1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 */
17
18 /**
19 * NOTE
20 * 1) The input to AudioFlinger binder calls are fuzzed in this fuzzer
21 * 2) AudioFlinger crashes due to the fuzzer are detected by the
22 Binder DeathRecipient, where the fuzzer aborts if AudioFlinger dies
23 */
24
25 #include <android_audio_policy_configuration_V7_0-enums.h>
26 #include <android/content/AttributionSourceState.h>
27 #include <binder/IServiceManager.h>
28 #include <binder/MemoryDealer.h>
29 #include <media/AidlConversion.h>
30 #include <media/AudioEffect.h>
31 #include <media/AudioRecord.h>
32 #include <media/AudioSystem.h>
33 #include <media/AudioTrack.h>
34 #include <media/IAudioFlinger.h>
35 #include "fuzzer/FuzzedDataProvider.h"
36
37 #define MAX_STRING_LENGTH 256
38 #define MAX_ARRAY_LENGTH 256
39
40 constexpr int32_t kMinSampleRateHz = 4000;
41 constexpr int32_t kMaxSampleRateHz = 192000;
42 constexpr int32_t kSampleRateUnspecified = 0;
43
44 using namespace std;
45 using namespace android;
46
47 namespace xsd {
48 using namespace ::android::audio::policy::configuration::V7_0;
49 }
50
51 using android::content::AttributionSourceState;
52
53 constexpr audio_unique_id_use_t kUniqueIds[] = {
54 AUDIO_UNIQUE_ID_USE_UNSPECIFIED, AUDIO_UNIQUE_ID_USE_SESSION, AUDIO_UNIQUE_ID_USE_MODULE,
55 AUDIO_UNIQUE_ID_USE_EFFECT, AUDIO_UNIQUE_ID_USE_PATCH, AUDIO_UNIQUE_ID_USE_OUTPUT,
56 AUDIO_UNIQUE_ID_USE_INPUT, AUDIO_UNIQUE_ID_USE_CLIENT, AUDIO_UNIQUE_ID_USE_MAX,
57 };
58
59 constexpr audio_mode_t kModes[] = {
60 AUDIO_MODE_INVALID, AUDIO_MODE_CURRENT, AUDIO_MODE_NORMAL, AUDIO_MODE_RINGTONE,
61 AUDIO_MODE_IN_CALL, AUDIO_MODE_IN_COMMUNICATION, AUDIO_MODE_CALL_SCREEN};
62
63 constexpr audio_session_t kSessionId[] = {AUDIO_SESSION_NONE, AUDIO_SESSION_OUTPUT_STAGE,
64 AUDIO_SESSION_DEVICE};
65
66 constexpr audio_encapsulation_mode_t kEncapsulation[] = {
67 AUDIO_ENCAPSULATION_MODE_NONE,
68 AUDIO_ENCAPSULATION_MODE_ELEMENTARY_STREAM,
69 AUDIO_ENCAPSULATION_MODE_HANDLE,
70 };
71
72 constexpr audio_port_role_t kPortRoles[] = {
73 AUDIO_PORT_ROLE_NONE,
74 AUDIO_PORT_ROLE_SOURCE,
75 AUDIO_PORT_ROLE_SINK,
76 };
77
78 constexpr audio_port_type_t kPortTypes[] = {
79 AUDIO_PORT_TYPE_NONE,
80 AUDIO_PORT_TYPE_DEVICE,
81 AUDIO_PORT_TYPE_MIX,
82 AUDIO_PORT_TYPE_SESSION,
83 };
84
85 template <typename T, typename X, typename FUNC>
getFlags(const xsdc_enum_range<X> & range,const FUNC & func,const std::string & findString={})86 std::vector<T> getFlags(const xsdc_enum_range<X> &range, const FUNC &func,
87 const std::string &findString = {}) {
88 std::vector<T> vec;
89 for (const auto &xsdEnumVal : range) {
90 T enumVal;
91 std::string enumString = toString(xsdEnumVal);
92 if (enumString.find(findString) != std::string::npos &&
93 func(enumString.c_str(), &enumVal)) {
94 vec.push_back(enumVal);
95 }
96 }
97 return vec;
98 }
99
100 static const std::vector<audio_stream_type_t> kStreamtypes =
101 getFlags<audio_stream_type_t, xsd::AudioStreamType, decltype(audio_stream_type_from_string)>(
102 xsdc_enum_range<xsd::AudioStreamType>{}, audio_stream_type_from_string);
103
104 static const std::vector<audio_format_t> kFormats =
105 getFlags<audio_format_t, xsd::AudioFormat, decltype(audio_format_from_string)>(
106 xsdc_enum_range<xsd::AudioFormat>{}, audio_format_from_string);
107
108 static const std::vector<audio_channel_mask_t> kChannelMasks =
109 getFlags<audio_channel_mask_t, xsd::AudioChannelMask, decltype(audio_channel_mask_from_string)>(
110 xsdc_enum_range<xsd::AudioChannelMask>{}, audio_channel_mask_from_string);
111
112 static const std::vector<audio_usage_t> kUsages =
113 getFlags<audio_usage_t, xsd::AudioUsage, decltype(audio_usage_from_string)>(
114 xsdc_enum_range<xsd::AudioUsage>{}, audio_usage_from_string);
115
116 static const std::vector<audio_content_type_t> kContentType =
117 getFlags<audio_content_type_t, xsd::AudioContentType, decltype(audio_content_type_from_string)>(
118 xsdc_enum_range<xsd::AudioContentType>{}, audio_content_type_from_string);
119
120 static const std::vector<audio_source_t> kInputSources =
121 getFlags<audio_source_t, xsd::AudioSource, decltype(audio_source_from_string)>(
122 xsdc_enum_range<xsd::AudioSource>{}, audio_source_from_string);
123
124 static const std::vector<audio_gain_mode_t> kGainModes =
125 getFlags<audio_gain_mode_t, xsd::AudioGainMode, decltype(audio_gain_mode_from_string)>(
126 xsdc_enum_range<xsd::AudioGainMode>{}, audio_gain_mode_from_string);
127
128 static const std::vector<audio_devices_t> kDevices =
129 getFlags<audio_devices_t, xsd::AudioDevice, decltype(audio_device_from_string)>(
130 xsdc_enum_range<xsd::AudioDevice>{}, audio_device_from_string);
131
132 static const std::vector<audio_input_flags_t> kInputFlags =
133 getFlags<audio_input_flags_t, xsd::AudioInOutFlag, decltype(audio_input_flag_from_string)>(
134 xsdc_enum_range<xsd::AudioInOutFlag>{}, audio_input_flag_from_string, "_INPUT_");
135
136 static const std::vector<audio_output_flags_t> kOutputFlags =
137 getFlags<audio_output_flags_t, xsd::AudioInOutFlag, decltype(audio_output_flag_from_string)>(
138 xsdc_enum_range<xsd::AudioInOutFlag>{}, audio_output_flag_from_string, "_OUTPUT_");
139
140 template <typename T, size_t size>
getValue(FuzzedDataProvider * fdp,const T (& arr)[size])141 T getValue(FuzzedDataProvider *fdp, const T (&arr)[size]) {
142 return arr[fdp->ConsumeIntegralInRange<int32_t>(0, size - 1)];
143 }
144
145 template <typename T>
getValue(FuzzedDataProvider * fdp,std::vector<T> vec)146 T getValue(FuzzedDataProvider *fdp, std::vector<T> vec) {
147 return vec[fdp->ConsumeIntegralInRange<int32_t>(0, vec.size() - 1)];
148 }
149
getSampleRate(FuzzedDataProvider * fdp)150 int32_t getSampleRate(FuzzedDataProvider *fdp) {
151 if (fdp->ConsumeBool()) {
152 return fdp->ConsumeIntegralInRange<int32_t>(kMinSampleRateHz, kMaxSampleRateHz);
153 }
154 return kSampleRateUnspecified;
155 }
156
157 class DeathNotifier : public IBinder::DeathRecipient {
158 public:
binderDied(const wp<IBinder> &)159 void binderDied(const wp<IBinder> &) { abort(); }
160 };
161
162 class AudioFlingerFuzzer {
163 public:
164 AudioFlingerFuzzer(const uint8_t *data, size_t size);
165 void process();
166
167 private:
168 FuzzedDataProvider mFdp;
169 void invokeAudioTrack();
170 void invokeAudioRecord();
171 status_t invokeAudioEffect();
172 void invokeAudioSystem();
173 status_t invokeAudioInputDevice();
174 status_t invokeAudioOutputDevice();
175 void invokeAudioPatch();
176
177 sp<DeathNotifier> mDeathNotifier;
178 };
179
AudioFlingerFuzzer(const uint8_t * data,size_t size)180 AudioFlingerFuzzer::AudioFlingerFuzzer(const uint8_t *data, size_t size) : mFdp(data, size) {
181 sp<IServiceManager> sm = defaultServiceManager();
182 sp<IBinder> binder = sm->getService(String16("media.audio_flinger"));
183 if (binder == nullptr) {
184 return;
185 }
186 mDeathNotifier = new DeathNotifier();
187 binder->linkToDeath(mDeathNotifier);
188 }
189
invokeAudioTrack()190 void AudioFlingerFuzzer::invokeAudioTrack() {
191 uint32_t sampleRate = getSampleRate(&mFdp);
192 audio_format_t format = getValue(&mFdp, kFormats);
193 audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
194 size_t frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
195 int32_t notificationFrames = mFdp.ConsumeIntegral<int32_t>();
196 uint32_t useSharedBuffer = mFdp.ConsumeBool();
197 audio_output_flags_t flags = getValue(&mFdp, kOutputFlags);
198 audio_session_t sessionId = getValue(&mFdp, kSessionId);
199 audio_usage_t usage = getValue(&mFdp, kUsages);
200 audio_content_type_t contentType = getValue(&mFdp, kContentType);
201 audio_attributes_t attributes = {};
202 sp<IMemory> sharedBuffer;
203 sp<MemoryDealer> heap = nullptr;
204 audio_offload_info_t offloadInfo = AUDIO_INFO_INITIALIZER;
205
206 bool offload = false;
207 bool fast = ((flags & AUDIO_OUTPUT_FLAG_FAST) != 0);
208
209 if (useSharedBuffer != 0) {
210 size_t heapSize = audio_channel_count_from_out_mask(channelMask) *
211 audio_bytes_per_sample(format) * frameCount;
212 heap = new MemoryDealer(heapSize, "AudioTrack Heap Base");
213 sharedBuffer = heap->allocate(heapSize);
214 frameCount = 0;
215 notificationFrames = 0;
216 }
217 if ((flags & AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD) != 0) {
218 offloadInfo.sample_rate = sampleRate;
219 offloadInfo.channel_mask = channelMask;
220 offloadInfo.format = format;
221 offload = true;
222 }
223
224 attributes.content_type = contentType;
225 attributes.usage = usage;
226 sp<AudioTrack> track = new AudioTrack();
227
228 // TODO b/182392769: use attribution source util
229 AttributionSourceState attributionSource;
230 attributionSource.uid = VALUE_OR_FATAL(legacy2aidl_uid_t_int32_t(getuid()));
231 attributionSource.pid = VALUE_OR_FATAL(legacy2aidl_pid_t_int32_t(getpid()));
232 attributionSource.token = sp<BBinder>::make();
233 track->set(AUDIO_STREAM_DEFAULT, sampleRate, format, channelMask, frameCount, flags, nullptr,
234 nullptr, notificationFrames, sharedBuffer, false, sessionId,
235 ((fast && sharedBuffer == 0) || offload) ? AudioTrack::TRANSFER_CALLBACK
236 : AudioTrack::TRANSFER_DEFAULT,
237 offload ? &offloadInfo : nullptr, attributionSource, &attributes, false, 1.0f,
238 AUDIO_PORT_HANDLE_NONE);
239
240 status_t status = track->initCheck();
241 if (status != NO_ERROR) {
242 track.clear();
243 return;
244 }
245 track->getSampleRate();
246 track->latency();
247 track->getUnderrunCount();
248 track->streamType();
249 track->channelCount();
250 track->getNotificationPeriodInFrames();
251 uint32_t bufferSizeInFrames = mFdp.ConsumeIntegral<uint32_t>();
252 track->setBufferSizeInFrames(bufferSizeInFrames);
253 track->getBufferSizeInFrames();
254
255 int64_t duration = mFdp.ConsumeIntegral<int64_t>();
256 track->getBufferDurationInUs(&duration);
257 sp<IMemory> sharedBuffer2 = track->sharedBuffer();
258 track->setCallerName(mFdp.ConsumeRandomLengthString(MAX_STRING_LENGTH));
259
260 track->setVolume(mFdp.ConsumeFloatingPoint<float>(), mFdp.ConsumeFloatingPoint<float>());
261 track->setVolume(mFdp.ConsumeFloatingPoint<float>());
262 track->setAuxEffectSendLevel(mFdp.ConsumeFloatingPoint<float>());
263
264 float auxEffectSendLevel;
265 track->getAuxEffectSendLevel(&auxEffectSendLevel);
266 track->setSampleRate(getSampleRate(&mFdp));
267 track->getSampleRate();
268 track->getOriginalSampleRate();
269
270 AudioPlaybackRate playbackRate = {};
271 playbackRate.mSpeed = mFdp.ConsumeFloatingPoint<float>();
272 playbackRate.mPitch = mFdp.ConsumeFloatingPoint<float>();
273 track->setPlaybackRate(playbackRate);
274 track->getPlaybackRate();
275 track->setLoop(mFdp.ConsumeIntegral<uint32_t>(), mFdp.ConsumeIntegral<uint32_t>(),
276 mFdp.ConsumeIntegral<uint32_t>());
277 track->setMarkerPosition(mFdp.ConsumeIntegral<uint32_t>());
278
279 uint32_t marker = {};
280 track->getMarkerPosition(&marker);
281 track->setPositionUpdatePeriod(mFdp.ConsumeIntegral<uint32_t>());
282
283 uint32_t updatePeriod = {};
284 track->getPositionUpdatePeriod(&updatePeriod);
285 track->setPosition(mFdp.ConsumeIntegral<uint32_t>());
286 uint32_t position = {};
287 track->getPosition(&position);
288 track->getBufferPosition(&position);
289 track->reload();
290 track->start();
291 track->pause();
292 track->flush();
293 track->stop();
294 track->stopped();
295 }
296
invokeAudioRecord()297 void AudioFlingerFuzzer::invokeAudioRecord() {
298 int32_t notificationFrames = mFdp.ConsumeIntegral<int32_t>();
299 uint32_t sampleRate = getSampleRate(&mFdp);
300 size_t frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
301 audio_format_t format = getValue(&mFdp, kFormats);
302 audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
303 audio_input_flags_t flags = getValue(&mFdp, kInputFlags);
304 audio_session_t sessionId = getValue(&mFdp, kSessionId);
305 audio_source_t inputSource = getValue(&mFdp, kInputSources);
306
307 audio_attributes_t attributes = {};
308 bool fast = ((flags & AUDIO_OUTPUT_FLAG_FAST) != 0);
309
310 attributes.source = inputSource;
311
312 // TODO b/182392769: use attribution source util
313 AttributionSourceState attributionSource;
314 attributionSource.packageName = std::string(mFdp.ConsumeRandomLengthString().c_str());
315 attributionSource.token = sp<BBinder>::make();
316 sp<AudioRecord> record = new AudioRecord(attributionSource);
317 record->set(AUDIO_SOURCE_DEFAULT, sampleRate, format, channelMask, frameCount, nullptr, nullptr,
318 notificationFrames, false, sessionId,
319 fast ? AudioRecord::TRANSFER_CALLBACK : AudioRecord::TRANSFER_DEFAULT, flags,
320 getuid(), getpid(), &attributes, AUDIO_PORT_HANDLE_NONE);
321 status_t status = record->initCheck();
322 if (status != NO_ERROR) {
323 return;
324 }
325 record->latency();
326 record->format();
327 record->channelCount();
328 record->frameCount();
329 record->frameSize();
330 record->inputSource();
331 record->getNotificationPeriodInFrames();
332 record->start();
333 record->stop();
334 record->stopped();
335
336 uint32_t marker = mFdp.ConsumeIntegral<uint32_t>();
337 record->setMarkerPosition(marker);
338 record->getMarkerPosition(&marker);
339
340 uint32_t updatePeriod = mFdp.ConsumeIntegral<uint32_t>();
341 record->setPositionUpdatePeriod(updatePeriod);
342 record->getPositionUpdatePeriod(&updatePeriod);
343
344 uint32_t position;
345 record->getPosition(&position);
346
347 ExtendedTimestamp timestamp;
348 record->getTimestamp(×tamp);
349 record->getSessionId();
350 record->getCallerName();
351 android::AudioRecord::Buffer audioBuffer;
352 int32_t waitCount = mFdp.ConsumeIntegral<int32_t>();
353 size_t nonContig = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
354 audioBuffer.frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
355 record->obtainBuffer(&audioBuffer, waitCount, &nonContig);
356 bool blocking = false;
357 record->read(audioBuffer.raw, audioBuffer.size, blocking);
358 record->getInputFramesLost();
359 record->getFlags();
360
361 std::vector<media::MicrophoneInfo> activeMicrophones;
362 record->getActiveMicrophones(&activeMicrophones);
363 record->releaseBuffer(&audioBuffer);
364
365 audio_port_handle_t deviceId =
366 static_cast<audio_port_handle_t>(mFdp.ConsumeIntegral<int32_t>());
367 record->setInputDevice(deviceId);
368 record->getInputDevice();
369 record->getRoutedDeviceId();
370 record->getPortId();
371 }
372
373 struct EffectClient : public android::media::BnEffectClient {
EffectClientEffectClient374 EffectClient() {}
controlStatusChangedEffectClient375 binder::Status controlStatusChanged(bool controlGranted __unused) override {
376 return binder::Status::ok();
377 }
enableStatusChangedEffectClient378 binder::Status enableStatusChanged(bool enabled __unused) override {
379 return binder::Status::ok();
380 }
commandExecutedEffectClient381 binder::Status commandExecuted(int32_t cmdCode __unused,
382 const std::vector<uint8_t> &cmdData __unused,
383 const std::vector<uint8_t> &replyData __unused) override {
384 return binder::Status::ok();
385 }
framesProcessedEffectClient386 binder::Status framesProcessed(int32_t frames __unused) override {
387 return binder::Status::ok();
388 }
389 };
390
invokeAudioEffect()391 status_t AudioFlingerFuzzer::invokeAudioEffect() {
392 effect_uuid_t type;
393 type.timeLow = mFdp.ConsumeIntegral<uint32_t>();
394 type.timeMid = mFdp.ConsumeIntegral<uint16_t>();
395 type.timeHiAndVersion = mFdp.ConsumeIntegral<uint16_t>();
396 type.clockSeq = mFdp.ConsumeIntegral<uint16_t>();
397 for (int i = 0; i < 6; ++i) {
398 type.node[i] = mFdp.ConsumeIntegral<uint8_t>();
399 }
400
401 effect_descriptor_t descriptor = {};
402 descriptor.type = type;
403 descriptor.uuid = *EFFECT_UUID_NULL;
404
405 sp<EffectClient> effectClient(new EffectClient());
406
407 const int32_t priority = mFdp.ConsumeIntegral<int32_t>();
408 audio_session_t sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
409 const audio_io_handle_t io = mFdp.ConsumeIntegral<int32_t>();
410 std::string opPackageName = static_cast<std::string>(mFdp.ConsumeRandomLengthString().c_str());
411 AudioDeviceTypeAddr device;
412
413 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
414 if (!af) {
415 return NO_ERROR;
416 }
417
418 media::CreateEffectRequest request{};
419 request.desc =
420 VALUE_OR_RETURN_STATUS(legacy2aidl_effect_descriptor_t_EffectDescriptor(descriptor));
421 request.client = effectClient;
422 request.priority = priority;
423 request.output = io;
424 request.sessionId = sessionId;
425 request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_AudioDeviceTypeAddress(device));
426 // TODO b/182392769: use attribution source util
427 request.attributionSource.packageName = opPackageName;
428 request.attributionSource.pid = VALUE_OR_RETURN_STATUS(legacy2aidl_pid_t_int32_t(getpid()));
429 request.probe = false;
430 request.notifyFramesProcessed = false;
431
432 media::CreateEffectResponse response{};
433 status_t status = af->createEffect(request, &response);
434
435 if (status != OK) {
436 return NO_ERROR;
437 }
438
439 descriptor =
440 VALUE_OR_RETURN_STATUS(aidl2legacy_EffectDescriptor_effect_descriptor_t(response.desc));
441
442 uint32_t numEffects;
443 af->queryNumberEffects(&numEffects);
444
445 uint32_t queryIndex = mFdp.ConsumeIntegral<uint32_t>();
446 af->queryEffect(queryIndex, &descriptor);
447
448 effect_descriptor_t getDescriptor;
449 uint32_t preferredTypeFlag = mFdp.ConsumeIntegral<int32_t>();
450 af->getEffectDescriptor(&descriptor.uuid, &descriptor.type, preferredTypeFlag, &getDescriptor);
451
452 sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
453 audio_io_handle_t srcOutput = mFdp.ConsumeIntegral<int32_t>();
454 audio_io_handle_t dstOutput = mFdp.ConsumeIntegral<int32_t>();
455 af->moveEffects(sessionId, srcOutput, dstOutput);
456
457 int effectId = mFdp.ConsumeIntegral<int32_t>();
458 sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
459 af->setEffectSuspended(effectId, sessionId, mFdp.ConsumeBool());
460 return NO_ERROR;
461 }
462
invokeAudioSystem()463 void AudioFlingerFuzzer::invokeAudioSystem() {
464 AudioSystem::muteMicrophone(mFdp.ConsumeBool());
465 AudioSystem::setMasterMute(mFdp.ConsumeBool());
466 AudioSystem::setMasterVolume(mFdp.ConsumeFloatingPoint<float>());
467 AudioSystem::setMasterBalance(mFdp.ConsumeFloatingPoint<float>());
468 AudioSystem::setVoiceVolume(mFdp.ConsumeFloatingPoint<float>());
469
470 float volume;
471 AudioSystem::getMasterVolume(&volume);
472
473 bool state;
474 AudioSystem::getMasterMute(&state);
475 AudioSystem::isMicrophoneMuted(&state);
476
477 audio_stream_type_t stream = getValue(&mFdp, kStreamtypes);
478 AudioSystem::setStreamMute(getValue(&mFdp, kStreamtypes), mFdp.ConsumeBool());
479
480 stream = getValue(&mFdp, kStreamtypes);
481 AudioSystem::setStreamVolume(stream, mFdp.ConsumeFloatingPoint<float>(),
482 mFdp.ConsumeIntegral<int32_t>());
483
484 audio_mode_t mode = getValue(&mFdp, kModes);
485 AudioSystem::setMode(mode);
486
487 size_t frameCount;
488 stream = getValue(&mFdp, kStreamtypes);
489 AudioSystem::getOutputFrameCount(&frameCount, stream);
490
491 uint32_t latency;
492 stream = getValue(&mFdp, kStreamtypes);
493 AudioSystem::getOutputLatency(&latency, stream);
494
495 stream = getValue(&mFdp, kStreamtypes);
496 AudioSystem::getStreamVolume(stream, &volume, mFdp.ConsumeIntegral<int32_t>());
497
498 stream = getValue(&mFdp, kStreamtypes);
499 AudioSystem::getStreamMute(stream, &state);
500
501 uint32_t samplingRate;
502 AudioSystem::getSamplingRate(mFdp.ConsumeIntegral<int32_t>(), &samplingRate);
503
504 AudioSystem::getFrameCount(mFdp.ConsumeIntegral<int32_t>(), &frameCount);
505 AudioSystem::getLatency(mFdp.ConsumeIntegral<int32_t>(), &latency);
506 AudioSystem::setVoiceVolume(mFdp.ConsumeFloatingPoint<float>());
507
508 uint32_t halFrames;
509 uint32_t dspFrames;
510 AudioSystem::getRenderPosition(mFdp.ConsumeIntegral<int32_t>(), &halFrames, &dspFrames);
511
512 AudioSystem::getInputFramesLost(mFdp.ConsumeIntegral<int32_t>());
513 AudioSystem::getInputFramesLost(mFdp.ConsumeIntegral<int32_t>());
514
515 audio_unique_id_use_t uniqueIdUse = getValue(&mFdp, kUniqueIds);
516 AudioSystem::newAudioUniqueId(uniqueIdUse);
517
518 audio_session_t sessionId = getValue(&mFdp, kSessionId);
519 pid_t pid = mFdp.ConsumeBool() ? getpid() : mFdp.ConsumeIntegral<int32_t>();
520 uid_t uid = mFdp.ConsumeBool() ? getuid() : mFdp.ConsumeIntegral<int32_t>();
521 AudioSystem::acquireAudioSessionId(sessionId, pid, uid);
522
523 pid = mFdp.ConsumeBool() ? getpid() : mFdp.ConsumeIntegral<int32_t>();
524 sessionId = getValue(&mFdp, kSessionId);
525 AudioSystem::releaseAudioSessionId(sessionId, pid);
526
527 sessionId = getValue(&mFdp, kSessionId);
528 AudioSystem::getAudioHwSyncForSession(sessionId);
529
530 AudioSystem::systemReady();
531 AudioSystem::getFrameCountHAL(mFdp.ConsumeIntegral<int32_t>(), &frameCount);
532
533 size_t buffSize;
534 uint32_t sampleRate = getSampleRate(&mFdp);
535 audio_format_t format = getValue(&mFdp, kFormats);
536 audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
537 AudioSystem::getInputBufferSize(sampleRate, format, channelMask, &buffSize);
538
539 AudioSystem::getPrimaryOutputSamplingRate();
540 AudioSystem::getPrimaryOutputFrameCount();
541 AudioSystem::setLowRamDevice(mFdp.ConsumeBool(), mFdp.ConsumeIntegral<int64_t>());
542
543 std::vector<media::MicrophoneInfo> microphones;
544 AudioSystem::getMicrophones(µphones);
545
546 std::vector<pid_t> pids;
547 pids.insert(pids.begin(), getpid());
548 for (int i = 1; i < mFdp.ConsumeIntegralInRange<int32_t>(2, MAX_ARRAY_LENGTH); ++i) {
549 pids.insert(pids.begin() + i, static_cast<pid_t>(mFdp.ConsumeIntegral<int32_t>()));
550 }
551 AudioSystem::setAudioHalPids(pids);
552 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
553 if (!af) {
554 return;
555 }
556 af->setRecordSilenced(mFdp.ConsumeIntegral<uint32_t>(), mFdp.ConsumeBool());
557
558 float balance = mFdp.ConsumeFloatingPoint<float>();
559 af->getMasterBalance(&balance);
560 af->invalidateStream(static_cast<audio_stream_type_t>(mFdp.ConsumeIntegral<uint32_t>()));
561 }
562
invokeAudioInputDevice()563 status_t AudioFlingerFuzzer::invokeAudioInputDevice() {
564 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
565 if (!af) {
566 return NO_ERROR;
567 }
568
569 audio_config_t config = {};
570 audio_module_handle_t module = mFdp.ConsumeIntegral<int32_t>();
571 audio_io_handle_t input = mFdp.ConsumeIntegral<int32_t>();
572 config.frame_count = mFdp.ConsumeIntegral<uint32_t>();
573 String8 address = static_cast<String8>(mFdp.ConsumeRandomLengthString().c_str());
574
575 config.channel_mask = getValue(&mFdp, kChannelMasks);
576 config.format = getValue(&mFdp, kFormats);
577
578 config.offload_info = AUDIO_INFO_INITIALIZER;
579 config.offload_info.bit_rate = mFdp.ConsumeIntegral<uint32_t>();
580 config.offload_info.bit_width = mFdp.ConsumeIntegral<uint32_t>();
581 config.offload_info.content_id = mFdp.ConsumeIntegral<uint32_t>();
582 config.offload_info.channel_mask = getValue(&mFdp, kChannelMasks);
583 config.offload_info.duration_us = mFdp.ConsumeIntegral<int64_t>();
584 config.offload_info.encapsulation_mode = getValue(&mFdp, kEncapsulation);
585 config.offload_info.format = getValue(&mFdp, kFormats);
586 config.offload_info.has_video = mFdp.ConsumeBool();
587 config.offload_info.is_streaming = mFdp.ConsumeBool();
588 config.offload_info.sample_rate = getSampleRate(&mFdp);
589 config.offload_info.sync_id = mFdp.ConsumeIntegral<uint32_t>();
590 config.offload_info.stream_type = getValue(&mFdp, kStreamtypes);
591 config.offload_info.usage = getValue(&mFdp, kUsages);
592
593 config.sample_rate = getSampleRate(&mFdp);
594
595 audio_devices_t device = getValue(&mFdp, kDevices);
596 audio_source_t source = getValue(&mFdp, kInputSources);
597 audio_input_flags_t flags = getValue(&mFdp, kInputFlags);
598
599 AudioDeviceTypeAddr deviceTypeAddr(device, address.c_str());
600
601 media::OpenInputRequest request{};
602 request.module = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_module_handle_t_int32_t(module));
603 request.input = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_io_handle_t_int32_t(input));
604 request.config = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_config_t_AudioConfig(config));
605 request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_AudioDeviceTypeAddress(deviceTypeAddr));
606 request.source = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_source_t_AudioSourceType(source));
607 request.flags = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_input_flags_t_int32_t_mask(flags));
608
609 media::OpenInputResponse response{};
610 status_t status = af->openInput(request, &response);
611 if (status != NO_ERROR) {
612 return NO_ERROR;
613 }
614
615 input = VALUE_OR_RETURN_STATUS(aidl2legacy_int32_t_audio_module_handle_t(response.input));
616 af->closeInput(input);
617 return NO_ERROR;
618 }
619
invokeAudioOutputDevice()620 status_t AudioFlingerFuzzer::invokeAudioOutputDevice() {
621 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
622 if (!af) {
623 return NO_ERROR;
624 }
625
626 audio_config_t config = {};
627 audio_module_handle_t module = mFdp.ConsumeIntegral<int32_t>();
628 audio_io_handle_t output = mFdp.ConsumeIntegral<int32_t>();
629 config.frame_count = mFdp.ConsumeIntegral<uint32_t>();
630 String8 address = static_cast<String8>(mFdp.ConsumeRandomLengthString().c_str());
631
632 config.channel_mask = getValue(&mFdp, kChannelMasks);
633
634 config.offload_info = AUDIO_INFO_INITIALIZER;
635 config.offload_info.bit_rate = mFdp.ConsumeIntegral<uint32_t>();
636 config.offload_info.bit_width = mFdp.ConsumeIntegral<uint32_t>();
637 config.offload_info.channel_mask = getValue(&mFdp, kChannelMasks);
638 config.offload_info.content_id = mFdp.ConsumeIntegral<uint32_t>();
639 config.offload_info.duration_us = mFdp.ConsumeIntegral<int64_t>();
640 config.offload_info.encapsulation_mode = getValue(&mFdp, kEncapsulation);
641 config.offload_info.format = getValue(&mFdp, kFormats);
642 config.offload_info.has_video = mFdp.ConsumeBool();
643 config.offload_info.is_streaming = mFdp.ConsumeBool();
644 config.offload_info.sample_rate = getSampleRate(&mFdp);
645 config.offload_info.stream_type = getValue(&mFdp, kStreamtypes);
646 config.offload_info.sync_id = mFdp.ConsumeIntegral<uint32_t>();
647 config.offload_info.usage = getValue(&mFdp, kUsages);
648
649 config.format = getValue(&mFdp, kFormats);
650 config.sample_rate = getSampleRate(&mFdp);
651
652 sp<DeviceDescriptorBase> device = new DeviceDescriptorBase(getValue(&mFdp, kDevices));
653 audio_output_flags_t flags = getValue(&mFdp, kOutputFlags);
654
655 audio_config_base_t mixerConfig = AUDIO_CONFIG_BASE_INITIALIZER;
656
657 media::OpenOutputRequest request{};
658 media::OpenOutputResponse response{};
659
660 request.module = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_module_handle_t_int32_t(module));
661 request.halConfig = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_config_t_AudioConfig(config));
662 request.mixerConfig =
663 VALUE_OR_RETURN_STATUS(legacy2aidl_audio_config_base_t_AudioConfigBase(mixerConfig));
664 request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_DeviceDescriptorBase(device));
665 request.flags = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_output_flags_t_int32_t_mask(flags));
666
667 status_t status = af->openOutput(request, &response);
668 if (status != NO_ERROR) {
669 return NO_ERROR;
670 }
671 output = VALUE_OR_RETURN_STATUS(aidl2legacy_int32_t_audio_io_handle_t(response.output));
672
673 audio_io_handle_t output1 = mFdp.ConsumeIntegral<int32_t>();
674 af->openDuplicateOutput(output, output1);
675 af->suspendOutput(output);
676 af->restoreOutput(output);
677 af->closeOutput(output);
678 return NO_ERROR;
679 }
680
invokeAudioPatch()681 void AudioFlingerFuzzer::invokeAudioPatch() {
682 sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
683 if (!af) {
684 return;
685 }
686 struct audio_patch patch = {};
687 audio_patch_handle_t handle = mFdp.ConsumeIntegral<int32_t>();
688
689 patch.id = mFdp.ConsumeIntegral<int32_t>();
690 patch.num_sources = mFdp.ConsumeIntegral<uint32_t>();
691 patch.num_sinks = mFdp.ConsumeIntegral<uint32_t>();
692
693 for (int i = 0; i < AUDIO_PATCH_PORTS_MAX; ++i) {
694 patch.sources[i].config_mask = mFdp.ConsumeIntegral<uint32_t>();
695 patch.sources[i].channel_mask = getValue(&mFdp, kChannelMasks);
696 patch.sources[i].format = getValue(&mFdp, kFormats);
697 patch.sources[i].gain.channel_mask = getValue(&mFdp, kChannelMasks);
698 patch.sources[i].gain.index = mFdp.ConsumeIntegral<int32_t>();
699 patch.sources[i].gain.mode = getValue(&mFdp, kGainModes);
700 patch.sources[i].gain.ramp_duration_ms = mFdp.ConsumeIntegral<uint32_t>();
701 patch.sources[i].id = static_cast<audio_format_t>(mFdp.ConsumeIntegral<int32_t>());
702 patch.sources[i].role = getValue(&mFdp, kPortRoles);
703 patch.sources[i].sample_rate = getSampleRate(&mFdp);
704 patch.sources[i].type = getValue(&mFdp, kPortTypes);
705
706 patch.sinks[i].config_mask = mFdp.ConsumeIntegral<uint32_t>();
707 patch.sinks[i].channel_mask = getValue(&mFdp, kChannelMasks);
708 patch.sinks[i].format = getValue(&mFdp, kFormats);
709 patch.sinks[i].gain.channel_mask = getValue(&mFdp, kChannelMasks);
710 patch.sinks[i].gain.index = mFdp.ConsumeIntegral<int32_t>();
711 patch.sinks[i].gain.mode = getValue(&mFdp, kGainModes);
712 patch.sinks[i].gain.ramp_duration_ms = mFdp.ConsumeIntegral<uint32_t>();
713 patch.sinks[i].id = static_cast<audio_format_t>(mFdp.ConsumeIntegral<int32_t>());
714 patch.sinks[i].role = getValue(&mFdp, kPortRoles);
715 patch.sinks[i].sample_rate = getSampleRate(&mFdp);
716 patch.sinks[i].type = getValue(&mFdp, kPortTypes);
717 }
718
719 status_t status = af->createAudioPatch(&patch, &handle);
720 if (status != NO_ERROR) {
721 return;
722 }
723
724 unsigned int num_patches = mFdp.ConsumeIntegral<uint32_t>();
725 struct audio_patch patches = {};
726 af->listAudioPatches(&num_patches, &patches);
727 af->releaseAudioPatch(handle);
728 }
729
process()730 void AudioFlingerFuzzer::process() {
731 invokeAudioEffect();
732 invokeAudioInputDevice();
733 invokeAudioOutputDevice();
734 invokeAudioPatch();
735 invokeAudioRecord();
736 invokeAudioSystem();
737 invokeAudioTrack();
738 }
739
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)740 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
741 if (size < 1) {
742 return 0;
743 }
744 AudioFlingerFuzzer audioFuzzer(data, size);
745 audioFuzzer.process();
746 return 0;
747 }
748