From ce3ceecc1329775e81251257ade593ae120273b6 Mon Sep 17 00:00:00 2001 From: yangliping Date: Wed, 2 Nov 2022 10:41:36 +0800 Subject: [PATCH 1/6] fuzz test case add and update Signed-off-by: yangliping --- test/BUILD.gn | 3 + .../audio_manager_fuzzer.cpp | 2 - test/fuzztest/audiopolicy_fuzzer/BUILD.gn | 1 - .../audio_policy_fuzzer.cpp | 55 +++--- .../audiopolicyanother_fuzzer/BUILD.gn | 55 ++++++ .../audio_policy_another_fuzzer.cpp | 156 ++++++++++++++++++ .../audiopolicyanother_fuzzer/project.xml | 25 +++ test/fuzztest/audioserver_fuzzer/BUILD.gn | 6 +- .../audio_server_fuzzer.cpp | 63 ++++--- .../audioserverbalance_fuzzer/BUILD.gn | 51 ++++++ .../audio_server_balance_fuzzer.cpp | 81 +++++++++ .../audioserverbalance_fuzzer/project.xml | 25 +++ .../audiostreamcollector_fuzzer/BUILD.gn | 55 ++++++ .../audio_stream_collector_fuzzer.cpp | 73 ++++++++ .../audiostreamcollector_fuzzer/project.xml | 25 +++ 15 files changed, 608 insertions(+), 68 deletions(-) create mode 100644 test/fuzztest/audiopolicyanother_fuzzer/BUILD.gn create mode 100644 test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp create mode 100644 test/fuzztest/audiopolicyanother_fuzzer/project.xml create mode 100644 test/fuzztest/audioserverbalance_fuzzer/BUILD.gn create mode 100644 test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp create mode 100644 test/fuzztest/audioserverbalance_fuzzer/project.xml create mode 100644 test/fuzztest/audiostreamcollector_fuzzer/BUILD.gn create mode 100644 test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp create mode 100644 test/fuzztest/audiostreamcollector_fuzzer/project.xml diff --git a/test/BUILD.gn b/test/BUILD.gn index c2926b1273..e90eac777b 100644 --- a/test/BUILD.gn +++ b/test/BUILD.gn @@ -39,6 +39,9 @@ group("audio_fuzz_test") { deps = [ "fuzztest/audiomanager_fuzzer:fuzztest", "fuzztest/audiopolicy_fuzzer:fuzztest", + "fuzztest/audiopolicyanother_fuzzer:fuzztest", "fuzztest/audioserver_fuzzer:fuzztest", + "fuzztest/audioserverbalance_fuzzer:fuzztest", + "fuzztest/audiostreamcollector_fuzzer:fuzztest", ] } diff --git a/test/fuzztest/audiomanager_fuzzer/audio_manager_fuzzer.cpp b/test/fuzztest/audiomanager_fuzzer/audio_manager_fuzzer.cpp index d3c94e38f7..8392be84ff 100644 --- a/test/fuzztest/audiomanager_fuzzer/audio_manager_fuzzer.cpp +++ b/test/fuzztest/audiomanager_fuzzer/audio_manager_fuzzer.cpp @@ -34,7 +34,6 @@ const int32_t LIMITSIZE = 4; void AudioManagerFuzzTest(const uint8_t* data, size_t size) { if ((data == nullptr) || (size < LIMITSIZE)) { - std::cout << "Invalid data" << std::endl; return; } @@ -57,7 +56,6 @@ void AudioManagerFuzzTest(const uint8_t* data, size_t size) void AudioStreamManagerFuzzTest(const uint8_t* data, size_t size) { if ((data == nullptr) || (size < LIMITSIZE)) { - std::cout << "Invalid data" << std::endl; return; } diff --git a/test/fuzztest/audiopolicy_fuzzer/BUILD.gn b/test/fuzztest/audiopolicy_fuzzer/BUILD.gn index 46dcd82043..8af7ed373b 100644 --- a/test/fuzztest/audiopolicy_fuzzer/BUILD.gn +++ b/test/fuzztest/audiopolicy_fuzzer/BUILD.gn @@ -35,7 +35,6 @@ ohos_fuzztest("AudioPolicyFuzzTest") { deps = [ "$hdf_uhdf_path/hdi:libhdi", "//foundation/barrierfree/accessibility/interfaces/innerkits/acfwk:accessibilityconfig", - "//foundation/multimedia/audio_framework/services/audio_policy:audio_policy_client", "//foundation/multimedia/audio_framework/services/audio_policy:audio_policy_service", ] external_deps = [ diff --git a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp index d2945f2092..a8245ef9f1 100644 --- a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp +++ b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp @@ -21,41 +21,40 @@ using namespace std; namespace OHOS { +namespace AudioStandard { constexpr int32_t OFFSET = 4; const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; const int32_t SYSTEM_ABILITY_ID = 3009; const bool RUN_ON_CREATE = false; const int32_t LIMITSIZE = 4; - namespace AudioStandard { - uint32_t Convert2Uint32(const uint8_t *ptr) - { - if (ptr == nullptr) { - return 0; - } - // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 - return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); + uint32_t Convert2Uint32(const uint8_t *ptr) + { + if (ptr == nullptr) { + return 0; } - void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr || size < LIMITSIZE) { - std::cout << "Invalid data" << std::endl; - return; - } - uint32_t code = Convert2Uint32(rawData); - rawData = rawData + OFFSET; - size = size - OFFSET; - - MessageParcel data; - data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); - data.WriteBuffer(rawData, size); - data.RewindRead(0); - MessageParcel reply; - MessageOption option; - std::shared_ptr AudioPolicyServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - AudioPolicyServerPtr->OnRemoteRequest(code, data, reply, option); + // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); + } + void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) + { + if (rawData == nullptr || size < LIMITSIZE) { + return; } - } // namespace AudioStandard + uint32_t code = Convert2Uint32(rawData); + rawData = rawData + OFFSET; + size = size - OFFSET; + + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + MessageParcel reply; + MessageOption option; + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + AudioPolicyServerPtr->OnRemoteRequest(code, data, reply, option); + } +} // namespace AudioStandard } // namesapce OHOS /* Fuzzer entry point */ diff --git a/test/fuzztest/audiopolicyanother_fuzzer/BUILD.gn b/test/fuzztest/audiopolicyanother_fuzzer/BUILD.gn new file mode 100644 index 0000000000..e0cc0ff811 --- /dev/null +++ b/test/fuzztest/audiopolicyanother_fuzzer/BUILD.gn @@ -0,0 +1,55 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/test.gni") +import("//drivers/hdf_core/adapter/uhdf2/uhdf.gni") + +ohos_fuzztest("AudioPolicyAnotherFuzzTest") { + module_out_path = "multimedia_audio_framework/audiopolicyanother_fuzzer" + fuzz_config_file = "//foundation/multimedia/audio_framework/test/fuzztest/audiopolicyanother_fuzzer" + + include_dirs = [ "//foundation/multimedia/audio_framework/services/audio_policy/server/include" ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + configs = [ "//foundation/multimedia/audio_framework/services/audio_policy:audio_policy_public_config" ] + + sources = [ "audio_policy_another_fuzzer.cpp" ] + + deps = [ + "$hdf_uhdf_path/hdi:libhdi", + "//foundation/barrierfree/accessibility/interfaces/innerkits/acfwk:accessibilityconfig", + "//foundation/multimedia/audio_framework/services/audio_policy:audio_policy_service", + ] + external_deps = [ + "ability_base:want", + "access_token:libaccesstoken_sdk", + "access_token:libtoken_setproc", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "hiviewdfx_hilog_native:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] +} + +group("fuzztest") { + testonly = true + deps = [ ":AudioPolicyAnotherFuzzTest" ] +} diff --git a/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp b/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp new file mode 100644 index 0000000000..6ef2419b82 --- /dev/null +++ b/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp @@ -0,0 +1,156 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include "audio_policy_server.h" +#include +#include +#include "message_parcel.h" +#include "audio_info.h" +using namespace std; + +namespace OHOS { +namespace AudioStandard { + const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; + const int32_t SYSTEM_ABILITY_ID = 3009; + const bool RUN_ON_CREATE = false; + const int32_t LIMITSIZE = 4; + void AudioVolumeFuzzTest(const uint8_t *rawData, size_t size) + { + if (rawData == nullptr || size < LIMITSIZE) { + return; + } + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + AudioStreamType streamType = *reinterpret_cast(rawData); + float volume = *reinterpret_cast(rawData); + int32_t streamId = *reinterpret_cast(rawData); + bool mute = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetStreamVolume(streamType, volume); + AudioPolicyServerPtr->GetStreamVolume(streamType); + AudioPolicyServerPtr->SetLowPowerVolume(streamId, volume); + AudioPolicyServerPtr->GetLowPowerVolume(streamId); + AudioPolicyServerPtr->GetSingleStreamVolume(streamId); + AudioPolicyServerPtr->SetStreamMute(streamType, mute); + AudioPolicyServerPtr->GetStreamMute(streamType); + AudioPolicyServerPtr->IsStreamActive(streamType); + } + void AudioDeviceFuzzTest(const uint8_t *rawData, size_t size) + { + if (rawData == nullptr || size < LIMITSIZE) { + return; + } + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + InternalDeviceType deviceType = *reinterpret_cast(rawData); + bool active = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetDeviceActive(deviceType, active); + AudioPolicyServerPtr->IsDeviceActive(deviceType); + AudioRingerMode ringMode = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetRingerMode(ringMode); + int32_t ltonetype = *reinterpret_cast(rawData); + AudioPolicyServerPtr->GetToneConfig(ltonetype); + AudioScene audioScene = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetAudioScene(audioScene); + bool mute = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetMicrophoneMute(mute); + int32_t clientId = *reinterpret_cast(rawData); + sptr object = data.ReadRemoteObject(); + AudioPolicyServerPtr->SetRingerModeCallback(clientId, object); + AudioPolicyServerPtr->UnsetRingerModeCallback(clientId); + DeviceFlag flag = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetDeviceChangeCallback(clientId, flag, object); + AudioPolicyServerPtr->UnsetDeviceChangeCallback(clientId); + } + void AudioInterruptFuzzTest(const uint8_t *rawData, size_t size) + { + if (rawData == nullptr || size < LIMITSIZE) { + return; + } + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + sptr object = data.ReadRemoteObject(); + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + uint32_t sessionID = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetAudioInterruptCallback(sessionID, object); + AudioPolicyServerPtr->UnsetAudioInterruptCallback(sessionID); + uint32_t clientID = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetAudioManagerInterruptCallback(clientID, object); + AudioInterrupt audioInterrupt; + audioInterrupt.contentType = CONTENT_TYPE_RINGTONE; + audioInterrupt.streamUsage = STREAM_USAGE_NOTIFICATION_RINGTONE; + audioInterrupt.streamType = STREAM_ACCESSIBILITY; + AudioPolicyServerPtr->RequestAudioFocus(clientID, audioInterrupt); + AudioPolicyServerPtr->AbandonAudioFocus(clientID, audioInterrupt); + } + void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) + { + if (rawData == nullptr || size < LIMITSIZE) { + return; + } + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + sptr object = data.ReadRemoteObject(); + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + int32_t clientPid = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetVolumeKeyEventCallback(clientPid, object); + AudioPolicyServerPtr->UnsetVolumeKeyEventCallback(clientPid); + uint32_t sessionID = *reinterpret_cast(rawData); + AudioPolicyServerPtr->OnSessionRemoved(sessionID); + int32_t clientUID = *reinterpret_cast(rawData); + AudioPolicyServerPtr->RegisterAudioRendererEventListener(clientUID, object); + AudioPolicyServerPtr->UnregisterAudioRendererEventListener(clientUID); + AudioPolicyServerPtr->RegisterAudioCapturerEventListener(clientUID, object); + AudioPolicyServerPtr->UnregisterAudioCapturerEventListener(clientUID); + AudioPolicyServer::DeathRecipientId id = + *reinterpret_cast(rawData); + AudioPolicyServerPtr->RegisterClientDeathRecipient(object, id); + int pid = *reinterpret_cast(rawData); + AudioPolicyServerPtr->RegisteredTrackerClientDied(pid); + AudioStreamInfo audioStreamInfo = {}; + audioStreamInfo.samplingRate = *reinterpret_cast(rawData); + audioStreamInfo.channels = *reinterpret_cast(rawData); + audioStreamInfo.format = *reinterpret_cast(rawData); + audioStreamInfo.encoding = *reinterpret_cast(rawData); + AudioPolicyServerPtr->IsAudioRendererLowLatencySupported(audioStreamInfo); + int32_t clientUid = *reinterpret_cast(rawData); + StreamSetState streamSetState = *reinterpret_cast(rawData); + AudioStreamType audioStreamType = *reinterpret_cast(rawData); + AudioPolicyServerPtr->UpdateStreamState(clientUid, streamSetState, audioStreamType); + } + } // namespace AudioStandard +} // namesapce OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + OHOS::AudioStandard::AudioVolumeFuzzTest(data, size); + OHOS::AudioStandard::AudioDeviceFuzzTest(data, size); + OHOS::AudioStandard::AudioInterruptFuzzTest(data, size); + OHOS::AudioStandard::AudioPolicyFuzzTest(data, size); + return 0; +} + diff --git a/test/fuzztest/audiopolicyanother_fuzzer/project.xml b/test/fuzztest/audiopolicyanother_fuzzer/project.xml new file mode 100644 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/audiopolicyanother_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/audioserver_fuzzer/BUILD.gn b/test/fuzztest/audioserver_fuzzer/BUILD.gn index 4e76b26a35..63f0f75e9f 100644 --- a/test/fuzztest/audioserver_fuzzer/BUILD.gn +++ b/test/fuzztest/audioserver_fuzzer/BUILD.gn @@ -29,16 +29,12 @@ ohos_fuzztest("AudioServerFuzzTest") { "-fno-omit-frame-pointer", ] - sources = [ - "audio_server_balance_fuzzer.cpp", - "audio_server_fuzzer.cpp", - ] + sources = [ "audio_server_fuzzer.cpp" ] configs = [ "//foundation/multimedia/audio_framework/services/audio_service:audio_service_config" ] deps = [ "$hdf_uhdf_path/hdi:libhdi", - "//foundation/multimedia/audio_framework/services/audio_service:audio_client", "//foundation/multimedia/audio_framework/services/audio_service:audio_service", ] external_deps = [ diff --git a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp index 5be1386fba..bf5022ae86 100644 --- a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp +++ b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp @@ -18,50 +18,49 @@ #include #include #include "message_parcel.h" - using namespace std; namespace OHOS { -constexpr int32_t OFFSET = 4; +namespace AudioStandard { + constexpr int32_t OFFSET = 4; const std::u16string FORMMGR_INTERFACE_TOKEN = u"IStandardAudioService"; const int32_t SYSTEM_ABILITY_ID = 3001; const bool RUN_ON_CREATE = false; - namespace AudioStandard { - uint32_t Convert2Uint32(const uint8_t *ptr) - { - if (ptr == nullptr) { - return 0; - } - // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 - return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); + const int32_t LIMITSIZE = 4; + uint32_t Convert2Uint32(const uint8_t *ptr) + { + if (ptr == nullptr) { + return 0; } - void AudioServerFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr) { - std::cout << "Invalid data" << std::endl; - return; - } - uint32_t code = Convert2Uint32(rawData); - rawData = rawData + OFFSET; - size = size - OFFSET; - - MessageParcel data; - data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); - data.WriteBuffer(rawData, size); - data.RewindRead(0); - MessageParcel reply; - MessageOption option; - std::shared_ptr AudioServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - AudioServerPtr->OnRemoteRequest(code, data, reply, option); + // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); + } + void AudioServerFuzzTest(const uint8_t *rawData, size_t size) + { + if (rawData == nullptr || size < LIMITSIZE) { + return; } - } // namespace AudioStandard + uint32_t code = Convert2Uint32(rawData); + rawData = rawData + OFFSET; + size = size - OFFSET; + + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + MessageParcel reply; + MessageOption option; + std::shared_ptr AudioServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + AudioServerPtr->OnRemoteRequest(code, data, reply, option); + } +} // namespace AudioStandard } // namesapce OHOS /* Fuzzer entry point */ -extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* Run your code on data */ OHOS::AudioStandard::AudioServerFuzzTest(data, size); return 0; -} +} \ No newline at end of file diff --git a/test/fuzztest/audioserverbalance_fuzzer/BUILD.gn b/test/fuzztest/audioserverbalance_fuzzer/BUILD.gn new file mode 100644 index 0000000000..6a8ad2ffca --- /dev/null +++ b/test/fuzztest/audioserverbalance_fuzzer/BUILD.gn @@ -0,0 +1,51 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/test.gni") +import("//drivers/hdf_core/adapter/uhdf2/uhdf.gni") + +ohos_fuzztest("AudioServerBalanceFuzzTest") { + module_out_path = "multimedia_audio_framework/audioserverbalance_fuzzer" + fuzz_config_file = "//foundation/multimedia/audio_framework/test/fuzztest/audioserverbalance_fuzzer" + + include_dirs = [ "//foundation/multimedia/audio_framework/services/audio_service/server/include" ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ "audio_server_balance_fuzzer.cpp" ] + + configs = [ "//foundation/multimedia/audio_framework/services/audio_service:audio_service_config" ] + + deps = [ + "$hdf_uhdf_path/hdi:libhdi", + "//foundation/multimedia/audio_framework/services/audio_service:audio_service", + ] + external_deps = [ + "access_token:libaccesstoken_sdk", + "c_utils:utils", + "ipc:ipc_core", + "power_manager:powermgr_client", + "safwk:system_ability_fwk", + ] +} + +group("fuzztest") { + testonly = true + deps = [ ":AudioServerBalanceFuzzTest" ] +} diff --git a/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp b/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp new file mode 100644 index 0000000000..68db120199 --- /dev/null +++ b/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp @@ -0,0 +1,81 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include +#include +#include "audio_manager_base.h" +#include "audio_server.h" +#include "message_parcel.h" +using namespace std; + +namespace OHOS { +namespace AudioStandard { + const int32_t SYSTEM_ABILITY_ID = 3001; + const bool RUN_ON_CREATE = false; + const int32_t LIMITSIZE = 4; + float Convert2Float(const uint8_t *ptr) + { + // 根据ptr的大小随机生成区间[-1, +1]内的float值 + float floatValue = static_cast(*ptr); + return floatValue / 128.0f - 1.0f; + } + + void AudioServerBalanceFuzzer(const uint8_t *rawData, size_t size, std::shared_ptr AudioServerPtr) + { + float balanceValue = Convert2Float(rawData); + MessageParcel data; + data.WriteFloat(balanceValue); + MessageParcel reply; + MessageOption option; + AudioServerPtr->OnRemoteRequest(AudioManagerStub::SET_AUDIO_BALANCE_VALUE, data, reply, option); + } + + bool Convert2Bool(const uint8_t *ptr) + { + // 根据ptr的值随机生成bool值 + return (ptr[0] & 1) ? true : false; + } + + void AudioServerMonoFuzzer(const uint8_t *rawData, size_t size, std::shared_ptr AudioServerPtr) + { + bool monoState = Convert2Bool(rawData); + MessageParcel data; + data.WriteBool(monoState); + MessageParcel reply; + MessageOption option; + AudioServerPtr->OnRemoteRequest(AudioManagerStub::SET_AUDIO_MONO_STATE, data, reply, option); + } + + void AudioServerBalanceFuzzTest(const uint8_t *rawData, size_t size) + { + if (rawData == nullptr || size < LIMITSIZE) { + return; + } + std::shared_ptr AudioServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + AudioServerBalanceFuzzer(rawData, size, AudioServerPtr); + AudioServerMonoFuzzer(rawData, size, AudioServerPtr); + } +} // namespace AudioStandard +} // namesapce OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + OHOS::AudioStandard::AudioServerBalanceFuzzTest(data, size); + return 0; +} diff --git a/test/fuzztest/audioserverbalance_fuzzer/project.xml b/test/fuzztest/audioserverbalance_fuzzer/project.xml new file mode 100644 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/audioserverbalance_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/audiostreamcollector_fuzzer/BUILD.gn b/test/fuzztest/audiostreamcollector_fuzzer/BUILD.gn new file mode 100644 index 0000000000..9ccb7fba5d --- /dev/null +++ b/test/fuzztest/audiostreamcollector_fuzzer/BUILD.gn @@ -0,0 +1,55 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/test.gni") +import("//drivers/hdf_core/adapter/uhdf2/uhdf.gni") + +ohos_fuzztest("AudioStreamCollectorFuzzTest") { + module_out_path = "multimedia_audio_framework/audiostreamcollector_fuzzer" + fuzz_config_file = "//foundation/multimedia/audio_framework/test/fuzztest/audiostreamcollector_fuzzer" + + include_dirs = [ "//foundation/multimedia/audio_framework/services/audio_policy/server/include" ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + configs = [ "//foundation/multimedia/audio_framework/services/audio_policy:audio_policy_public_config" ] + + sources = [ "audio_stream_collector_fuzzer.cpp" ] + + deps = [ + "$hdf_uhdf_path/hdi:libhdi", + "//foundation/barrierfree/accessibility/interfaces/innerkits/acfwk:accessibilityconfig", + "//foundation/multimedia/audio_framework/services/audio_policy:audio_policy_service", + ] + external_deps = [ + "ability_base:want", + "access_token:libaccesstoken_sdk", + "access_token:libtoken_setproc", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "hiviewdfx_hilog_native:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] +} + +group("fuzztest") { + testonly = true + deps = [ ":AudioStreamCollectorFuzzTest" ] +} diff --git a/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp b/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp new file mode 100644 index 0000000000..c254a9094c --- /dev/null +++ b/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp @@ -0,0 +1,73 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include +#include +#include "message_parcel.h" +#include "audio_info.h" +#include "audio_stream_collector.h" +using namespace std; + +namespace OHOS { +namespace AudioStandard { + const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; + const int32_t LIMITSIZE = 4; + void AudioStreamCollectorFuzzTest(const uint8_t *rawData, size_t size) + { + if (rawData == nullptr || size < LIMITSIZE) { + return; + } + int32_t clientUID = *reinterpret_cast(rawData); + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + sptr object = data.ReadRemoteObject(); + bool hasBTPermission = *reinterpret_cast(rawData); + AudioStreamCollector::GetAudioStreamCollector() + .RegisterAudioRendererEventListener(clientUID, object, hasBTPermission); + AudioStreamCollector::GetAudioStreamCollector().UnregisterAudioRendererEventListener(clientUID); + AudioStreamCollector::GetAudioStreamCollector() + .RegisterAudioCapturerEventListener(clientUID, object, hasBTPermission); + AudioStreamCollector::GetAudioStreamCollector().UnregisterAudioCapturerEventListener(clientUID); + + int32_t uid = *reinterpret_cast(rawData); + AudioStreamCollector::GetAudioStreamCollector().RegisteredTrackerClientDied(uid); + AudioStreamCollector::GetAudioStreamCollector().RegisteredStreamListenerClientDied(uid); + + int32_t clientUid = *reinterpret_cast(rawData); + StreamSetStateEventInternal streamSetStateEventInternal = {}; + streamSetStateEventInternal.streamSetState = *reinterpret_cast(rawData); + streamSetStateEventInternal.audioStreamType = *reinterpret_cast(rawData); + AudioStreamCollector::GetAudioStreamCollector(). + UpdateStreamState(clientUid, streamSetStateEventInternal); + + int32_t streamId = *reinterpret_cast(rawData); + float volume = *reinterpret_cast(rawData); + AudioStreamCollector::GetAudioStreamCollector().SetLowPowerVolume(streamId, volume); + AudioStreamCollector::GetAudioStreamCollector().GetLowPowerVolume(streamId); + AudioStreamCollector::GetAudioStreamCollector().GetSingleStreamVolume(streamId); + } +} // namespace AudioStandard +} // namesapce OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + OHOS::AudioStandard::AudioStreamCollectorFuzzTest(data, size); + return 0; +} diff --git a/test/fuzztest/audiostreamcollector_fuzzer/project.xml b/test/fuzztest/audiostreamcollector_fuzzer/project.xml new file mode 100644 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/audiostreamcollector_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + -- Gitee From bbe086bf3e9919a762b095d0fe9574bcd26f46e9 Mon Sep 17 00:00:00 2001 From: yangliping Date: Wed, 2 Nov 2022 15:10:10 +0800 Subject: [PATCH 2/6] fuzz test case update and add Signed-off-by: yangliping --- .../audio_policy_fuzzer.cpp | 63 +++-- .../audio_policy_another_fuzzer.cpp | 256 ++++++++++-------- .../audio_server_fuzzer.cpp | 62 +++-- .../audio_server_balance_fuzzer.cpp | 83 +++--- .../audio_stream_collector_fuzzer.cpp | 74 ++--- 5 files changed, 290 insertions(+), 248 deletions(-) diff --git a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp index a8245ef9f1..61c97aa6de 100644 --- a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp +++ b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp @@ -22,38 +22,43 @@ using namespace std; namespace OHOS { namespace AudioStandard { - constexpr int32_t OFFSET = 4; - const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; - const int32_t SYSTEM_ABILITY_ID = 3009; - const bool RUN_ON_CREATE = false; - const int32_t LIMITSIZE = 4; - uint32_t Convert2Uint32(const uint8_t *ptr) - { - if (ptr == nullptr) { - return 0; - } - // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 - return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); +constexpr int32_t OFFSET = 4; +const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; +const int32_t SYSTEM_ABILITY_ID = 3009; +const bool RUN_ON_CREATE = false; +const int32_t LIMITSIZE = 4; + +uint32_t Convert2Uint32(const uint8_t *ptr) +{ + if (ptr == nullptr) { + return 0; } - void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr || size < LIMITSIZE) { - return; - } - uint32_t code = Convert2Uint32(rawData); - rawData = rawData + OFFSET; - size = size - OFFSET; + // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); +} - MessageParcel data; - data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); - data.WriteBuffer(rawData, size); - data.RewindRead(0); - MessageParcel reply; - MessageOption option; - std::shared_ptr AudioPolicyServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - AudioPolicyServerPtr->OnRemoteRequest(code, data, reply, option); +void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) +{ + if (rawData == nullptr || size < LIMITSIZE) { + return; } + uint32_t code = Convert2Uint32(rawData); + rawData = rawData + OFFSET; + size = size - OFFSET; + + //data build + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + + MessageParcel reply; + MessageOption option; + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + + AudioPolicyServerPtr->OnRemoteRequest(code, data, reply, option); +} } // namespace AudioStandard } // namesapce OHOS diff --git a/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp b/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp index 6ef2419b82..8ad745d3a2 100644 --- a/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp +++ b/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp @@ -23,124 +23,152 @@ using namespace std; namespace OHOS { namespace AudioStandard { - const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; - const int32_t SYSTEM_ABILITY_ID = 3009; - const bool RUN_ON_CREATE = false; - const int32_t LIMITSIZE = 4; - void AudioVolumeFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr || size < LIMITSIZE) { - return; - } - std::shared_ptr AudioPolicyServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - AudioStreamType streamType = *reinterpret_cast(rawData); - float volume = *reinterpret_cast(rawData); - int32_t streamId = *reinterpret_cast(rawData); - bool mute = *reinterpret_cast(rawData); - AudioPolicyServerPtr->SetStreamVolume(streamType, volume); - AudioPolicyServerPtr->GetStreamVolume(streamType); - AudioPolicyServerPtr->SetLowPowerVolume(streamId, volume); - AudioPolicyServerPtr->GetLowPowerVolume(streamId); - AudioPolicyServerPtr->GetSingleStreamVolume(streamId); - AudioPolicyServerPtr->SetStreamMute(streamType, mute); - AudioPolicyServerPtr->GetStreamMute(streamType); - AudioPolicyServerPtr->IsStreamActive(streamType); +const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; +const int32_t SYSTEM_ABILITY_ID = 3009; +const bool RUN_ON_CREATE = false; +const int32_t LIMITSIZE = 4; + +void AudioVolumeFuzzTest(const uint8_t *rawData, size_t size) +{ + if (rawData == nullptr || size < LIMITSIZE) { + return; } - void AudioDeviceFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr || size < LIMITSIZE) { - return; - } - MessageParcel data; - data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); - data.WriteBuffer(rawData, size); - data.RewindRead(0); - std::shared_ptr AudioPolicyServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - InternalDeviceType deviceType = *reinterpret_cast(rawData); - bool active = *reinterpret_cast(rawData); - AudioPolicyServerPtr->SetDeviceActive(deviceType, active); - AudioPolicyServerPtr->IsDeviceActive(deviceType); - AudioRingerMode ringMode = *reinterpret_cast(rawData); - AudioPolicyServerPtr->SetRingerMode(ringMode); - int32_t ltonetype = *reinterpret_cast(rawData); - AudioPolicyServerPtr->GetToneConfig(ltonetype); - AudioScene audioScene = *reinterpret_cast(rawData); - AudioPolicyServerPtr->SetAudioScene(audioScene); - bool mute = *reinterpret_cast(rawData); - AudioPolicyServerPtr->SetMicrophoneMute(mute); - int32_t clientId = *reinterpret_cast(rawData); - sptr object = data.ReadRemoteObject(); - AudioPolicyServerPtr->SetRingerModeCallback(clientId, object); - AudioPolicyServerPtr->UnsetRingerModeCallback(clientId); - DeviceFlag flag = *reinterpret_cast(rawData); - AudioPolicyServerPtr->SetDeviceChangeCallback(clientId, flag, object); - AudioPolicyServerPtr->UnsetDeviceChangeCallback(clientId); + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + + AudioStreamType streamType = *reinterpret_cast(rawData); + float volume = *reinterpret_cast(rawData); + int32_t streamId = *reinterpret_cast(rawData); + bool mute = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetStreamVolume(streamType, volume); + AudioPolicyServerPtr->GetStreamVolume(streamType); + AudioPolicyServerPtr->SetLowPowerVolume(streamId, volume); + AudioPolicyServerPtr->GetLowPowerVolume(streamId); + AudioPolicyServerPtr->GetSingleStreamVolume(streamId); + AudioPolicyServerPtr->SetStreamMute(streamType, mute); + AudioPolicyServerPtr->GetStreamMute(streamType); + AudioPolicyServerPtr->IsStreamActive(streamType); +} + +void AudioDeviceFuzzTest(const uint8_t *rawData, size_t size) +{ + if (rawData == nullptr || size < LIMITSIZE) { + return; } - void AudioInterruptFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr || size < LIMITSIZE) { - return; - } - MessageParcel data; - data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); - data.WriteBuffer(rawData, size); - data.RewindRead(0); - sptr object = data.ReadRemoteObject(); - std::shared_ptr AudioPolicyServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - uint32_t sessionID = *reinterpret_cast(rawData); - AudioPolicyServerPtr->SetAudioInterruptCallback(sessionID, object); - AudioPolicyServerPtr->UnsetAudioInterruptCallback(sessionID); - uint32_t clientID = *reinterpret_cast(rawData); - AudioPolicyServerPtr->SetAudioManagerInterruptCallback(clientID, object); - AudioInterrupt audioInterrupt; - audioInterrupt.contentType = CONTENT_TYPE_RINGTONE; - audioInterrupt.streamUsage = STREAM_USAGE_NOTIFICATION_RINGTONE; - audioInterrupt.streamType = STREAM_ACCESSIBILITY; - AudioPolicyServerPtr->RequestAudioFocus(clientID, audioInterrupt); - AudioPolicyServerPtr->AbandonAudioFocus(clientID, audioInterrupt); + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + + //data build + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + + InternalDeviceType deviceType = *reinterpret_cast(rawData); + bool active = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetDeviceActive(deviceType, active); + AudioPolicyServerPtr->IsDeviceActive(deviceType); + + AudioRingerMode ringMode = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetRingerMode(ringMode); + + int32_t ltonetype = *reinterpret_cast(rawData); + AudioPolicyServerPtr->GetToneConfig(ltonetype); + + AudioScene audioScene = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetAudioScene(audioScene); + + bool mute = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetMicrophoneMute(mute); + + int32_t clientId = *reinterpret_cast(rawData); + sptr object = data.ReadRemoteObject(); + AudioPolicyServerPtr->SetRingerModeCallback(clientId, object); + AudioPolicyServerPtr->UnsetRingerModeCallback(clientId); + + DeviceFlag flag = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetDeviceChangeCallback(clientId, flag, object); + AudioPolicyServerPtr->UnsetDeviceChangeCallback(clientId); +} + +void AudioInterruptFuzzTest(const uint8_t *rawData, size_t size) +{ + if (rawData == nullptr || size < LIMITSIZE) { + return; } - void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr || size < LIMITSIZE) { - return; - } - MessageParcel data; - data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); - data.WriteBuffer(rawData, size); - data.RewindRead(0); - sptr object = data.ReadRemoteObject(); - std::shared_ptr AudioPolicyServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - int32_t clientPid = *reinterpret_cast(rawData); - AudioPolicyServerPtr->SetVolumeKeyEventCallback(clientPid, object); - AudioPolicyServerPtr->UnsetVolumeKeyEventCallback(clientPid); - uint32_t sessionID = *reinterpret_cast(rawData); - AudioPolicyServerPtr->OnSessionRemoved(sessionID); - int32_t clientUID = *reinterpret_cast(rawData); - AudioPolicyServerPtr->RegisterAudioRendererEventListener(clientUID, object); - AudioPolicyServerPtr->UnregisterAudioRendererEventListener(clientUID); - AudioPolicyServerPtr->RegisterAudioCapturerEventListener(clientUID, object); - AudioPolicyServerPtr->UnregisterAudioCapturerEventListener(clientUID); - AudioPolicyServer::DeathRecipientId id = - *reinterpret_cast(rawData); - AudioPolicyServerPtr->RegisterClientDeathRecipient(object, id); - int pid = *reinterpret_cast(rawData); - AudioPolicyServerPtr->RegisteredTrackerClientDied(pid); - AudioStreamInfo audioStreamInfo = {}; - audioStreamInfo.samplingRate = *reinterpret_cast(rawData); - audioStreamInfo.channels = *reinterpret_cast(rawData); - audioStreamInfo.format = *reinterpret_cast(rawData); - audioStreamInfo.encoding = *reinterpret_cast(rawData); - AudioPolicyServerPtr->IsAudioRendererLowLatencySupported(audioStreamInfo); - int32_t clientUid = *reinterpret_cast(rawData); - StreamSetState streamSetState = *reinterpret_cast(rawData); - AudioStreamType audioStreamType = *reinterpret_cast(rawData); - AudioPolicyServerPtr->UpdateStreamState(clientUid, streamSetState, audioStreamType); + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + + //data build + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + + sptr object = data.ReadRemoteObject(); + uint32_t sessionID = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetAudioInterruptCallback(sessionID, object); + AudioPolicyServerPtr->UnsetAudioInterruptCallback(sessionID); + + uint32_t clientID = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetAudioManagerInterruptCallback(clientID, object); + + AudioInterrupt audioInterrupt; + audioInterrupt.contentType = *reinterpret_cast(rawData); + audioInterrupt.streamUsage = *reinterpret_cast(rawData); + audioInterrupt.streamType = *reinterpret_cast(rawData); + AudioPolicyServerPtr->RequestAudioFocus(clientID, audioInterrupt); + AudioPolicyServerPtr->AbandonAudioFocus(clientID, audioInterrupt); +} + +void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) +{ + if (rawData == nullptr || size < LIMITSIZE) { + return; } - } // namespace AudioStandard + std::shared_ptr AudioPolicyServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + + //data build + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + + sptr object = data.ReadRemoteObject(); + int32_t clientPid = *reinterpret_cast(rawData); + AudioPolicyServerPtr->SetVolumeKeyEventCallback(clientPid, object); + AudioPolicyServerPtr->UnsetVolumeKeyEventCallback(clientPid); + + uint32_t sessionID = *reinterpret_cast(rawData); + AudioPolicyServerPtr->OnSessionRemoved(sessionID); + + int32_t clientUID = *reinterpret_cast(rawData); + AudioPolicyServerPtr->RegisterAudioRendererEventListener(clientUID, object); + AudioPolicyServerPtr->UnregisterAudioRendererEventListener(clientUID); + AudioPolicyServerPtr->RegisterAudioCapturerEventListener(clientUID, object); + AudioPolicyServerPtr->UnregisterAudioCapturerEventListener(clientUID); + + AudioPolicyServer::DeathRecipientId id = + *reinterpret_cast(rawData); + AudioPolicyServerPtr->RegisterClientDeathRecipient(object, id); + + int pid = *reinterpret_cast(rawData); + AudioPolicyServerPtr->RegisteredTrackerClientDied(pid); + + AudioStreamInfo audioStreamInfo = {}; + audioStreamInfo.samplingRate = *reinterpret_cast(rawData); + audioStreamInfo.channels = *reinterpret_cast(rawData); + audioStreamInfo.format = *reinterpret_cast(rawData); + audioStreamInfo.encoding = *reinterpret_cast(rawData); + AudioPolicyServerPtr->IsAudioRendererLowLatencySupported(audioStreamInfo); + + int32_t clientUid = *reinterpret_cast(rawData); + StreamSetState streamSetState = *reinterpret_cast(rawData); + AudioStreamType audioStreamType = *reinterpret_cast(rawData); + AudioPolicyServerPtr->UpdateStreamState(clientUid, streamSetState, audioStreamType); +} +} // namespace AudioStandard } // namesapce OHOS /* Fuzzer entry point */ diff --git a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp index bf5022ae86..bc4ed80768 100644 --- a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp +++ b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp @@ -22,38 +22,42 @@ using namespace std; namespace OHOS { namespace AudioStandard { - constexpr int32_t OFFSET = 4; - const std::u16string FORMMGR_INTERFACE_TOKEN = u"IStandardAudioService"; - const int32_t SYSTEM_ABILITY_ID = 3001; - const bool RUN_ON_CREATE = false; - const int32_t LIMITSIZE = 4; - uint32_t Convert2Uint32(const uint8_t *ptr) - { - if (ptr == nullptr) { - return 0; - } - // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 - return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); +constexpr int32_t OFFSET = 4; +const std::u16string FORMMGR_INTERFACE_TOKEN = u"IStandardAudioService"; +const int32_t SYSTEM_ABILITY_ID = 3001; +const bool RUN_ON_CREATE = false; +const int32_t LIMITSIZE = 4; + +uint32_t Convert2Uint32(const uint8_t *ptr) +{ + if (ptr == nullptr) { + return 0; } - void AudioServerFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr || size < LIMITSIZE) { - return; - } - uint32_t code = Convert2Uint32(rawData); - rawData = rawData + OFFSET; - size = size - OFFSET; + // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); +} - MessageParcel data; - data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); - data.WriteBuffer(rawData, size); - data.RewindRead(0); - MessageParcel reply; - MessageOption option; - std::shared_ptr AudioServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - AudioServerPtr->OnRemoteRequest(code, data, reply, option); +void AudioServerFuzzTest(const uint8_t *rawData, size_t size) +{ + if (rawData == nullptr || size < LIMITSIZE) { + return; } + uint32_t code = Convert2Uint32(rawData); + rawData = rawData + OFFSET; + size = size - OFFSET; + + //data build + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + MessageParcel reply; + MessageOption option; + + std::shared_ptr AudioServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + AudioServerPtr->OnRemoteRequest(code, data, reply, option); +} } // namespace AudioStandard } // namesapce OHOS diff --git a/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp b/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp index 68db120199..ea971fda8b 100644 --- a/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp +++ b/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp @@ -23,52 +23,53 @@ using namespace std; namespace OHOS { namespace AudioStandard { - const int32_t SYSTEM_ABILITY_ID = 3001; - const bool RUN_ON_CREATE = false; - const int32_t LIMITSIZE = 4; - float Convert2Float(const uint8_t *ptr) - { - // 根据ptr的大小随机生成区间[-1, +1]内的float值 - float floatValue = static_cast(*ptr); - return floatValue / 128.0f - 1.0f; - } +const int32_t SYSTEM_ABILITY_ID = 3001; +const bool RUN_ON_CREATE = false; +const int32_t LIMITSIZE = 4; - void AudioServerBalanceFuzzer(const uint8_t *rawData, size_t size, std::shared_ptr AudioServerPtr) - { - float balanceValue = Convert2Float(rawData); - MessageParcel data; - data.WriteFloat(balanceValue); - MessageParcel reply; - MessageOption option; - AudioServerPtr->OnRemoteRequest(AudioManagerStub::SET_AUDIO_BALANCE_VALUE, data, reply, option); - } +float Convert2Float(const uint8_t *ptr) +{ + // 根据ptr的大小随机生成区间[-1, +1]内的float值 + float floatValue = static_cast(*ptr); + return floatValue / 128.0f - 1.0f; +} - bool Convert2Bool(const uint8_t *ptr) - { - // 根据ptr的值随机生成bool值 - return (ptr[0] & 1) ? true : false; - } +void AudioServerBalanceFuzzer(const uint8_t *rawData, size_t size, std::shared_ptr AudioServerPtr) +{ + float balanceValue = Convert2Float(rawData); + MessageParcel data; + data.WriteFloat(balanceValue); + MessageParcel reply; + MessageOption option; + AudioServerPtr->OnRemoteRequest(AudioManagerStub::SET_AUDIO_BALANCE_VALUE, data, reply, option); +} - void AudioServerMonoFuzzer(const uint8_t *rawData, size_t size, std::shared_ptr AudioServerPtr) - { - bool monoState = Convert2Bool(rawData); - MessageParcel data; - data.WriteBool(monoState); - MessageParcel reply; - MessageOption option; - AudioServerPtr->OnRemoteRequest(AudioManagerStub::SET_AUDIO_MONO_STATE, data, reply, option); - } +bool Convert2Bool(const uint8_t *ptr) +{ + // 根据ptr的值随机生成bool值 + return (ptr[0] & 1) ? true : false; +} - void AudioServerBalanceFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr || size < LIMITSIZE) { - return; - } - std::shared_ptr AudioServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - AudioServerBalanceFuzzer(rawData, size, AudioServerPtr); - AudioServerMonoFuzzer(rawData, size, AudioServerPtr); +void AudioServerMonoFuzzer(const uint8_t *rawData, size_t size, std::shared_ptr AudioServerPtr) +{ + bool monoState = Convert2Bool(rawData); + MessageParcel data; + data.WriteBool(monoState); + MessageParcel reply; + MessageOption option; + AudioServerPtr->OnRemoteRequest(AudioManagerStub::SET_AUDIO_MONO_STATE, data, reply, option); +} + +void AudioServerBalanceFuzzTest(const uint8_t *rawData, size_t size) +{ + if (rawData == nullptr || size < LIMITSIZE) { + return; } + std::shared_ptr AudioServerPtr = + std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); + AudioServerBalanceFuzzer(rawData, size, AudioServerPtr); + AudioServerMonoFuzzer(rawData, size, AudioServerPtr); +} } // namespace AudioStandard } // namesapce OHOS diff --git a/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp b/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp index c254a9094c..b40efde4e3 100644 --- a/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp +++ b/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp @@ -23,44 +23,48 @@ using namespace std; namespace OHOS { namespace AudioStandard { - const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; - const int32_t LIMITSIZE = 4; - void AudioStreamCollectorFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr || size < LIMITSIZE) { - return; - } - int32_t clientUID = *reinterpret_cast(rawData); - MessageParcel data; - data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); - data.WriteBuffer(rawData, size); - data.RewindRead(0); - sptr object = data.ReadRemoteObject(); - bool hasBTPermission = *reinterpret_cast(rawData); - AudioStreamCollector::GetAudioStreamCollector() - .RegisterAudioRendererEventListener(clientUID, object, hasBTPermission); - AudioStreamCollector::GetAudioStreamCollector().UnregisterAudioRendererEventListener(clientUID); - AudioStreamCollector::GetAudioStreamCollector() - .RegisterAudioCapturerEventListener(clientUID, object, hasBTPermission); - AudioStreamCollector::GetAudioStreamCollector().UnregisterAudioCapturerEventListener(clientUID); +const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; +const int32_t LIMITSIZE = 4; - int32_t uid = *reinterpret_cast(rawData); - AudioStreamCollector::GetAudioStreamCollector().RegisteredTrackerClientDied(uid); - AudioStreamCollector::GetAudioStreamCollector().RegisteredStreamListenerClientDied(uid); +void AudioStreamCollectorFuzzTest(const uint8_t *rawData, size_t size) +{ + if (rawData == nullptr || size < LIMITSIZE) { + return; + } - int32_t clientUid = *reinterpret_cast(rawData); - StreamSetStateEventInternal streamSetStateEventInternal = {}; - streamSetStateEventInternal.streamSetState = *reinterpret_cast(rawData); - streamSetStateEventInternal.audioStreamType = *reinterpret_cast(rawData); - AudioStreamCollector::GetAudioStreamCollector(). - UpdateStreamState(clientUid, streamSetStateEventInternal); + //data build + MessageParcel data; + data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); + data.WriteBuffer(rawData, size); + data.RewindRead(0); + + sptr object = data.ReadRemoteObject(); + int32_t clientUID = *reinterpret_cast(rawData); + bool hasBTPermission = *reinterpret_cast(rawData); + AudioStreamCollector::GetAudioStreamCollector() + .RegisterAudioRendererEventListener(clientUID, object, hasBTPermission); + AudioStreamCollector::GetAudioStreamCollector().UnregisterAudioRendererEventListener(clientUID); + AudioStreamCollector::GetAudioStreamCollector() + .RegisterAudioCapturerEventListener(clientUID, object, hasBTPermission); + AudioStreamCollector::GetAudioStreamCollector().UnregisterAudioCapturerEventListener(clientUID); - int32_t streamId = *reinterpret_cast(rawData); - float volume = *reinterpret_cast(rawData); - AudioStreamCollector::GetAudioStreamCollector().SetLowPowerVolume(streamId, volume); - AudioStreamCollector::GetAudioStreamCollector().GetLowPowerVolume(streamId); - AudioStreamCollector::GetAudioStreamCollector().GetSingleStreamVolume(streamId); - } + int32_t uid = *reinterpret_cast(rawData); + AudioStreamCollector::GetAudioStreamCollector().RegisteredTrackerClientDied(uid); + AudioStreamCollector::GetAudioStreamCollector().RegisteredStreamListenerClientDied(uid); + + int32_t clientUid = *reinterpret_cast(rawData); + StreamSetStateEventInternal streamSetStateEventInternal = {}; + streamSetStateEventInternal.streamSetState = *reinterpret_cast(rawData); + streamSetStateEventInternal.audioStreamType = *reinterpret_cast(rawData); + AudioStreamCollector::GetAudioStreamCollector(). + UpdateStreamState(clientUid, streamSetStateEventInternal); + + int32_t streamId = *reinterpret_cast(rawData); + float volume = *reinterpret_cast(rawData); + AudioStreamCollector::GetAudioStreamCollector().SetLowPowerVolume(streamId, volume); + AudioStreamCollector::GetAudioStreamCollector().GetLowPowerVolume(streamId); + AudioStreamCollector::GetAudioStreamCollector().GetSingleStreamVolume(streamId); +} } // namespace AudioStandard } // namesapce OHOS -- Gitee From 04be11e93ec48edf104072c88afc6f4c4740aed3 Mon Sep 17 00:00:00 2001 From: yangliping Date: Wed, 2 Nov 2022 15:59:09 +0800 Subject: [PATCH 3/6] fuzz test case update and add Signed-off-by: yangliping --- .../audio_policy_fuzzer.cpp | 3 +- .../audio_policy_another_fuzzer.cpp | 8 +- .../audio_server_balance_fuzzer.cpp | 83 ------------------- .../audio_server_fuzzer.cpp | 3 +- .../audio_stream_collector_fuzzer.cpp | 3 +- 5 files changed, 6 insertions(+), 94 deletions(-) delete mode 100644 test/fuzztest/audioserver_fuzzer/audio_server_balance_fuzzer.cpp diff --git a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp index 61c97aa6de..710ad66af5 100644 --- a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp +++ b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp @@ -14,9 +14,9 @@ */ #include -#include "audio_policy_server.h" #include #include +#include "audio_policy_server.h" #include "message_parcel.h" using namespace std; @@ -46,7 +46,6 @@ void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) rawData = rawData + OFFSET; size = size - OFFSET; - //data build MessageParcel data; data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); data.WriteBuffer(rawData, size); diff --git a/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp b/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp index 8ad745d3a2..ff8876960b 100644 --- a/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp +++ b/test/fuzztest/audiopolicyanother_fuzzer/audio_policy_another_fuzzer.cpp @@ -14,11 +14,12 @@ */ #include -#include "audio_policy_server.h" #include #include -#include "message_parcel.h" #include "audio_info.h" +#include "audio_policy_server.h" +#include "message_parcel.h" + using namespace std; namespace OHOS { @@ -58,7 +59,6 @@ void AudioDeviceFuzzTest(const uint8_t *rawData, size_t size) std::shared_ptr AudioPolicyServerPtr = std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - //data build MessageParcel data; data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); data.WriteBuffer(rawData, size); @@ -99,7 +99,6 @@ void AudioInterruptFuzzTest(const uint8_t *rawData, size_t size) std::shared_ptr AudioPolicyServerPtr = std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - //data build MessageParcel data; data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); data.WriteBuffer(rawData, size); @@ -129,7 +128,6 @@ void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) std::shared_ptr AudioPolicyServerPtr = std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - //data build MessageParcel data; data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); data.WriteBuffer(rawData, size); diff --git a/test/fuzztest/audioserver_fuzzer/audio_server_balance_fuzzer.cpp b/test/fuzztest/audioserver_fuzzer/audio_server_balance_fuzzer.cpp deleted file mode 100644 index 41397641aa..0000000000 --- a/test/fuzztest/audioserver_fuzzer/audio_server_balance_fuzzer.cpp +++ /dev/null @@ -1,83 +0,0 @@ -/* - * Copyright (c) 2022 Huawei Device Co., Ltd. - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -#include -#include -#include - -#include "audio_manager_base.h" -#include "audio_server.h" -#include "message_parcel.h" - -using namespace std; - -namespace OHOS { - const int32_t SYSTEM_ABILITY_ID = 3001; - const bool RUN_ON_CREATE = false; - namespace AudioStandard { - float Convert2Float(const uint8_t *ptr) - { - // 根据ptr的大小随机生成区间[-1, +1]内的float值 - float floatValue = static_cast(*ptr); - return floatValue / 128.0f - 1.0f; - } - - void AudioServerBalanceFuzzer(const uint8_t *rawData, size_t size, std::shared_ptr AudioServerPtr) - { - float balanceValue = Convert2Float(rawData); - MessageParcel data; - data.WriteFloat(balanceValue); - MessageParcel reply; - MessageOption option; - AudioServerPtr->OnRemoteRequest(AudioManagerStub::SET_AUDIO_BALANCE_VALUE, data, reply, option); - } - - bool Convert2Bool(const uint8_t *ptr) - { - // 根据ptr的值随机生成bool值 - return (ptr[0] & 1) ? true : false; - } - - void AudioServerMonoFuzzer(const uint8_t *rawData, size_t size, std::shared_ptr AudioServerPtr) - { - bool monoState = Convert2Bool(rawData); - MessageParcel data; - data.WriteBool(monoState); - MessageParcel reply; - MessageOption option; - AudioServerPtr->OnRemoteRequest(AudioManagerStub::SET_AUDIO_MONO_STATE, data, reply, option); - } - - void AudioServerBalanceFuzzTest(const uint8_t *rawData, size_t size) - { - if (rawData == nullptr) { - std::cout << "Invalid data" << std::endl; - return; - } - std::shared_ptr AudioServerPtr = - std::make_shared(SYSTEM_ABILITY_ID, RUN_ON_CREATE); - AudioServerBalanceFuzzer(rawData, size, AudioServerPtr); - AudioServerMonoFuzzer(rawData, size, AudioServerPtr); - } - } // namespace AudioStandard -} // namesapce OHOS - -/* Fuzzer entry point */ -extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) -{ - /* Run your code on data */ - OHOS::AudioStandard::AudioServerBalanceFuzzTest(data, size); - return 0; -} diff --git a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp index bc4ed80768..e2b756a7c4 100644 --- a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp +++ b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp @@ -14,9 +14,9 @@ */ #include -#include "audio_server.h" #include #include +#include "audio_server.h" #include "message_parcel.h" using namespace std; @@ -46,7 +46,6 @@ void AudioServerFuzzTest(const uint8_t *rawData, size_t size) rawData = rawData + OFFSET; size = size - OFFSET; - //data build MessageParcel data; data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); data.WriteBuffer(rawData, size); diff --git a/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp b/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp index b40efde4e3..674ea1939b 100644 --- a/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp +++ b/test/fuzztest/audiostreamcollector_fuzzer/audio_stream_collector_fuzzer.cpp @@ -16,9 +16,9 @@ #include #include #include -#include "message_parcel.h" #include "audio_info.h" #include "audio_stream_collector.h" +#include "message_parcel.h" using namespace std; namespace OHOS { @@ -32,7 +32,6 @@ void AudioStreamCollectorFuzzTest(const uint8_t *rawData, size_t size) return; } - //data build MessageParcel data; data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN); data.WriteBuffer(rawData, size); -- Gitee From e8bbd091b18a1377f31634f9c84902726a559241 Mon Sep 17 00:00:00 2001 From: yangliping Date: Thu, 3 Nov 2022 15:05:10 +0800 Subject: [PATCH 4/6] fuzz test case delete explain Signed-off-by: yangliping --- test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp | 1 - test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp | 1 - .../audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp | 2 -- 3 files changed, 4 deletions(-) diff --git a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp index 710ad66af5..3aade0a742 100644 --- a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp +++ b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp @@ -33,7 +33,6 @@ uint32_t Convert2Uint32(const uint8_t *ptr) if (ptr == nullptr) { return 0; } - // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); } diff --git a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp index e2b756a7c4..8c965d1755 100644 --- a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp +++ b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp @@ -33,7 +33,6 @@ uint32_t Convert2Uint32(const uint8_t *ptr) if (ptr == nullptr) { return 0; } - // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); } diff --git a/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp b/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp index ea971fda8b..96bed59a4e 100644 --- a/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp +++ b/test/fuzztest/audioserverbalance_fuzzer/audio_server_balance_fuzzer.cpp @@ -29,7 +29,6 @@ const int32_t LIMITSIZE = 4; float Convert2Float(const uint8_t *ptr) { - // 根据ptr的大小随机生成区间[-1, +1]内的float值 float floatValue = static_cast(*ptr); return floatValue / 128.0f - 1.0f; } @@ -46,7 +45,6 @@ void AudioServerBalanceFuzzer(const uint8_t *rawData, size_t size, std::shared_p bool Convert2Bool(const uint8_t *ptr) { - // 根据ptr的值随机生成bool值 return (ptr[0] & 1) ? true : false; } -- Gitee From 88d1f918c7822c99f7d1d6188cab78994b8717fa Mon Sep 17 00:00:00 2001 From: yangliping Date: Thu, 3 Nov 2022 16:07:15 +0800 Subject: [PATCH 5/6] fuzz test case update and add Signed-off-by: yangliping --- test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp | 2 ++ test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp | 2 ++ 2 files changed, 4 insertions(+) diff --git a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp index 3aade0a742..efe63cb930 100644 --- a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp +++ b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp @@ -33,6 +33,8 @@ uint32_t Convert2Uint32(const uint8_t *ptr) if (ptr == nullptr) { return 0; } + /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits, + the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */ return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); } diff --git a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp index 8c965d1755..5943657389 100644 --- a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp +++ b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp @@ -33,6 +33,8 @@ uint32_t Convert2Uint32(const uint8_t *ptr) if (ptr == nullptr) { return 0; } + /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits, + the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */ return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); } -- Gitee From cf44e9598756d434164992ba7948421d4483439d Mon Sep 17 00:00:00 2001 From: yangliping Date: Thu, 3 Nov 2022 17:59:19 +0800 Subject: [PATCH 6/6] fuzz test case add and update Signed-off-by: yangliping --- test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp | 5 ++++- test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp index efe63cb930..3f3810cfc3 100644 --- a/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp +++ b/test/fuzztest/audiopolicy_fuzzer/audio_policy_fuzzer.cpp @@ -27,6 +27,9 @@ const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy"; const int32_t SYSTEM_ABILITY_ID = 3009; const bool RUN_ON_CREATE = false; const int32_t LIMITSIZE = 4; +const int32_t SHIFT_LEFT_8 = 8; +const int32_t SHIFT_LEFT_16 = 16; +const int32_t SHIFT_LEFT_24 = 24; uint32_t Convert2Uint32(const uint8_t *ptr) { @@ -35,7 +38,7 @@ uint32_t Convert2Uint32(const uint8_t *ptr) } /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits, the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */ - return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); + return (ptr[0] << SHIFT_LEFT_24) | (ptr[1] << SHIFT_LEFT_16) | (ptr[2] << SHIFT_LEFT_8) | (ptr[3]); } void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size) diff --git a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp index 5943657389..79936c2c07 100644 --- a/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp +++ b/test/fuzztest/audioserver_fuzzer/audio_server_fuzzer.cpp @@ -27,6 +27,9 @@ const std::u16string FORMMGR_INTERFACE_TOKEN = u"IStandardAudioService"; const int32_t SYSTEM_ABILITY_ID = 3001; const bool RUN_ON_CREATE = false; const int32_t LIMITSIZE = 4; +const int32_t SHIFT_LEFT_8 = 8; +const int32_t SHIFT_LEFT_16 = 16; +const int32_t SHIFT_LEFT_24 = 24; uint32_t Convert2Uint32(const uint8_t *ptr) { @@ -35,7 +38,7 @@ uint32_t Convert2Uint32(const uint8_t *ptr) } /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits, the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */ - return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); + return (ptr[0] << SHIFT_LEFT_24) | (ptr[1] << SHIFT_LEFT_16) | (ptr[2] << SHIFT_LEFT_8) | (ptr[3]); } void AudioServerFuzzTest(const uint8_t *rawData, size_t size) -- Gitee