1 /*
2  * Copyright (C) 2021 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at:
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  *
16  */
17 
18 /**
19  * NOTE
20  * 1) The input to AudioFlinger binder calls are fuzzed in this fuzzer
21  * 2) AudioFlinger crashes due to the fuzzer are detected by the
22       Binder DeathRecipient, where the fuzzer aborts if AudioFlinger dies
23  */
24 
25 #include <android_audio_policy_configuration_V7_0-enums.h>
26 #include <android/content/AttributionSourceState.h>
27 #include <binder/IServiceManager.h>
28 #include <binder/MemoryDealer.h>
29 #include <media/AidlConversion.h>
30 #include <media/AudioEffect.h>
31 #include <media/AudioRecord.h>
32 #include <media/AudioSystem.h>
33 #include <media/AudioTrack.h>
34 #include <media/IAudioFlinger.h>
35 #include "fuzzer/FuzzedDataProvider.h"
36 
37 #define MAX_STRING_LENGTH 256
38 #define MAX_ARRAY_LENGTH 256
39 
40 constexpr int32_t kMinSampleRateHz = 4000;
41 constexpr int32_t kMaxSampleRateHz = 192000;
42 constexpr int32_t kSampleRateUnspecified = 0;
43 
44 using namespace std;
45 using namespace android;
46 
47 namespace xsd {
48 using namespace ::android::audio::policy::configuration::V7_0;
49 }
50 
51 using android::content::AttributionSourceState;
52 
53 constexpr audio_unique_id_use_t kUniqueIds[] = {
54     AUDIO_UNIQUE_ID_USE_UNSPECIFIED, AUDIO_UNIQUE_ID_USE_SESSION, AUDIO_UNIQUE_ID_USE_MODULE,
55     AUDIO_UNIQUE_ID_USE_EFFECT,      AUDIO_UNIQUE_ID_USE_PATCH,   AUDIO_UNIQUE_ID_USE_OUTPUT,
56     AUDIO_UNIQUE_ID_USE_INPUT,       AUDIO_UNIQUE_ID_USE_CLIENT,  AUDIO_UNIQUE_ID_USE_MAX,
57 };
58 
59 constexpr audio_mode_t kModes[] = {
60     AUDIO_MODE_INVALID, AUDIO_MODE_CURRENT,          AUDIO_MODE_NORMAL,     AUDIO_MODE_RINGTONE,
61     AUDIO_MODE_IN_CALL, AUDIO_MODE_IN_COMMUNICATION, AUDIO_MODE_CALL_SCREEN};
62 
63 constexpr audio_session_t kSessionId[] = {AUDIO_SESSION_NONE, AUDIO_SESSION_OUTPUT_STAGE,
64                                           AUDIO_SESSION_DEVICE};
65 
66 constexpr audio_encapsulation_mode_t kEncapsulation[] = {
67     AUDIO_ENCAPSULATION_MODE_NONE,
68     AUDIO_ENCAPSULATION_MODE_ELEMENTARY_STREAM,
69     AUDIO_ENCAPSULATION_MODE_HANDLE,
70 };
71 
72 constexpr audio_port_role_t kPortRoles[] = {
73     AUDIO_PORT_ROLE_NONE,
74     AUDIO_PORT_ROLE_SOURCE,
75     AUDIO_PORT_ROLE_SINK,
76 };
77 
78 constexpr audio_port_type_t kPortTypes[] = {
79     AUDIO_PORT_TYPE_NONE,
80     AUDIO_PORT_TYPE_DEVICE,
81     AUDIO_PORT_TYPE_MIX,
82     AUDIO_PORT_TYPE_SESSION,
83 };
84 
85 template <typename T, typename X, typename FUNC>
getFlags(const xsdc_enum_range<X> & range,const FUNC & func,const std::string & findString={})86 std::vector<T> getFlags(const xsdc_enum_range<X> &range, const FUNC &func,
87                         const std::string &findString = {}) {
88     std::vector<T> vec;
89     for (const auto &xsdEnumVal : range) {
90         T enumVal;
91         std::string enumString = toString(xsdEnumVal);
92         if (enumString.find(findString) != std::string::npos &&
93             func(enumString.c_str(), &enumVal)) {
94             vec.push_back(enumVal);
95         }
96     }
97     return vec;
98 }
99 
100 static const std::vector<audio_stream_type_t> kStreamtypes =
101     getFlags<audio_stream_type_t, xsd::AudioStreamType, decltype(audio_stream_type_from_string)>(
102         xsdc_enum_range<xsd::AudioStreamType>{}, audio_stream_type_from_string);
103 
104 static const std::vector<audio_format_t> kFormats =
105     getFlags<audio_format_t, xsd::AudioFormat, decltype(audio_format_from_string)>(
106         xsdc_enum_range<xsd::AudioFormat>{}, audio_format_from_string);
107 
108 static const std::vector<audio_channel_mask_t> kChannelMasks =
109     getFlags<audio_channel_mask_t, xsd::AudioChannelMask, decltype(audio_channel_mask_from_string)>(
110         xsdc_enum_range<xsd::AudioChannelMask>{}, audio_channel_mask_from_string);
111 
112 static const std::vector<audio_usage_t> kUsages =
113     getFlags<audio_usage_t, xsd::AudioUsage, decltype(audio_usage_from_string)>(
114         xsdc_enum_range<xsd::AudioUsage>{}, audio_usage_from_string);
115 
116 static const std::vector<audio_content_type_t> kContentType =
117     getFlags<audio_content_type_t, xsd::AudioContentType, decltype(audio_content_type_from_string)>(
118         xsdc_enum_range<xsd::AudioContentType>{}, audio_content_type_from_string);
119 
120 static const std::vector<audio_source_t> kInputSources =
121     getFlags<audio_source_t, xsd::AudioSource, decltype(audio_source_from_string)>(
122         xsdc_enum_range<xsd::AudioSource>{}, audio_source_from_string);
123 
124 static const std::vector<audio_gain_mode_t> kGainModes =
125     getFlags<audio_gain_mode_t, xsd::AudioGainMode, decltype(audio_gain_mode_from_string)>(
126         xsdc_enum_range<xsd::AudioGainMode>{}, audio_gain_mode_from_string);
127 
128 static const std::vector<audio_devices_t> kDevices =
129     getFlags<audio_devices_t, xsd::AudioDevice, decltype(audio_device_from_string)>(
130         xsdc_enum_range<xsd::AudioDevice>{}, audio_device_from_string);
131 
132 static const std::vector<audio_input_flags_t> kInputFlags =
133     getFlags<audio_input_flags_t, xsd::AudioInOutFlag, decltype(audio_input_flag_from_string)>(
134         xsdc_enum_range<xsd::AudioInOutFlag>{}, audio_input_flag_from_string, "_INPUT_");
135 
136 static const std::vector<audio_output_flags_t> kOutputFlags =
137     getFlags<audio_output_flags_t, xsd::AudioInOutFlag, decltype(audio_output_flag_from_string)>(
138         xsdc_enum_range<xsd::AudioInOutFlag>{}, audio_output_flag_from_string, "_OUTPUT_");
139 
140 template <typename T, size_t size>
getValue(FuzzedDataProvider * fdp,const T (& arr)[size])141 T getValue(FuzzedDataProvider *fdp, const T (&arr)[size]) {
142     return arr[fdp->ConsumeIntegralInRange<int32_t>(0, size - 1)];
143 }
144 
145 template <typename T>
getValue(FuzzedDataProvider * fdp,std::vector<T> vec)146 T getValue(FuzzedDataProvider *fdp, std::vector<T> vec) {
147     return vec[fdp->ConsumeIntegralInRange<int32_t>(0, vec.size() - 1)];
148 }
149 
getSampleRate(FuzzedDataProvider * fdp)150 int32_t getSampleRate(FuzzedDataProvider *fdp) {
151     if (fdp->ConsumeBool()) {
152         return fdp->ConsumeIntegralInRange<int32_t>(kMinSampleRateHz, kMaxSampleRateHz);
153     }
154     return kSampleRateUnspecified;
155 }
156 
157 class DeathNotifier : public IBinder::DeathRecipient {
158    public:
binderDied(const wp<IBinder> &)159     void binderDied(const wp<IBinder> &) { abort(); }
160 };
161 
162 class AudioFlingerFuzzer {
163    public:
164     AudioFlingerFuzzer(const uint8_t *data, size_t size);
165     void process();
166 
167    private:
168     FuzzedDataProvider mFdp;
169     void invokeAudioTrack();
170     void invokeAudioRecord();
171     status_t invokeAudioEffect();
172     void invokeAudioSystem();
173     status_t invokeAudioInputDevice();
174     status_t invokeAudioOutputDevice();
175     void invokeAudioPatch();
176 
177     sp<DeathNotifier> mDeathNotifier;
178 };
179 
AudioFlingerFuzzer(const uint8_t * data,size_t size)180 AudioFlingerFuzzer::AudioFlingerFuzzer(const uint8_t *data, size_t size) : mFdp(data, size) {
181     sp<IServiceManager> sm = defaultServiceManager();
182     sp<IBinder> binder = sm->getService(String16("media.audio_flinger"));
183     if (binder == nullptr) {
184         return;
185     }
186     mDeathNotifier = new DeathNotifier();
187     binder->linkToDeath(mDeathNotifier);
188 }
189 
invokeAudioTrack()190 void AudioFlingerFuzzer::invokeAudioTrack() {
191     uint32_t sampleRate = getSampleRate(&mFdp);
192     audio_format_t format = getValue(&mFdp, kFormats);
193     audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
194     size_t frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
195     int32_t notificationFrames = mFdp.ConsumeIntegral<int32_t>();
196     uint32_t useSharedBuffer = mFdp.ConsumeBool();
197     audio_output_flags_t flags = getValue(&mFdp, kOutputFlags);
198     audio_session_t sessionId = getValue(&mFdp, kSessionId);
199     audio_usage_t usage = getValue(&mFdp, kUsages);
200     audio_content_type_t contentType = getValue(&mFdp, kContentType);
201     audio_attributes_t attributes = {};
202     sp<IMemory> sharedBuffer;
203     sp<MemoryDealer> heap = nullptr;
204     audio_offload_info_t offloadInfo = AUDIO_INFO_INITIALIZER;
205 
206     bool offload = false;
207     bool fast = ((flags & AUDIO_OUTPUT_FLAG_FAST) != 0);
208 
209     if (useSharedBuffer != 0) {
210         size_t heapSize = audio_channel_count_from_out_mask(channelMask) *
211                           audio_bytes_per_sample(format) * frameCount;
212         heap = new MemoryDealer(heapSize, "AudioTrack Heap Base");
213         sharedBuffer = heap->allocate(heapSize);
214         frameCount = 0;
215         notificationFrames = 0;
216     }
217     if ((flags & AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD) != 0) {
218         offloadInfo.sample_rate = sampleRate;
219         offloadInfo.channel_mask = channelMask;
220         offloadInfo.format = format;
221         offload = true;
222     }
223 
224     attributes.content_type = contentType;
225     attributes.usage = usage;
226     sp<AudioTrack> track = new AudioTrack();
227 
228     // TODO b/182392769: use attribution source util
229     AttributionSourceState attributionSource;
230     attributionSource.uid = VALUE_OR_FATAL(legacy2aidl_uid_t_int32_t(getuid()));
231     attributionSource.pid = VALUE_OR_FATAL(legacy2aidl_pid_t_int32_t(getpid()));
232     attributionSource.token = sp<BBinder>::make();
233     track->set(AUDIO_STREAM_DEFAULT, sampleRate, format, channelMask, frameCount, flags, nullptr,
234                nullptr, notificationFrames, sharedBuffer, false, sessionId,
235                ((fast && sharedBuffer == 0) || offload) ? AudioTrack::TRANSFER_CALLBACK
236                                                         : AudioTrack::TRANSFER_DEFAULT,
237                offload ? &offloadInfo : nullptr, attributionSource, &attributes, false, 1.0f,
238                AUDIO_PORT_HANDLE_NONE);
239 
240     status_t status = track->initCheck();
241     if (status != NO_ERROR) {
242         track.clear();
243         return;
244     }
245     track->getSampleRate();
246     track->latency();
247     track->getUnderrunCount();
248     track->streamType();
249     track->channelCount();
250     track->getNotificationPeriodInFrames();
251     uint32_t bufferSizeInFrames = mFdp.ConsumeIntegral<uint32_t>();
252     track->setBufferSizeInFrames(bufferSizeInFrames);
253     track->getBufferSizeInFrames();
254 
255     int64_t duration = mFdp.ConsumeIntegral<int64_t>();
256     track->getBufferDurationInUs(&duration);
257     sp<IMemory> sharedBuffer2 = track->sharedBuffer();
258     track->setCallerName(mFdp.ConsumeRandomLengthString(MAX_STRING_LENGTH));
259 
260     track->setVolume(mFdp.ConsumeFloatingPoint<float>(), mFdp.ConsumeFloatingPoint<float>());
261     track->setVolume(mFdp.ConsumeFloatingPoint<float>());
262     track->setAuxEffectSendLevel(mFdp.ConsumeFloatingPoint<float>());
263 
264     float auxEffectSendLevel;
265     track->getAuxEffectSendLevel(&auxEffectSendLevel);
266     track->setSampleRate(getSampleRate(&mFdp));
267     track->getSampleRate();
268     track->getOriginalSampleRate();
269 
270     AudioPlaybackRate playbackRate = {};
271     playbackRate.mSpeed = mFdp.ConsumeFloatingPoint<float>();
272     playbackRate.mPitch = mFdp.ConsumeFloatingPoint<float>();
273     track->setPlaybackRate(playbackRate);
274     track->getPlaybackRate();
275     track->setLoop(mFdp.ConsumeIntegral<uint32_t>(), mFdp.ConsumeIntegral<uint32_t>(),
276                    mFdp.ConsumeIntegral<uint32_t>());
277     track->setMarkerPosition(mFdp.ConsumeIntegral<uint32_t>());
278 
279     uint32_t marker = {};
280     track->getMarkerPosition(&marker);
281     track->setPositionUpdatePeriod(mFdp.ConsumeIntegral<uint32_t>());
282 
283     uint32_t updatePeriod = {};
284     track->getPositionUpdatePeriod(&updatePeriod);
285     track->setPosition(mFdp.ConsumeIntegral<uint32_t>());
286     uint32_t position = {};
287     track->getPosition(&position);
288     track->getBufferPosition(&position);
289     track->reload();
290     track->start();
291     track->pause();
292     track->flush();
293     track->stop();
294     track->stopped();
295 }
296 
invokeAudioRecord()297 void AudioFlingerFuzzer::invokeAudioRecord() {
298     int32_t notificationFrames = mFdp.ConsumeIntegral<int32_t>();
299     uint32_t sampleRate = getSampleRate(&mFdp);
300     size_t frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
301     audio_format_t format = getValue(&mFdp, kFormats);
302     audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
303     audio_input_flags_t flags = getValue(&mFdp, kInputFlags);
304     audio_session_t sessionId = getValue(&mFdp, kSessionId);
305     audio_source_t inputSource = getValue(&mFdp, kInputSources);
306 
307     audio_attributes_t attributes = {};
308     bool fast = ((flags & AUDIO_OUTPUT_FLAG_FAST) != 0);
309 
310     attributes.source = inputSource;
311 
312     // TODO b/182392769: use attribution source util
313     AttributionSourceState attributionSource;
314     attributionSource.packageName = std::string(mFdp.ConsumeRandomLengthString().c_str());
315     attributionSource.token = sp<BBinder>::make();
316     sp<AudioRecord> record = new AudioRecord(attributionSource);
317     record->set(AUDIO_SOURCE_DEFAULT, sampleRate, format, channelMask, frameCount, nullptr, nullptr,
318                 notificationFrames, false, sessionId,
319                 fast ? AudioRecord::TRANSFER_CALLBACK : AudioRecord::TRANSFER_DEFAULT, flags,
320                 getuid(), getpid(), &attributes, AUDIO_PORT_HANDLE_NONE);
321     status_t status = record->initCheck();
322     if (status != NO_ERROR) {
323         return;
324     }
325     record->latency();
326     record->format();
327     record->channelCount();
328     record->frameCount();
329     record->frameSize();
330     record->inputSource();
331     record->getNotificationPeriodInFrames();
332     record->start();
333     record->stop();
334     record->stopped();
335 
336     uint32_t marker = mFdp.ConsumeIntegral<uint32_t>();
337     record->setMarkerPosition(marker);
338     record->getMarkerPosition(&marker);
339 
340     uint32_t updatePeriod = mFdp.ConsumeIntegral<uint32_t>();
341     record->setPositionUpdatePeriod(updatePeriod);
342     record->getPositionUpdatePeriod(&updatePeriod);
343 
344     uint32_t position;
345     record->getPosition(&position);
346 
347     ExtendedTimestamp timestamp;
348     record->getTimestamp(&timestamp);
349     record->getSessionId();
350     record->getCallerName();
351     android::AudioRecord::Buffer audioBuffer;
352     int32_t waitCount = mFdp.ConsumeIntegral<int32_t>();
353     size_t nonContig = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
354     audioBuffer.frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
355     record->obtainBuffer(&audioBuffer, waitCount, &nonContig);
356     bool blocking = false;
357     record->read(audioBuffer.raw, audioBuffer.size, blocking);
358     record->getInputFramesLost();
359     record->getFlags();
360 
361     std::vector<media::MicrophoneInfo> activeMicrophones;
362     record->getActiveMicrophones(&activeMicrophones);
363     record->releaseBuffer(&audioBuffer);
364 
365     audio_port_handle_t deviceId =
366         static_cast<audio_port_handle_t>(mFdp.ConsumeIntegral<int32_t>());
367     record->setInputDevice(deviceId);
368     record->getInputDevice();
369     record->getRoutedDeviceId();
370     record->getPortId();
371 }
372 
373 struct EffectClient : public android::media::BnEffectClient {
EffectClientEffectClient374     EffectClient() {}
controlStatusChangedEffectClient375     binder::Status controlStatusChanged(bool controlGranted __unused) override {
376         return binder::Status::ok();
377     }
enableStatusChangedEffectClient378     binder::Status enableStatusChanged(bool enabled __unused) override {
379         return binder::Status::ok();
380     }
commandExecutedEffectClient381     binder::Status commandExecuted(int32_t cmdCode __unused,
382                                    const std::vector<uint8_t> &cmdData __unused,
383                                    const std::vector<uint8_t> &replyData __unused) override {
384         return binder::Status::ok();
385     }
framesProcessedEffectClient386     binder::Status framesProcessed(int32_t frames __unused) override {
387         return binder::Status::ok();
388     }
389 };
390 
invokeAudioEffect()391 status_t AudioFlingerFuzzer::invokeAudioEffect() {
392     effect_uuid_t type;
393     type.timeLow = mFdp.ConsumeIntegral<uint32_t>();
394     type.timeMid = mFdp.ConsumeIntegral<uint16_t>();
395     type.timeHiAndVersion = mFdp.ConsumeIntegral<uint16_t>();
396     type.clockSeq = mFdp.ConsumeIntegral<uint16_t>();
397     for (int i = 0; i < 6; ++i) {
398         type.node[i] = mFdp.ConsumeIntegral<uint8_t>();
399     }
400 
401     effect_descriptor_t descriptor = {};
402     descriptor.type = type;
403     descriptor.uuid = *EFFECT_UUID_NULL;
404 
405     sp<EffectClient> effectClient(new EffectClient());
406 
407     const int32_t priority = mFdp.ConsumeIntegral<int32_t>();
408     audio_session_t sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
409     const audio_io_handle_t io = mFdp.ConsumeIntegral<int32_t>();
410     std::string opPackageName = static_cast<std::string>(mFdp.ConsumeRandomLengthString().c_str());
411     AudioDeviceTypeAddr device;
412 
413     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
414     if (!af) {
415         return NO_ERROR;
416     }
417 
418     media::CreateEffectRequest request{};
419     request.desc =
420         VALUE_OR_RETURN_STATUS(legacy2aidl_effect_descriptor_t_EffectDescriptor(descriptor));
421     request.client = effectClient;
422     request.priority = priority;
423     request.output = io;
424     request.sessionId = sessionId;
425     request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_AudioDeviceTypeAddress(device));
426     // TODO b/182392769: use attribution source util
427     request.attributionSource.packageName = opPackageName;
428     request.attributionSource.pid = VALUE_OR_RETURN_STATUS(legacy2aidl_pid_t_int32_t(getpid()));
429     request.probe = false;
430     request.notifyFramesProcessed = false;
431 
432     media::CreateEffectResponse response{};
433     status_t status = af->createEffect(request, &response);
434 
435     if (status != OK) {
436         return NO_ERROR;
437     }
438 
439     descriptor =
440         VALUE_OR_RETURN_STATUS(aidl2legacy_EffectDescriptor_effect_descriptor_t(response.desc));
441 
442     uint32_t numEffects;
443     af->queryNumberEffects(&numEffects);
444 
445     uint32_t queryIndex = mFdp.ConsumeIntegral<uint32_t>();
446     af->queryEffect(queryIndex, &descriptor);
447 
448     effect_descriptor_t getDescriptor;
449     uint32_t preferredTypeFlag = mFdp.ConsumeIntegral<int32_t>();
450     af->getEffectDescriptor(&descriptor.uuid, &descriptor.type, preferredTypeFlag, &getDescriptor);
451 
452     sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
453     audio_io_handle_t srcOutput = mFdp.ConsumeIntegral<int32_t>();
454     audio_io_handle_t dstOutput = mFdp.ConsumeIntegral<int32_t>();
455     af->moveEffects(sessionId, srcOutput, dstOutput);
456 
457     int effectId = mFdp.ConsumeIntegral<int32_t>();
458     sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
459     af->setEffectSuspended(effectId, sessionId, mFdp.ConsumeBool());
460     return NO_ERROR;
461 }
462 
invokeAudioSystem()463 void AudioFlingerFuzzer::invokeAudioSystem() {
464     AudioSystem::muteMicrophone(mFdp.ConsumeBool());
465     AudioSystem::setMasterMute(mFdp.ConsumeBool());
466     AudioSystem::setMasterVolume(mFdp.ConsumeFloatingPoint<float>());
467     AudioSystem::setMasterBalance(mFdp.ConsumeFloatingPoint<float>());
468     AudioSystem::setVoiceVolume(mFdp.ConsumeFloatingPoint<float>());
469 
470     float volume;
471     AudioSystem::getMasterVolume(&volume);
472 
473     bool state;
474     AudioSystem::getMasterMute(&state);
475     AudioSystem::isMicrophoneMuted(&state);
476 
477     audio_stream_type_t stream = getValue(&mFdp, kStreamtypes);
478     AudioSystem::setStreamMute(getValue(&mFdp, kStreamtypes), mFdp.ConsumeBool());
479 
480     stream = getValue(&mFdp, kStreamtypes);
481     AudioSystem::setStreamVolume(stream, mFdp.ConsumeFloatingPoint<float>(),
482                                  mFdp.ConsumeIntegral<int32_t>());
483 
484     audio_mode_t mode = getValue(&mFdp, kModes);
485     AudioSystem::setMode(mode);
486 
487     size_t frameCount;
488     stream = getValue(&mFdp, kStreamtypes);
489     AudioSystem::getOutputFrameCount(&frameCount, stream);
490 
491     uint32_t latency;
492     stream = getValue(&mFdp, kStreamtypes);
493     AudioSystem::getOutputLatency(&latency, stream);
494 
495     stream = getValue(&mFdp, kStreamtypes);
496     AudioSystem::getStreamVolume(stream, &volume, mFdp.ConsumeIntegral<int32_t>());
497 
498     stream = getValue(&mFdp, kStreamtypes);
499     AudioSystem::getStreamMute(stream, &state);
500 
501     uint32_t samplingRate;
502     AudioSystem::getSamplingRate(mFdp.ConsumeIntegral<int32_t>(), &samplingRate);
503 
504     AudioSystem::getFrameCount(mFdp.ConsumeIntegral<int32_t>(), &frameCount);
505     AudioSystem::getLatency(mFdp.ConsumeIntegral<int32_t>(), &latency);
506     AudioSystem::setVoiceVolume(mFdp.ConsumeFloatingPoint<float>());
507 
508     uint32_t halFrames;
509     uint32_t dspFrames;
510     AudioSystem::getRenderPosition(mFdp.ConsumeIntegral<int32_t>(), &halFrames, &dspFrames);
511 
512     AudioSystem::getInputFramesLost(mFdp.ConsumeIntegral<int32_t>());
513     AudioSystem::getInputFramesLost(mFdp.ConsumeIntegral<int32_t>());
514 
515     audio_unique_id_use_t uniqueIdUse = getValue(&mFdp, kUniqueIds);
516     AudioSystem::newAudioUniqueId(uniqueIdUse);
517 
518     audio_session_t sessionId = getValue(&mFdp, kSessionId);
519     pid_t pid = mFdp.ConsumeBool() ? getpid() : mFdp.ConsumeIntegral<int32_t>();
520     uid_t uid = mFdp.ConsumeBool() ? getuid() : mFdp.ConsumeIntegral<int32_t>();
521     AudioSystem::acquireAudioSessionId(sessionId, pid, uid);
522 
523     pid = mFdp.ConsumeBool() ? getpid() : mFdp.ConsumeIntegral<int32_t>();
524     sessionId = getValue(&mFdp, kSessionId);
525     AudioSystem::releaseAudioSessionId(sessionId, pid);
526 
527     sessionId = getValue(&mFdp, kSessionId);
528     AudioSystem::getAudioHwSyncForSession(sessionId);
529 
530     AudioSystem::systemReady();
531     AudioSystem::getFrameCountHAL(mFdp.ConsumeIntegral<int32_t>(), &frameCount);
532 
533     size_t buffSize;
534     uint32_t sampleRate = getSampleRate(&mFdp);
535     audio_format_t format = getValue(&mFdp, kFormats);
536     audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
537     AudioSystem::getInputBufferSize(sampleRate, format, channelMask, &buffSize);
538 
539     AudioSystem::getPrimaryOutputSamplingRate();
540     AudioSystem::getPrimaryOutputFrameCount();
541     AudioSystem::setLowRamDevice(mFdp.ConsumeBool(), mFdp.ConsumeIntegral<int64_t>());
542 
543     std::vector<media::MicrophoneInfo> microphones;
544     AudioSystem::getMicrophones(&microphones);
545 
546     std::vector<pid_t> pids;
547     pids.insert(pids.begin(), getpid());
548     for (int i = 1; i < mFdp.ConsumeIntegralInRange<int32_t>(2, MAX_ARRAY_LENGTH); ++i) {
549         pids.insert(pids.begin() + i, static_cast<pid_t>(mFdp.ConsumeIntegral<int32_t>()));
550     }
551     AudioSystem::setAudioHalPids(pids);
552     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
553     if (!af) {
554         return;
555     }
556     af->setRecordSilenced(mFdp.ConsumeIntegral<uint32_t>(), mFdp.ConsumeBool());
557 
558     float balance = mFdp.ConsumeFloatingPoint<float>();
559     af->getMasterBalance(&balance);
560     af->invalidateStream(static_cast<audio_stream_type_t>(mFdp.ConsumeIntegral<uint32_t>()));
561 }
562 
invokeAudioInputDevice()563 status_t AudioFlingerFuzzer::invokeAudioInputDevice() {
564     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
565     if (!af) {
566         return NO_ERROR;
567     }
568 
569     audio_config_t config = {};
570     audio_module_handle_t module = mFdp.ConsumeIntegral<int32_t>();
571     audio_io_handle_t input = mFdp.ConsumeIntegral<int32_t>();
572     config.frame_count = mFdp.ConsumeIntegral<uint32_t>();
573     String8 address = static_cast<String8>(mFdp.ConsumeRandomLengthString().c_str());
574 
575     config.channel_mask = getValue(&mFdp, kChannelMasks);
576     config.format = getValue(&mFdp, kFormats);
577 
578     config.offload_info = AUDIO_INFO_INITIALIZER;
579     config.offload_info.bit_rate = mFdp.ConsumeIntegral<uint32_t>();
580     config.offload_info.bit_width = mFdp.ConsumeIntegral<uint32_t>();
581     config.offload_info.content_id = mFdp.ConsumeIntegral<uint32_t>();
582     config.offload_info.channel_mask = getValue(&mFdp, kChannelMasks);
583     config.offload_info.duration_us = mFdp.ConsumeIntegral<int64_t>();
584     config.offload_info.encapsulation_mode = getValue(&mFdp, kEncapsulation);
585     config.offload_info.format = getValue(&mFdp, kFormats);
586     config.offload_info.has_video = mFdp.ConsumeBool();
587     config.offload_info.is_streaming = mFdp.ConsumeBool();
588     config.offload_info.sample_rate = getSampleRate(&mFdp);
589     config.offload_info.sync_id = mFdp.ConsumeIntegral<uint32_t>();
590     config.offload_info.stream_type = getValue(&mFdp, kStreamtypes);
591     config.offload_info.usage = getValue(&mFdp, kUsages);
592 
593     config.sample_rate = getSampleRate(&mFdp);
594 
595     audio_devices_t device = getValue(&mFdp, kDevices);
596     audio_source_t source = getValue(&mFdp, kInputSources);
597     audio_input_flags_t flags = getValue(&mFdp, kInputFlags);
598 
599     AudioDeviceTypeAddr deviceTypeAddr(device, address.c_str());
600 
601     media::OpenInputRequest request{};
602     request.module = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_module_handle_t_int32_t(module));
603     request.input = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_io_handle_t_int32_t(input));
604     request.config = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_config_t_AudioConfig(config));
605     request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_AudioDeviceTypeAddress(deviceTypeAddr));
606     request.source = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_source_t_AudioSourceType(source));
607     request.flags = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_input_flags_t_int32_t_mask(flags));
608 
609     media::OpenInputResponse response{};
610     status_t status = af->openInput(request, &response);
611     if (status != NO_ERROR) {
612         return NO_ERROR;
613     }
614 
615     input = VALUE_OR_RETURN_STATUS(aidl2legacy_int32_t_audio_module_handle_t(response.input));
616     af->closeInput(input);
617     return NO_ERROR;
618 }
619 
invokeAudioOutputDevice()620 status_t AudioFlingerFuzzer::invokeAudioOutputDevice() {
621     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
622     if (!af) {
623         return NO_ERROR;
624     }
625 
626     audio_config_t config = {};
627     audio_module_handle_t module = mFdp.ConsumeIntegral<int32_t>();
628     audio_io_handle_t output = mFdp.ConsumeIntegral<int32_t>();
629     config.frame_count = mFdp.ConsumeIntegral<uint32_t>();
630     String8 address = static_cast<String8>(mFdp.ConsumeRandomLengthString().c_str());
631 
632     config.channel_mask = getValue(&mFdp, kChannelMasks);
633 
634     config.offload_info = AUDIO_INFO_INITIALIZER;
635     config.offload_info.bit_rate = mFdp.ConsumeIntegral<uint32_t>();
636     config.offload_info.bit_width = mFdp.ConsumeIntegral<uint32_t>();
637     config.offload_info.channel_mask = getValue(&mFdp, kChannelMasks);
638     config.offload_info.content_id = mFdp.ConsumeIntegral<uint32_t>();
639     config.offload_info.duration_us = mFdp.ConsumeIntegral<int64_t>();
640     config.offload_info.encapsulation_mode = getValue(&mFdp, kEncapsulation);
641     config.offload_info.format = getValue(&mFdp, kFormats);
642     config.offload_info.has_video = mFdp.ConsumeBool();
643     config.offload_info.is_streaming = mFdp.ConsumeBool();
644     config.offload_info.sample_rate = getSampleRate(&mFdp);
645     config.offload_info.stream_type = getValue(&mFdp, kStreamtypes);
646     config.offload_info.sync_id = mFdp.ConsumeIntegral<uint32_t>();
647     config.offload_info.usage = getValue(&mFdp, kUsages);
648 
649     config.format = getValue(&mFdp, kFormats);
650     config.sample_rate = getSampleRate(&mFdp);
651 
652     sp<DeviceDescriptorBase> device = new DeviceDescriptorBase(getValue(&mFdp, kDevices));
653     audio_output_flags_t flags = getValue(&mFdp, kOutputFlags);
654 
655     audio_config_base_t mixerConfig = AUDIO_CONFIG_BASE_INITIALIZER;
656 
657     media::OpenOutputRequest request{};
658     media::OpenOutputResponse response{};
659 
660     request.module = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_module_handle_t_int32_t(module));
661     request.halConfig = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_config_t_AudioConfig(config));
662     request.mixerConfig =
663             VALUE_OR_RETURN_STATUS(legacy2aidl_audio_config_base_t_AudioConfigBase(mixerConfig));
664     request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_DeviceDescriptorBase(device));
665     request.flags = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_output_flags_t_int32_t_mask(flags));
666 
667     status_t status = af->openOutput(request, &response);
668     if (status != NO_ERROR) {
669         return NO_ERROR;
670     }
671     output = VALUE_OR_RETURN_STATUS(aidl2legacy_int32_t_audio_io_handle_t(response.output));
672 
673     audio_io_handle_t output1 = mFdp.ConsumeIntegral<int32_t>();
674     af->openDuplicateOutput(output, output1);
675     af->suspendOutput(output);
676     af->restoreOutput(output);
677     af->closeOutput(output);
678     return NO_ERROR;
679 }
680 
invokeAudioPatch()681 void AudioFlingerFuzzer::invokeAudioPatch() {
682     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
683     if (!af) {
684         return;
685     }
686     struct audio_patch patch = {};
687     audio_patch_handle_t handle = mFdp.ConsumeIntegral<int32_t>();
688 
689     patch.id = mFdp.ConsumeIntegral<int32_t>();
690     patch.num_sources = mFdp.ConsumeIntegral<uint32_t>();
691     patch.num_sinks = mFdp.ConsumeIntegral<uint32_t>();
692 
693     for (int i = 0; i < AUDIO_PATCH_PORTS_MAX; ++i) {
694         patch.sources[i].config_mask = mFdp.ConsumeIntegral<uint32_t>();
695         patch.sources[i].channel_mask = getValue(&mFdp, kChannelMasks);
696         patch.sources[i].format = getValue(&mFdp, kFormats);
697         patch.sources[i].gain.channel_mask = getValue(&mFdp, kChannelMasks);
698         patch.sources[i].gain.index = mFdp.ConsumeIntegral<int32_t>();
699         patch.sources[i].gain.mode = getValue(&mFdp, kGainModes);
700         patch.sources[i].gain.ramp_duration_ms = mFdp.ConsumeIntegral<uint32_t>();
701         patch.sources[i].id = static_cast<audio_format_t>(mFdp.ConsumeIntegral<int32_t>());
702         patch.sources[i].role = getValue(&mFdp, kPortRoles);
703         patch.sources[i].sample_rate = getSampleRate(&mFdp);
704         patch.sources[i].type = getValue(&mFdp, kPortTypes);
705 
706         patch.sinks[i].config_mask = mFdp.ConsumeIntegral<uint32_t>();
707         patch.sinks[i].channel_mask = getValue(&mFdp, kChannelMasks);
708         patch.sinks[i].format = getValue(&mFdp, kFormats);
709         patch.sinks[i].gain.channel_mask = getValue(&mFdp, kChannelMasks);
710         patch.sinks[i].gain.index = mFdp.ConsumeIntegral<int32_t>();
711         patch.sinks[i].gain.mode = getValue(&mFdp, kGainModes);
712         patch.sinks[i].gain.ramp_duration_ms = mFdp.ConsumeIntegral<uint32_t>();
713         patch.sinks[i].id = static_cast<audio_format_t>(mFdp.ConsumeIntegral<int32_t>());
714         patch.sinks[i].role = getValue(&mFdp, kPortRoles);
715         patch.sinks[i].sample_rate = getSampleRate(&mFdp);
716         patch.sinks[i].type = getValue(&mFdp, kPortTypes);
717     }
718 
719     status_t status = af->createAudioPatch(&patch, &handle);
720     if (status != NO_ERROR) {
721         return;
722     }
723 
724     unsigned int num_patches = mFdp.ConsumeIntegral<uint32_t>();
725     struct audio_patch patches = {};
726     af->listAudioPatches(&num_patches, &patches);
727     af->releaseAudioPatch(handle);
728 }
729 
process()730 void AudioFlingerFuzzer::process() {
731     invokeAudioEffect();
732     invokeAudioInputDevice();
733     invokeAudioOutputDevice();
734     invokeAudioPatch();
735     invokeAudioRecord();
736     invokeAudioSystem();
737     invokeAudioTrack();
738 }
739 
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)740 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
741     if (size < 1) {
742         return 0;
743     }
744     AudioFlingerFuzzer audioFuzzer(data, size);
745     audioFuzzer.process();
746     return 0;
747 }
748