From deaff8f1b0e19052981cec6cd713c652fbd76cea Mon Sep 17 00:00:00 2001 From: zhangwt3652 Date: Mon, 25 Aug 2025 16:45:19 +0800 Subject: [PATCH] fuzz Signed-off-by: zhangwt3652 --- test/BUILD.gn | 1 + .../audio_core_service_private_fuzzer.cpp | 200 ++++++++++++ .../audiostreamchecker_fuzzer/BUILD.gn | 53 ++++ .../audio_stream_checker_fuzzer.cpp | 284 ++++++++++++++++++ .../audiostreamchecker_fuzzer/corpus/init | 13 + .../audiostreamchecker_fuzzer/project.xml | 25 ++ 6 files changed, 576 insertions(+) create mode 100644 test/fuzztest/audiostreamchecker_fuzzer/BUILD.gn create mode 100644 test/fuzztest/audiostreamchecker_fuzzer/audio_stream_checker_fuzzer.cpp create mode 100644 test/fuzztest/audiostreamchecker_fuzzer/corpus/init create mode 100644 test/fuzztest/audiostreamchecker_fuzzer/project.xml diff --git a/test/BUILD.gn b/test/BUILD.gn index 94cbf4316c..9df45b4566 100644 --- a/test/BUILD.gn +++ b/test/BUILD.gn @@ -279,6 +279,7 @@ group("audio_fuzz_test") { "fuzztest/audiospatializationservice_fuzzer:fuzztest", "fuzztest/audiostatemanager_fuzzer:fuzztest", "fuzztest/audiostream_fuzzer:fuzztest", + "fuzztest/audiostreamchecker_fuzzer:fuzztest", "fuzztest/audiostreamcollector_fuzzer:fuzztest", "fuzztest/audiostreamdescriptor_fuzzer:fuzztest", "fuzztest/audiousbmanager_fuzzer:fuzztest", diff --git a/test/fuzztest/audiocoreserviceprivate_fuzzer/audio_core_service_private_fuzzer.cpp b/test/fuzztest/audiocoreserviceprivate_fuzzer/audio_core_service_private_fuzzer.cpp index 5f94ea9619..24d10fd4af 100644 --- a/test/fuzztest/audiocoreserviceprivate_fuzzer/audio_core_service_private_fuzzer.cpp +++ b/test/fuzztest/audiocoreserviceprivate_fuzzer/audio_core_service_private_fuzzer.cpp @@ -204,6 +204,10 @@ void AudioCoreServicePrivateFetchDeviceAndRouteFuzzTest() if (audioCoreService == nullptr) { return; } + audioCoreService->audioA2dpOffloadManager_ = std::make_shared(); + if (audioCoreService->audioA2dpOffloadManager_ == nullptr) { + return; + } AudioStreamDeviceChangeReasonExt::ExtEnum extEnum = GetData(); AudioStreamDeviceChangeReasonExt reason(extEnum); std::string caller = "SetAudioScene"; @@ -252,6 +256,7 @@ void AudioCoreServicePrivateOnDeviceStatusUpdatedFuzzTest() } AudioDeviceDescriptor desc; bool isConnect = GetData() % NUM_2; + audioCoreService->pipeManager_ = nullptr; audioCoreService->OnDeviceStatusUpdated(desc, isConnect); } @@ -916,6 +921,10 @@ void AudioCoreServicePrivateHandleScoOutputDeviceFetchedFuzzTest() shared_ptr desc = std::make_shared(); AudioStreamDeviceChangeReasonExt reason; + audioCoreService->audioA2dpOffloadManager_ = std::make_shared(); + if (audioCoreService->audioA2dpOffloadManager_ == nullptr) { + return; + } audioCoreService->HandleScoOutputDeviceFetched(desc, reason); } @@ -1081,6 +1090,10 @@ void LoadSplitModuleFuzzTest() { auto audioCoreService = std::make_shared(); CHECK_AND_RETURN(audioCoreService != nullptr); + audioCoreService->audioA2dpOffloadManager_ = std::make_shared(); + if (audioCoreService->audioA2dpOffloadManager_ == nullptr) { + return; + } audioCoreService->LoadSplitModule("", "networkId"); audioCoreService->LoadSplitModule("splitArgs", "networkId"); } @@ -1160,6 +1173,14 @@ void AudioCoreServicePrivateUpdateTrackerFuzzTest() RENDERER_PAUSED }; RendererState rendererState = testRendererStates[GetData() % testRendererStates.size()]; + audioCoreService->audioA2dpOffloadManager_ = std::make_shared(); + if (audioCoreService->audioA2dpOffloadManager_ == nullptr) { + return; + } + audioCoreService->UpdateTracker(mode, streamChangeInfo, rendererState); + mode = AudioMode::AUDIO_MODE_PLAYBACK; + audioCoreService->enableDualHalToneState_ = true; + rendererState = RendererState::RENDERER_STOPPED; audioCoreService->UpdateTracker(mode, streamChangeInfo, rendererState); } @@ -1171,6 +1192,8 @@ void AudioCoreServicePrivateHandleCommonSourceOpenedFuzzTest() int32_t streamActionCount = static_cast(AudioStreamAction::AUDIO_STREAM_ACTION_RECREATE) + 1; audioStreamDescriptor->streamAction_ = static_cast(GetData() % streamActionCount); pipeInfo->streamDescriptors_.push_back(audioStreamDescriptor); + pipeInfo->pipeRole_ = AudioPipeRole::PIPE_ROLE_INPUT; + pipeInfo->streamDescriptors_.push_back(audioStreamDescriptor); audioCoreService->pipeManager_ = std::make_shared(); std::shared_ptr audioDeviceDescriptor = std::make_shared(); audioStreamDescriptor->newDeviceDescs_.push_back(audioDeviceDescriptor); @@ -1184,6 +1207,8 @@ void AudioCoreServicePrivateDelayReleaseOffloadPipeFuzzTest() uint32_t paIndex = GetData() % NUM_2; OffloadType type = LOCAL_OFFLOAD; audioCoreService->DelayReleaseOffloadPipe(id, paIndex, type); + audioCoreService->isOffloadOpened_[type].store(true); + audioCoreService->DelayReleaseOffloadPipe(id, paIndex, type); } void AudioCoreServicePrivateReleaseOffloadPipeFuzzTest() @@ -1224,6 +1249,9 @@ void AudioCoreServicePrivateMuteSinkPortForSwitchDeviceFuzzTest() std::shared_ptr audioDeviceDescriptor = std::make_shared(); audioStreamDescriptor->newDeviceDescs_.push_back(audioDeviceDescriptor); std::shared_ptr audioDeviceDescriptor1 = std::make_shared(); + audioDeviceDescriptor1->networkId_ = "networkId"; + uint32_t deviceTypeCount = GetData() % DeviceTypeVec.size(); + audioDeviceDescriptor1->deviceType_ = DeviceTypeVec[deviceTypeCount]; audioStreamDescriptor->oldDeviceDescs_.push_back(audioDeviceDescriptor1); AudioStreamDeviceChangeReasonExt reason; audioCoreService->MuteSinkPortForSwitchDevice(audioStreamDescriptor, reason); @@ -1242,6 +1270,24 @@ void AudioCoreServicePrivateMuteSinkPortFuzzTest() const std::string newSinkName = OFFLOAD_PRIMARY_SPEAKER; AudioStreamDeviceChangeReasonExt reason; audioCoreService->MuteSinkPort(oldSinkName, newSinkName, reason); + reason.reason_ = AudioStreamDeviceChangeReasonExt::ExtEnum::OVERRODE; + audioCoreService->MuteSinkPort(oldSinkName, newSinkName, reason); + reason.reason_ = AudioStreamDeviceChangeReasonExt::ExtEnum::UNKNOWN; + reason = AudioStreamDeviceChangeReason::NEW_DEVICE_AVAILABLE; + audioCoreService->MuteSinkPort(oldSinkName, newSinkName, reason); +} + +void AudioCoreServicePrivateMutePrimaryOrOffloadSinkFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::string sinkName = OFFLOAD_PRIMARY_SPEAKER; + int64_t muteTime = GetData(); + audioCoreService->MutePrimaryOrOffloadSink(sinkName, muteTime); + sinkName = PRIMARY_SPEAKER; + audioCoreService->MutePrimaryOrOffloadSink(sinkName, muteTime); } void AudioCoreServicePrivateMuteSinkPortLogicFuzzTest() @@ -1289,6 +1335,8 @@ void AudioCoreServicePrivateHandleOutputStreamInRunningFuzzTest() AudioStreamDeviceChangeReasonExt::ExtEnum extEnum = GetData(); AudioStreamDeviceChangeReasonExt reason(extEnum); audioCoreService->HandleOutputStreamInRunning(audioStreamDescriptor, reason); + audioStreamDescriptor->streamStatus_ = STREAM_STATUS_STARTED; + audioCoreService->HandleOutputStreamInRunning(audioStreamDescriptor, reason); } void AudioCoreServicePrivateHandleInputStreamInRunningFuzzTest() @@ -1303,6 +1351,8 @@ void AudioCoreServicePrivateHandleInputStreamInRunningFuzzTest() std::shared_ptr audioDeviceDescriptor1 = std::make_shared(); audioStreamDescriptor->oldDeviceDescs_.push_back(audioDeviceDescriptor1); audioCoreService->HandleInputStreamInRunning(audioStreamDescriptor); + audioStreamDescriptor->streamStatus_ = STREAM_STATUS_STARTED; + audioCoreService->HandleInputStreamInRunning(audioStreamDescriptor); } void AudioCoreServicePrivateHandleDualStartClientFuzzTest() @@ -1316,6 +1366,7 @@ void AudioCoreServicePrivateHandleDualStartClientFuzzTest() audioStreamDescriptor->newDeviceDescs_.push_back(audioDeviceDescriptor); std::shared_ptr audioDeviceDescriptor1 = std::make_shared(); audioStreamDescriptor->oldDeviceDescs_.push_back(audioDeviceDescriptor1); + audioStreamDescriptor->newDeviceDescs_.push_back(audioDeviceDescriptor1); std::vector> activeDevices; activeDevices.push_back({DEVICE_TYPE_ACCESSORY, OUTPUT_DEVICES_FLAG}); audioCoreService->HandleDualStartClient(activeDevices, audioStreamDescriptor); @@ -1329,6 +1380,7 @@ void AudioCoreServicePrivateHandlePlaybackStreamInA2dpFuzzTest() int32_t streamActionCount = static_cast(AudioStreamAction::AUDIO_STREAM_ACTION_RECREATE) + 1; audioStreamDescriptor->streamAction_ = static_cast(GetData() % streamActionCount); std::shared_ptr audioDeviceDescriptor = std::make_shared(); + audioDeviceDescriptor->deviceType_ = DEVICE_TYPE_BLUETOOTH_A2DP; audioStreamDescriptor->newDeviceDescs_.push_back(audioDeviceDescriptor); std::shared_ptr audioDeviceDescriptor1 = std::make_shared(); audioStreamDescriptor->oldDeviceDescs_.push_back(audioDeviceDescriptor1); @@ -1362,6 +1414,15 @@ void AudioCoreServicePrivateSwitchActiveHearingAidDeviceFuzzTest() { auto audioCoreService = std::make_shared(); std::shared_ptr audioDeviceDescriptor = std::make_shared(); + if (audioCoreService == nullptr || audioDeviceDescriptor == nullptr) { + return; + } + std::vector insertList = {"00:00:00:00:00:00", "abc"}; + uint32_t insertListCount = GetData() % insertList.size(); + audioDeviceDescriptor->macAddress_ = insertList[insertListCount]; + A2dpDeviceConfigInfo a2dpDeviceConfigInfo; + audioCoreService->audioA2dpDevice_.connectedHearingAidDeviceMap_.insert({audioDeviceDescriptor->macAddress_, + a2dpDeviceConfigInfo}); audioCoreService->SwitchActiveHearingAidDevice(audioDeviceDescriptor); } @@ -1620,6 +1681,138 @@ void AudioCoreServicePrivateIsFastAllowedFuzzTest() audioCoreService->IsFastAllowed(bundleName); } +void AudioCoreServicePrivateSetDefaultOutputDeviceFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + uint32_t deviceTypeCount = GetData() % DeviceTypeVec.size(); + DeviceType deviceType = DeviceTypeVec[deviceTypeCount]; + uint32_t sessionID = GetData(); + StreamUsage streamUsage = GetData(); + bool isRunning = GetData(); + bool skipForce = GetData(); + audioCoreService->policyConfigMananger_.hasEarpiece_ = GetData(); + audioCoreService->pipeManager_ = std::make_shared(); + if (audioCoreService->pipeManager_ == nullptr) { + return; + } + std::shared_ptr pipeInfo = std::make_shared(); + if (pipeInfo == nullptr) { + return; + } + std::shared_ptr streamDesc = std::make_shared(); + if (streamDesc == nullptr) { + return; + } + streamDesc->sessionId_ = sessionID; + pipeInfo->streamDescriptors_.push_back(streamDesc); + audioCoreService->pipeManager_->curPipeList_.push_back(pipeInfo); + audioCoreService->SetDefaultOutputDevice(deviceType, sessionID, streamUsage, isRunning, skipForce); +} + +void AudioCoreServicePrivateIsHeadsetToSpkOrEpFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::shared_ptr oldDesc = std::make_shared(); + if (oldDesc == nullptr) { + return; + } + std::shared_ptr newDesc = std::make_shared(); + if (newDesc == nullptr) { + return; + } + uint32_t deviceTypeCount = GetData() % DeviceTypeVec.size(); + oldDesc->deviceType_ = DeviceTypeVec[deviceTypeCount]; + deviceTypeCount = GetData() % DeviceTypeVec.size(); + newDesc->deviceType_ = DeviceTypeVec[deviceTypeCount]; + audioCoreService->IsHeadsetToSpkOrEp(oldDesc, newDesc); +} + +void AudioCoreServicePrivateIsSceneRequireMuteAndSleepFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + audioCoreService->IsSceneRequireMuteAndSleep(); +} + +void AudioCoreServicePrivateSleepForSwitchDeviceFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::shared_ptr streamDesc = std::make_shared(); + if (streamDesc == nullptr) { + return; + } + streamDesc->oldDeviceDescs_.clear(); + std::shared_ptr audioDeviceDescriptor = std::make_shared(); + if (audioDeviceDescriptor == nullptr) { + return; + } + streamDesc->oldDeviceDescs_.push_back(audioDeviceDescriptor); + streamDesc->newDeviceDescs_.clear(); + std::shared_ptr audioDeviceDescriptor1 = std::make_shared(); + if (audioDeviceDescriptor1 == nullptr) { + return; + } + audioDeviceDescriptor1->networkId_ = "networkId"; + uint32_t deviceTypeCount = GetData() % DeviceTypeVec.size(); + audioDeviceDescriptor1->deviceType_ = DeviceTypeVec[deviceTypeCount]; + streamDesc->newDeviceDescs_.push_back(audioDeviceDescriptor1); + + AudioStreamDeviceChangeReasonExt::ExtEnum extEnum = GetData(); + AudioStreamDeviceChangeReasonExt reason(extEnum); + audioCoreService->SleepForSwitchDevice(streamDesc, reason); +} + +void AudioCoreServicePrivateResetNearlinkDeviceStateFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + std::shared_ptr deviceDesc = std::make_shared(); + if (deviceDesc == nullptr) { + return; + } + deviceDesc->deviceType_ = DEVICE_TYPE_NEARLINK; + deviceDesc->macAddress_ = "00:00:00:00:00:00"; + deviceDesc->deviceId_ = GetData(); + audioCoreService->audioActiveDevice_.currentActiveDevice_.deviceType_ = DEVICE_TYPE_NEARLINK; + std::vector insertList = {"macAddress1", "macAddress2", "macAddress3"}; + uint32_t insertListCount = GetData() % insertList.size(); + audioCoreService->audioActiveDevice_.currentActiveDevice_.macAddress_ = insertList[insertListCount]; + + audioCoreService->ResetNearlinkDeviceState(deviceDesc); + + deviceDesc->deviceType_ = DEVICE_TYPE_NEARLINK_IN; + audioCoreService->audioActiveDevice_.currentActiveInputDevice_.deviceType_ = DEVICE_TYPE_NEARLINK; + insertListCount = GetData() % insertList.size(); + audioCoreService->audioActiveDevice_.currentActiveInputDevice_.macAddress_ = insertList[insertListCount]; + + audioCoreService->ResetNearlinkDeviceState(deviceDesc); +} + +void AudioCoreServicePrivateUpdateRouteForCollaborationFuzzTest() +{ + auto audioCoreService = std::make_shared(); + if (audioCoreService == nullptr) { + return; + } + uint32_t deviceTypeCount = GetData() % DeviceTypeVec.size(); + InternalDeviceType deviceType = DeviceTypeVec[deviceTypeCount]; + AudioCollaborativeService::GetAudioCollaborativeService().isCollaborativeStateEnabled_ = true; + audioCoreService->UpdateRouteForCollaboration(deviceType); +} + TestFuncs g_testFuncs[] = { AudioCoreServicePrivateFetchRendererPipesAndExecuteFuzzTest, AudioCoreServicePrivateUpdateActiveDeviceAndVolumeBeforeMoveSessionFuzzTest, @@ -1700,6 +1893,7 @@ TestFuncs g_testFuncs[] = { AudioCoreServicePrivateMuteSinkPortForSwitchDeviceFuzzTest, AudioCoreServicePrivateSetVoiceCallMuteForSwitchDeviceFuzzTest, AudioCoreServicePrivateMuteSinkPortFuzzTest, + AudioCoreServicePrivateMutePrimaryOrOffloadSinkFuzzTest, AudioCoreServicePrivateMuteSinkPortLogicFuzzTest, AudioCoreServicePrivateActivateOutputDeviceFuzzTest, AudioCoreServicePrivateOnAudioSceneChangeFuzzTest, @@ -1723,6 +1917,12 @@ TestFuncs g_testFuncs[] = { AudioCoreServicePrivateWriteCapturerConcurrentMsgFuzzTest, AudioCoreServicePrivateLoadHearingAidModuleFuzzTest, AudioCoreServicePrivateIsFastAllowedFuzzTest, + AudioCoreServicePrivateSetDefaultOutputDeviceFuzzTest, + AudioCoreServicePrivateIsHeadsetToSpkOrEpFuzzTest, + AudioCoreServicePrivateIsSceneRequireMuteAndSleepFuzzTest, + AudioCoreServicePrivateSleepForSwitchDeviceFuzzTest, + AudioCoreServicePrivateResetNearlinkDeviceStateFuzzTest, + AudioCoreServicePrivateUpdateRouteForCollaborationFuzzTest, }; bool FuzzTest(const uint8_t* rawData, size_t size) diff --git a/test/fuzztest/audiostreamchecker_fuzzer/BUILD.gn b/test/fuzztest/audiostreamchecker_fuzzer/BUILD.gn new file mode 100644 index 0000000000..82048b1a86 --- /dev/null +++ b/test/fuzztest/audiostreamchecker_fuzzer/BUILD.gn @@ -0,0 +1,53 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/test.gni") + +ohos_fuzztest("AudioStreamCheckerFuzzTest") { + module_out_path = "audio_framework/audio_framework_route" + fuzz_config_file = "../audiostreamchecker_fuzzer" + + include_dirs = [ + "../../../services/audio_service/common/include", + ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + cflags_cc = cflags + cflags_cc += [ "-fno-access-control" ] + + sources = [ "audio_stream_checker_fuzzer.cpp" ] + + deps = [ + "../../../frameworks/native/audioschedule:audio_schedule", + "../../../frameworks/native/audioutils:audio_utils", + "../../../services/audio_service:audio_common", + "../../../services/audio_engine:audio_engine_plugins", + ] + + external_deps = [ + "c_utils:utils", + "hilog:libhilog", + ] +} + +group("fuzztest") { + testonly = true + deps = [ ":AudioStreamCheckerFuzzTest" ] +} diff --git a/test/fuzztest/audiostreamchecker_fuzzer/audio_stream_checker_fuzzer.cpp b/test/fuzztest/audiostreamchecker_fuzzer/audio_stream_checker_fuzzer.cpp new file mode 100644 index 0000000000..48e60ea502 --- /dev/null +++ b/test/fuzztest/audiostreamchecker_fuzzer/audio_stream_checker_fuzzer.cpp @@ -0,0 +1,284 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include +#include +#include +#include "audio_stream_checker.h" +#include "audio_utils.h" +#include "../fuzz_utils.h" + +namespace OHOS { +namespace AudioStandard { +using namespace std; + +FuzzUtils &g_fuzzUtils = FuzzUtils::GetInstance(); +const size_t FUZZ_INPUT_SIZE_THRESHOLD = 10; +const int32_t COUNT = 4; +const int32_t DEFAULT_BAD_DATA_TRANSFER_BIT_MAP = 3; +const int32_t DEFAULT_TIME_INTERVAL = 2000000000; +const int32_t DEFAULT_BAD_FRAME_RATIO = 50; +const int32_t DEFAULT_SUMFRAME_COUNT = 100; +const int32_t DEFAULT_ABNORMAL_FRAME_NUM = 40; +const float DEFAULT_FLOAT_BAD_FRAME_RATIO = 0.5f; + +typedef void (*TestFuncs)(); + +void AudioStreamCheckerInitCheckerFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + int32_t pid = g_fuzzUtils.GetData(); + int32_t callbackId = g_fuzzUtils.GetData(); + checker->InitChecker(para, pid, callbackId); + checker->InitChecker(para, pid, callbackId); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerRecordFrameFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + checker->InitChecker(para, g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + checker->RecordMuteFrame(); + checker->RecordNodataFrame(); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerGetAppUidFuzzTest() +{ + AudioProcessConfig cfg; + cfg.appInfo.appUid = g_fuzzUtils.GetData(); + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + int32_t uid = checker->GetAppUid(); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerDeleteCheckerParaFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + int32_t pid1 = g_fuzzUtils.GetData(); + int32_t pid2 = g_fuzzUtils.GetData(); + int32_t callbackId1 = g_fuzzUtils.GetData(); + int32_t callbackId2 = g_fuzzUtils.GetData(); + checker->InitChecker(para, pid1, callbackId2); + checker->InitChecker(para, pid2, callbackId2); + checker->DeleteCheckerPara(pid1, callbackId1); + checker->DeleteCheckerPara(pid1, callbackId2); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerMonitorCheckFrameFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = 0; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + checker->InitChecker(para, g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + if (g_fuzzUtils.GetData()) { + checker->RecordMuteFrame(); + checker->RecordNormalFrame(); + } + if (g_fuzzUtils.GetData()) { + for (int i = 0; i < COUNT; i++) { + checker->RecordNormalFrame(); + } + } + checker->MonitorCheckFrame(); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerMonitorOnAllCallbackFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = DEFAULT_TIME_INTERVAL; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + checker->InitChecker(para, g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + checker->MonitorOnAllCallback(g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerOnRemoteAppDiedFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = DEFAULT_TIME_INTERVAL; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + int32_t pid = g_fuzzUtils.GetData(); + checker->InitChecker(para, pid, g_fuzzUtils.GetData()); + checker->OnRemoteAppDied(pid); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerMonitorCheckFrameSubFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = DEFAULT_TIME_INTERVAL; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + checker->InitChecker(para, g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + CheckerParam checkerPara; + checkerPara.hasInitCheck = g_fuzzUtils.GetData(); + checkerPara.isMonitorMuteFrame = g_fuzzUtils.GetData(); + checkerPara.isMonitorNoDataFrame = g_fuzzUtils.GetData(); + if (g_fuzzUtils.GetData()) { + checkerPara.para.timeInterval = DEFAULT_TIME_INTERVAL; + } + checkerPara.lastUpdateTime = ClockTime::GetCurNano(); + checker->MonitorCheckFrameSub(checkerPara); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerMonitorCheckFrameActionFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = DEFAULT_TIME_INTERVAL; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + checker->InitChecker(para, g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + CheckerParam checkerPara; + checkerPara.lastStatus = g_fuzzUtils.GetData(); + checkerPara.sumFrameCount = DEFAULT_SUMFRAME_COUNT; + int64_t abnormalFrameNum = DEFAULT_ABNORMAL_FRAME_NUM; + float badFrameRatio = DEFAULT_FLOAT_BAD_FRAME_RATIO; + checker->MonitorCheckFrameAction(checkerPara, abnormalFrameNum, badFrameRatio); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerMonitorOnCallbackFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = DEFAULT_TIME_INTERVAL; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + checker->InitChecker(para, g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + CheckerParam checkerPara; + checkerPara.sumFrameCount = DEFAULT_SUMFRAME_COUNT; + checkerPara.hasInitCheck = g_fuzzUtils.GetData(); + checker->MonitorOnCallback(g_fuzzUtils.GetData(), + g_fuzzUtils.GetData(), checkerPara); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerRecordStandbyTimeFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = DEFAULT_TIME_INTERVAL; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + checker->InitChecker(para, g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + checker->RecordStandbyTime(g_fuzzUtils.GetData()); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerUpdateAppStateFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = DEFAULT_TIME_INTERVAL; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + checker->InitChecker(para, g_fuzzUtils.GetData(), g_fuzzUtils.GetData()); + checker->UpdateAppState(g_fuzzUtils.GetData()); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerStopCheckStreamThreadFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = DEFAULT_TIME_INTERVAL; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + checker->StopCheckStreamThread(); +} + +void AudioStreamCheckerCleanRecordDataFuzzTest() +{ + AudioProcessConfig cfg; + DataTransferMonitorParam para; + para.badDataTransferTypeBitMap = DEFAULT_BAD_DATA_TRANSFER_BIT_MAP; + para.timeInterval = DEFAULT_TIME_INTERVAL; + para.badFramesRatio = DEFAULT_BAD_FRAME_RATIO; + std::shared_ptr checker = std::make_shared(cfg); + CHECK_AND_RETURN(checker != nullptr); + CheckerParam tmpPara; + CheckerParam &checkerPara = tmpPara; + checker->CleanRecordData(checkerPara); + checker->StopCheckStreamThread(); +} + +vector g_testFuncs = { + AudioStreamCheckerInitCheckerFuzzTest, + AudioStreamCheckerRecordFrameFuzzTest, + AudioStreamCheckerGetAppUidFuzzTest, + AudioStreamCheckerDeleteCheckerParaFuzzTest, + AudioStreamCheckerMonitorCheckFrameFuzzTest, + AudioStreamCheckerMonitorOnAllCallbackFuzzTest, + AudioStreamCheckerOnRemoteAppDiedFuzzTest, + AudioStreamCheckerMonitorCheckFrameSubFuzzTest, + AudioStreamCheckerMonitorCheckFrameActionFuzzTest, + AudioStreamCheckerMonitorOnCallbackFuzzTest, + AudioStreamCheckerRecordStandbyTimeFuzzTest, + AudioStreamCheckerUpdateAppStateFuzzTest, + AudioStreamCheckerCleanRecordDataFuzzTest, +}; +} // namespace AudioStandard +} // namesapce OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + if (size < OHOS::AudioStandard::FUZZ_INPUT_SIZE_THRESHOLD) { + return 0; + } + + OHOS::AudioStandard::g_fuzzUtils.fuzzTest(data, size, OHOS::AudioStandard::g_testFuncs); + return 0; +} diff --git a/test/fuzztest/audiostreamchecker_fuzzer/corpus/init b/test/fuzztest/audiostreamchecker_fuzzer/corpus/init new file mode 100644 index 0000000000..8f37f09254 --- /dev/null +++ b/test/fuzztest/audiostreamchecker_fuzzer/corpus/init @@ -0,0 +1,13 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +FUZZ \ No newline at end of file diff --git a/test/fuzztest/audiostreamchecker_fuzzer/project.xml b/test/fuzztest/audiostreamchecker_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/audiostreamchecker_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + -- Gitee