosession_fuzzer/audio_session_fuzzer.cpp b/test/fuzztest/audiosession_fuzzer/audio_session_fuzzer.cpp new file mode 100644 index 0000000000..c92b92edb4 --- /dev/null +++ b/test/fuzztest/audiosession_fuzzer/audio_session_fuzzer.cpp @@ -0,0 +1,329 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "audio_log.h" +#include "audio_session.h" +#include "audio_session_service.h" +#include "../fuzz_utils.h" + +using namespace std; +namespace OHOS { +namespace AudioStandard { + +FuzzUtils &g_fuzzUtils = FuzzUtils::GetInstance(); +const size_t FUZZ_INPUT_SIZE_THRESHOLD = 10; + +typedef void (*TestFuncs)(); + +std::shared_ptr CreateAudioSession() +{ + AudioSessionStrategy strategy; + std::shared_ptr audioSessionStateMonitor = nullptr; + if (g_fuzzUtils.GetData()) { + auto audioSessionService = std::make_shared(); + audioSessionStateMonitor = std::static_pointer_cast(audioSessionService); + } + return std::make_shared(g_fuzzUtils.GetData(), strategy, audioSessionStateMonitor); +} + +void SetAudioSessionSceneFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->SetAudioSessionScene(g_fuzzUtils.GetData()); +} + +void GetStreamsFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->GetStreams(); +} + +void GetFakeStreamTypeFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->SetAudioSessionScene(g_fuzzUtils.GetData()); + audioSession->GetFakeStreamType(); +} + +void AddStreamInfoFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + AudioInterrupt incomingInterrupt; + incomingInterrupt.isAudioSessionInterrupt = g_fuzzUtils.GetData(); + audioSession->IsActivated(); + audioSession->IsSceneParameterSet(); + incomingInterrupt.audioFocusType.streamType = g_fuzzUtils.GetData(); + incomingInterrupt.audioFocusType.sourceType = g_fuzzUtils.GetData(); + audioSession->AddStreamInfo(incomingInterrupt); +} + +void RemoveStreamInfoFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + uint32_t streamId = g_fuzzUtils.GetData(); + audioSession->RemoveStreamInfo(streamId); + AudioInterrupt audioInterrupt; + audioInterrupt.streamId = streamId; + audioSession->AddStreamInfo(audioInterrupt); + audioSession->RemoveStreamInfo(streamId); + audioSession->ClearStreamInfo(); +} + +void ClearStreamInfoFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->ClearStreamInfo(); +} + +void GetFakeStreamIdFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->GetFakeStreamId(); +} + +void SaveFakeStreamIdFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->SaveFakeStreamId(g_fuzzUtils.GetData()); +} + +void DumpFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + std::string dumpString = "dumpString"; + AudioInterrupt audioInterrupt; + audioInterrupt.streamId = g_fuzzUtils.GetData(); + audioInterrupt.audioFocusType.streamType = g_fuzzUtils.GetData(); + audioSession->AddStreamInfo(audioInterrupt); + audioSession->Dump(dumpString); + audioSession->ClearStreamInfo(); +} + +void UpdateSingleVoipStreamDefaultOutputDeviceFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + AudioInterrupt interrupt; + interrupt.streamId = g_fuzzUtils.GetData(); + audioSession->UpdateSingleVoipStreamDefaultOutputDevice(interrupt); +} + +void UpdateVoipStreamsDefaultOutputDeviceFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + AudioInterrupt audioInterrupt; + audioSession->AddStreamInfo(audioInterrupt); + audioSession->UpdateVoipStreamsDefaultOutputDevice(); + audioSession->ClearStreamInfo(); +} + +void DeactivateFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->IsSessionDefaultDeviceEnabled(); + audioSession->Deactivate(); +} + +void IsOutputDeviceConfigurableByStreamUsageFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->IsOutputDeviceConfigurableByStreamUsage(g_fuzzUtils.GetData()); +} + +void CanCurrentStreamSetDefaultOutputDeviceFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + AudioInterrupt interrupt; + interrupt.streamUsage = g_fuzzUtils.GetData(); + audioSession->CanCurrentStreamSetDefaultOutputDevice(interrupt); +} + +void EnableSingleVoipStreamDefaultOutputDeviceFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + AudioInterrupt interrupt; + interrupt.streamUsage = g_fuzzUtils.GetData(); + interrupt.streamId = g_fuzzUtils.GetData(); + audioSession->EnableSingleVoipStreamDefaultOutputDevice(interrupt); +} + +void EnableVoipStreamsDefaultOutputDeviceFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + AudioInterrupt interrupt; + interrupt.streamUsage = g_fuzzUtils.GetData(); + interrupt.streamId = g_fuzzUtils.GetData(); + audioSession->AddStreamInfo(interrupt); + audioSession->EnableVoipStreamsDefaultOutputDevice(); + audioSession->ClearStreamInfo(); +} + +void EnableDefaultDeviceFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->IsActivated(); + audioSession->SetSessionDefaultOutputDevice(g_fuzzUtils.GetData()); + audioSession->SetAudioSessionScene(g_fuzzUtils.GetData()); + audioSession->EnableDefaultDevice(); +} + +void GetStreamUsageInnerFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->SetAudioSessionScene(g_fuzzUtils.GetData()); + audioSession->GetStreamUsageInner(); +} + +void GetSessionStrategyFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->GetSessionStrategy(); +} + +void ShouldExcludeStreamTypeFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + AudioInterrupt audioInterrupt; + audioInterrupt.audioFocusType.streamType = g_fuzzUtils.GetData(); + audioSession->ShouldExcludeStreamType(audioInterrupt); +} + +void IsAudioRendererEmptyFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + AudioInterrupt audioInterrupt; + audioInterrupt.audioFocusType.streamType = g_fuzzUtils.GetData(); + audioSession->AddStreamInfo(audioInterrupt); + audioSession->IsAudioRendererEmpty(); + audioSession->ClearStreamInfo(); +} + +void GetSessionDefaultOutputDeviceFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + DeviceType deviceType = g_fuzzUtils.GetData(); + audioSession->GetSessionDefaultOutputDevice(deviceType); +} + +void IsStreamContainedInCurrentSessionFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + AudioInterrupt audioInterrupt; + audioInterrupt.streamId = g_fuzzUtils.GetData(); + audioSession->AddStreamInfo(audioInterrupt); + audioSession->IsStreamContainedInCurrentSession(g_fuzzUtils.GetData()); + audioSession->ClearStreamInfo(); +} + +void IsCurrentDevicePrivateDeviceFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->IsCurrentDevicePrivateDevice(std::make_shared()); +} + +void IsRecommendToStopAudioFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->IsRecommendToStopAudio(std::make_shared()); +} + +void IsSessionOutputDeviceChangedFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->IsSessionOutputDeviceChanged(std::make_shared()); +} + +void GetSessionStreamUsageFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->GetSessionStreamUsage(); +} + +void IsBackGroundAppFuzzTest() +{ + auto audioSession = CreateAudioSession(); + CHECK_AND_RETURN(audioSession != nullptr); + audioSession->IsBackGroundApp(); +} + +vector g_testFuncs = { + SetAudioSessionSceneFuzzTest, + GetStreamsFuzzTest, + GetFakeStreamTypeFuzzTest, + AddStreamInfoFuzzTest, + RemoveStreamInfoFuzzTest, + ClearStreamInfoFuzzTest, + GetFakeStreamIdFuzzTest, + SaveFakeStreamIdFuzzTest, + DumpFuzzTest, + UpdateSingleVoipStreamDefaultOutputDeviceFuzzTest, + UpdateVoipStreamsDefaultOutputDeviceFuzzTest, + DeactivateFuzzTest, + IsOutputDeviceConfigurableByStreamUsageFuzzTest, + CanCurrentStreamSetDefaultOutputDeviceFuzzTest, + EnableSingleVoipStreamDefaultOutputDeviceFuzzTest, + EnableVoipStreamsDefaultOutputDeviceFuzzTest, + EnableDefaultDeviceFuzzTest, + GetStreamUsageInnerFuzzTest, + GetSessionStrategyFuzzTest, + ShouldExcludeStreamTypeFuzzTest, + IsAudioRendererEmptyFuzzTest, + GetSessionDefaultOutputDeviceFuzzTest, + IsStreamContainedInCurrentSessionFuzzTest, + IsCurrentDevicePrivateDeviceFuzzTest, + IsRecommendToStopAudioFuzzTest, + IsSessionOutputDeviceChangedFuzzTest, + GetSessionStreamUsageFuzzTest, + IsBackGroundAppFuzzTest, +}; +} // namespace AudioStandard +} // namesapce OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + if (size < OHOS::AudioStandard::FUZZ_INPUT_SIZE_THRESHOLD) { + return 0; + } + + OHOS::AudioStandard::g_fuzzUtils.fuzzTest(data, size, OHOS::AudioStandard::g_testFuncs); + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/audiosession_fuzzer/corpus/init b/test/fuzztest/audiosession_fuzzer/corpus/init new file mode 100644 index 0000000000..8f37f09254 --- /dev/null +++ b/test/fuzztest/audiosession_fuzzer/corpus/init @@ -0,0 +1,13 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +FUZZ \ No newline at end of file diff --git a/test/fuzztest/audiosession_fuzzer/project.xml b/test/fuzztest/audiosession_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/audiosession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/formatconverter_fuzzer/format_converter_fuzzer.cpp b/test/fuzztest/formatconverter_fuzzer/format_converter_fuzzer.cpp index 362957e2dd..76942f3fa3 100644 --- a/test/fuzztest/formatconverter_fuzzer/format_converter_fuzzer.cpp +++ b/test/fuzztest/formatconverter_fuzzer/format_converter_fuzzer.cpp @@ -128,7 +128,7 @@ void S16MonoToS16StereoFuzzTest() dstDesc.bufLength = BUFFER_SIZE_LARGE; dstDesc.buffer = dstBuffer; FormatConverter::S16MonoToS16Stereo(srcDesc, dstDesc); - srcDesc.bufLength = BUFFER_SIZE_MEDIUM; + srcDesc.buffer = nullptr; FormatConverter::S16MonoToS16Stereo(srcDesc, dstDesc); } diff --git a/test/fuzztest/hpaecapturermanager_fuzzer/hpaecapturermanager_fuzzer.cpp b/test/fuzztest/hpaecapturermanager_fuzzer/hpaecapturermanager_fuzzer.cpp index b26bf9581b..8b93988b0d 100644 --- a/test/fuzztest/hpaecapturermanager_fuzzer/hpaecapturermanager_fuzzer.cpp +++ b/test/fuzztest/hpaecapturermanager_fuzzer/hpaecapturermanager_fuzzer.cpp @@ -744,6 +744,221 @@ void AddAllNodesToSourceAdvancedFuzzTest() capturerManager->DeInit(); } +void DisConnectSceneClusterFromSourceInputClusterFuzzTest() +{ + HpaeSourceInfo sourceInfo; + InitFuzzSourceInfo(sourceInfo); + + sourceInfo.ecType = GetData(); + sourceInfo.micRef = GetData(); + + auto capturerManager = std::make_shared(sourceInfo); + CHECK_AND_RETURN(capturerManager != nullptr); + + capturerManager->Init(); + WaitForMsgProcessing(capturerManager); + + HpaeStreamInfo streamInfo; + InitReloadFuzzStreamInfo(streamInfo); + streamInfo.sourceType = GetData(); + streamInfo.sessionId = GetData(); + + capturerManager->CreateStream(streamInfo); + WaitForMsgProcessing(capturerManager); + + capturerManager->Start(streamInfo.sessionId); + WaitForMsgProcessing(capturerManager); + + capturerManager->Stop(streamInfo.sessionId); + capturerManager->Release(streamInfo.sessionId); + WaitForMsgProcessing(capturerManager); + + capturerManager->DeInit(); +} + +void ConnectOutputSessionFuzzTest() +{ + HpaeSourceInfo sourceInfo; + InitFuzzSourceInfo(sourceInfo); + + sourceInfo.ecType = GetData(); + sourceInfo.micRef = GetData(); + + auto capturerManager = std::make_shared(sourceInfo); + CHECK_AND_RETURN(capturerManager != nullptr); + + capturerManager->Init(); + WaitForMsgProcessing(capturerManager); + + HpaeStreamInfo streamInfo; + InitReloadFuzzStreamInfo(streamInfo); + streamInfo.sourceType = GetData(); + streamInfo.sessionId = GetData(); + + capturerManager->CreateStream(streamInfo); + WaitForMsgProcessing(capturerManager); + + capturerManager->Start(streamInfo.sessionId); + WaitForMsgProcessing(capturerManager); + + capturerManager->DeInit(); +} + +void PauseFuzzTest() +{ + HpaeSourceInfo sourceInfo; + InitFuzzSourceInfo(sourceInfo); + + auto capturerManager = std::make_shared(sourceInfo); + CHECK_AND_RETURN(capturerManager != nullptr); + + capturerManager->Init(); + WaitForMsgProcessing(capturerManager); + + HpaeStreamInfo streamInfo; + InitReloadFuzzStreamInfo(streamInfo); + streamInfo.sessionId = GetData(); + + capturerManager->CreateStream(streamInfo); + WaitForMsgProcessing(capturerManager); + + capturerManager->Start(streamInfo.sessionId); + WaitForMsgProcessing(capturerManager); + + capturerManager->Pause(streamInfo.sessionId); + WaitForMsgProcessing(capturerManager); + + capturerManager->DeInit(); +} + +void SetStreamMuteFuzzTest() +{ + HpaeSourceInfo sourceInfo; + InitFuzzSourceInfo(sourceInfo); + + auto capturerManager = std::make_shared(sourceInfo); + CHECK_AND_RETURN(capturerManager != nullptr); + + capturerManager->Init(); + WaitForMsgProcessing(capturerManager); + + HpaeStreamInfo streamInfo; + InitReloadFuzzStreamInfo(streamInfo); + streamInfo.sessionId = GetData(); + + capturerManager->CreateStream(streamInfo); + WaitForMsgProcessing(capturerManager); + + bool isMute1 = GetData(); + capturerManager->SetStreamMute(streamInfo.sessionId, isMute1); + WaitForMsgProcessing(capturerManager); + + uint32_t invalidSessionId = GetData(); + bool isMute2 = GetData(); + capturerManager->SetStreamMute(invalidSessionId, isMute2); + WaitForMsgProcessing(capturerManager); + + capturerManager->DeInit(); +} + +void ProcessFuzzTest() +{ + HpaeSourceInfo sourceInfo; + InitFuzzSourceInfo(sourceInfo); + + auto capturerManager = std::make_shared(sourceInfo); + CHECK_AND_RETURN(capturerManager != nullptr); + + capturerManager->Init(); + WaitForMsgProcessing(capturerManager); + + HpaeStreamInfo streamInfo; + InitReloadFuzzStreamInfo(streamInfo); + streamInfo.sessionId = GetData(); + + capturerManager->CreateStream(streamInfo); + WaitForMsgProcessing(capturerManager); + + capturerManager->Start(streamInfo.sessionId); + WaitForMsgProcessing(capturerManager); + + capturerManager->Process(); + + capturerManager->DeInit(); +} + +void ReloadCaptureManagerFuzzTest() +{ + HpaeSourceInfo sourceInfo; + InitFuzzSourceInfo(sourceInfo); + + auto capturerManager = std::make_shared(sourceInfo); + CHECK_AND_RETURN(capturerManager != nullptr); + + capturerManager->Init(); + WaitForMsgProcessing(capturerManager); + + HpaeStreamInfo streamInfo; + InitReloadFuzzStreamInfo(streamInfo); + streamInfo.sessionId = GetData(); + + capturerManager->CreateStream(streamInfo); + WaitForMsgProcessing(capturerManager); + + capturerManager->ReloadCaptureManager(sourceInfo); + + capturerManager->DeInit(); +} + +void DeInitFuzzTest() +{ + HpaeSourceInfo sourceInfo; + InitFuzzSourceInfo(sourceInfo); + sourceInfo.ecType = GetData(); + sourceInfo.micRef = GetData(); + + auto capturerManager = std::make_shared(sourceInfo); + CHECK_AND_RETURN(capturerManager != nullptr); + + capturerManager->Init(); + WaitForMsgProcessing(capturerManager); + + HpaeStreamInfo streamInfo; + InitReloadFuzzStreamInfo(streamInfo); + streamInfo.sessionId = GetData(); + + capturerManager->CreateStream(streamInfo); + WaitForMsgProcessing(capturerManager); + + bool isMoveDefault = GetData(); + capturerManager->DeInit(isMoveDefault); +} + +void GetSourceOutputInfoFuzzTest() +{ + HpaeSourceInfo sourceInfo; + InitFuzzSourceInfo(sourceInfo); + sourceInfo.ecType = GetData(); + sourceInfo.micRef = GetData(); + + auto capturerManager = std::make_shared(sourceInfo); + CHECK_AND_RETURN(capturerManager != nullptr); + + capturerManager->Init(); + WaitForMsgProcessing(capturerManager); + + HpaeStreamInfo streamInfo; + InitReloadFuzzStreamInfo(streamInfo); + streamInfo.sessionId = GetData(); + + capturerManager->CreateStream(streamInfo); + WaitForMsgProcessing(capturerManager); + + HpaeSourceOutputInfo sourceOutputInfo; + capturerManager->GetSourceOutputInfo(streamInfo.sessionId, sourceOutputInfo); + capturerManager->DeInit(); +} + typedef void (*TestFuncs)(); TestFuncs g_testFuncs[] = { @@ -770,6 +985,14 @@ TestFuncs g_testFuncs[] = { AddAllNodesToSourceAdvancedFuzzTest, CheckIfAnyStreamRunningFuzzTest, DumpSourceInfoFuzzTest, + DisConnectSceneClusterFromSourceInputClusterFuzzTest, + ConnectOutputSessionFuzzTest, + PauseFuzzTest, + SetStreamMuteFuzzTest, + ProcessFuzzTest, + ReloadCaptureManagerFuzzTest, + DeInitFuzzTest, + GetSourceOutputInfoFuzzTest, }; bool FuzzTest(const uint8_t* rawData, size_t size) -- Gitee