1 /******************************************************************************
2 *
3 * Copyright (C) 2020 The Android Open Source Project
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 *****************************************************************************
18 * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
19 */
20 #include <fuzzer/FuzzedDataProvider.h>
21 #include <stdio.h>
22
23 #include <AAudioService.h>
24 #include <aaudio/AAudio.h>
25 #include "aaudio/BnAAudioClient.h"
26 #include <android/content/AttributionSourceState.h>
27
28 #define UNUSED_PARAM __attribute__((unused))
29
30 using namespace android;
31 using namespace aaudio;
32
33 aaudio_format_t kAAudioFormats[] = {
34 AAUDIO_FORMAT_UNSPECIFIED,
35 AAUDIO_FORMAT_PCM_I16,
36 AAUDIO_FORMAT_PCM_FLOAT,
37 };
38
39 aaudio_usage_t kAAudioUsages[] = {
40 AAUDIO_USAGE_MEDIA,
41 AAUDIO_USAGE_VOICE_COMMUNICATION,
42 AAUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING,
43 AAUDIO_USAGE_ALARM,
44 AAUDIO_USAGE_NOTIFICATION,
45 AAUDIO_USAGE_NOTIFICATION_RINGTONE,
46 AAUDIO_USAGE_NOTIFICATION_EVENT,
47 AAUDIO_USAGE_ASSISTANCE_ACCESSIBILITY,
48 AAUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE,
49 AAUDIO_USAGE_ASSISTANCE_SONIFICATION,
50 AAUDIO_USAGE_GAME,
51 AAUDIO_USAGE_ASSISTANT,
52 AAUDIO_SYSTEM_USAGE_EMERGENCY,
53 AAUDIO_SYSTEM_USAGE_SAFETY,
54 AAUDIO_SYSTEM_USAGE_VEHICLE_STATUS,
55 AAUDIO_SYSTEM_USAGE_ANNOUNCEMENT,
56 };
57
58 aaudio_content_type_t kAAudioContentTypes[] = {
59 AAUDIO_CONTENT_TYPE_SPEECH,
60 AAUDIO_CONTENT_TYPE_MUSIC,
61 AAUDIO_CONTENT_TYPE_MOVIE,
62 AAUDIO_CONTENT_TYPE_SONIFICATION,
63 };
64
65 aaudio_input_preset_t kAAudioInputPresets[] = {
66 AAUDIO_INPUT_PRESET_GENERIC, AAUDIO_INPUT_PRESET_CAMCORDER,
67 AAUDIO_INPUT_PRESET_VOICE_RECOGNITION, AAUDIO_INPUT_PRESET_VOICE_COMMUNICATION,
68 AAUDIO_INPUT_PRESET_UNPROCESSED, AAUDIO_INPUT_PRESET_VOICE_PERFORMANCE,
69 };
70
71 aaudio_channel_mask_t kAAudioChannelMasks[] = {
72 AAUDIO_UNSPECIFIED,
73 AAUDIO_CHANNEL_INDEX_MASK_1,
74 AAUDIO_CHANNEL_INDEX_MASK_2,
75 AAUDIO_CHANNEL_INDEX_MASK_3,
76 AAUDIO_CHANNEL_INDEX_MASK_4,
77 AAUDIO_CHANNEL_INDEX_MASK_5,
78 AAUDIO_CHANNEL_INDEX_MASK_6,
79 AAUDIO_CHANNEL_INDEX_MASK_7,
80 AAUDIO_CHANNEL_INDEX_MASK_8,
81 AAUDIO_CHANNEL_INDEX_MASK_9,
82 AAUDIO_CHANNEL_INDEX_MASK_10,
83 AAUDIO_CHANNEL_INDEX_MASK_11,
84 AAUDIO_CHANNEL_INDEX_MASK_12,
85 AAUDIO_CHANNEL_INDEX_MASK_13,
86 AAUDIO_CHANNEL_INDEX_MASK_14,
87 AAUDIO_CHANNEL_INDEX_MASK_15,
88 AAUDIO_CHANNEL_INDEX_MASK_16,
89 AAUDIO_CHANNEL_INDEX_MASK_17,
90 AAUDIO_CHANNEL_INDEX_MASK_18,
91 AAUDIO_CHANNEL_INDEX_MASK_19,
92 AAUDIO_CHANNEL_INDEX_MASK_20,
93 AAUDIO_CHANNEL_INDEX_MASK_21,
94 AAUDIO_CHANNEL_INDEX_MASK_22,
95 AAUDIO_CHANNEL_INDEX_MASK_23,
96 AAUDIO_CHANNEL_INDEX_MASK_24,
97 AAUDIO_CHANNEL_MONO,
98 AAUDIO_CHANNEL_STEREO,
99 AAUDIO_CHANNEL_FRONT_BACK,
100 AAUDIO_CHANNEL_2POINT0POINT2,
101 AAUDIO_CHANNEL_2POINT1POINT2,
102 AAUDIO_CHANNEL_3POINT0POINT2,
103 AAUDIO_CHANNEL_3POINT1POINT2,
104 AAUDIO_CHANNEL_5POINT1,
105 AAUDIO_CHANNEL_MONO,
106 AAUDIO_CHANNEL_STEREO,
107 AAUDIO_CHANNEL_2POINT1,
108 AAUDIO_CHANNEL_TRI,
109 AAUDIO_CHANNEL_TRI_BACK,
110 AAUDIO_CHANNEL_3POINT1,
111 AAUDIO_CHANNEL_2POINT0POINT2,
112 AAUDIO_CHANNEL_2POINT1POINT2,
113 AAUDIO_CHANNEL_3POINT0POINT2,
114 AAUDIO_CHANNEL_3POINT1POINT2,
115 AAUDIO_CHANNEL_QUAD,
116 AAUDIO_CHANNEL_QUAD_SIDE,
117 AAUDIO_CHANNEL_SURROUND,
118 AAUDIO_CHANNEL_PENTA,
119 AAUDIO_CHANNEL_5POINT1,
120 AAUDIO_CHANNEL_5POINT1_SIDE,
121 AAUDIO_CHANNEL_5POINT1POINT2,
122 AAUDIO_CHANNEL_5POINT1POINT4,
123 AAUDIO_CHANNEL_6POINT1,
124 AAUDIO_CHANNEL_7POINT1,
125 AAUDIO_CHANNEL_7POINT1POINT2,
126 AAUDIO_CHANNEL_7POINT1POINT4,
127 AAUDIO_CHANNEL_9POINT1POINT4,
128 AAUDIO_CHANNEL_9POINT1POINT6,
129 };
130
131 const size_t kNumAAudioFormats = std::size(kAAudioFormats);
132 const size_t kNumAAudioUsages = std::size(kAAudioUsages);
133 const size_t kNumAAudioContentTypes = std::size(kAAudioContentTypes);
134 const size_t kNumAAudioInputPresets = std::size(kAAudioInputPresets);
135 const size_t kNumAAudioChannelMasks = std::size(kAAudioChannelMasks);
136
137 class FuzzAAudioClient : public virtual RefBase, public AAudioServiceInterface {
138 public:
139 FuzzAAudioClient(sp<AAudioService> service);
140
141 virtual ~FuzzAAudioClient();
142
143 AAudioServiceInterface *getAAudioService();
144
145 void dropAAudioService();
146
registerClient(const sp<IAAudioClient> & client UNUSED_PARAM)147 void registerClient(const sp<IAAudioClient> &client UNUSED_PARAM) override {}
148
149 aaudio_handle_t openStream(const AAudioStreamRequest &request,
150 AAudioStreamConfiguration &configurationOutput) override;
151
152 aaudio_result_t closeStream(aaudio_handle_t streamHandle) override;
153
154 aaudio_result_t getStreamDescription(aaudio_handle_t streamHandle,
155 AudioEndpointParcelable &parcelable) override;
156
157 aaudio_result_t startStream(aaudio_handle_t streamHandle) override;
158
159 aaudio_result_t pauseStream(aaudio_handle_t streamHandle) override;
160
161 aaudio_result_t stopStream(aaudio_handle_t streamHandle) override;
162
163 aaudio_result_t flushStream(aaudio_handle_t streamHandle) override;
164
165 aaudio_result_t registerAudioThread(aaudio_handle_t streamHandle, pid_t clientThreadId,
166 int64_t periodNanoseconds) override;
167
168 aaudio_result_t unregisterAudioThread(aaudio_handle_t streamHandle,
169 pid_t clientThreadId) override;
170
startClient(aaudio_handle_t streamHandle UNUSED_PARAM,const AudioClient & client UNUSED_PARAM,const audio_attributes_t * attr UNUSED_PARAM,audio_port_handle_t * clientHandle UNUSED_PARAM)171 aaudio_result_t startClient(aaudio_handle_t streamHandle UNUSED_PARAM,
172 const AudioClient &client UNUSED_PARAM,
173 const audio_attributes_t *attr UNUSED_PARAM,
174 audio_port_handle_t *clientHandle UNUSED_PARAM) override {
175 return AAUDIO_ERROR_UNAVAILABLE;
176 }
177
stopClient(aaudio_handle_t streamHandle UNUSED_PARAM,audio_port_handle_t clientHandle UNUSED_PARAM)178 aaudio_result_t stopClient(aaudio_handle_t streamHandle UNUSED_PARAM,
179 audio_port_handle_t clientHandle UNUSED_PARAM) override {
180 return AAUDIO_ERROR_UNAVAILABLE;
181 }
182
onStreamChange(aaudio_handle_t handle,int32_t opcode,int32_t value)183 void onStreamChange(aaudio_handle_t handle, int32_t opcode, int32_t value) {}
184
getDeathCount()185 int getDeathCount() { return mDeathCount; }
186
incDeathCount()187 void incDeathCount() { ++mDeathCount; }
188
189 class AAudioClient : public IBinder::DeathRecipient, public BnAAudioClient {
190 public:
AAudioClient(wp<FuzzAAudioClient> fuzzAAudioClient)191 AAudioClient(wp<FuzzAAudioClient> fuzzAAudioClient) : mBinderClient(fuzzAAudioClient) {}
192
binderDied(const wp<IBinder> & who UNUSED_PARAM)193 virtual void binderDied(const wp<IBinder> &who UNUSED_PARAM) {
194 sp<FuzzAAudioClient> client = mBinderClient.promote();
195 if (client.get()) {
196 client->dropAAudioService();
197 client->incDeathCount();
198 }
199 }
200
onStreamChange(int32_t handle,int32_t opcode,int32_t value)201 android::binder::Status onStreamChange(int32_t handle, int32_t opcode, int32_t value) {
202 static_assert(std::is_same_v<aaudio_handle_t, int32_t>);
203 android::sp<FuzzAAudioClient> client = mBinderClient.promote();
204 if (client.get() != nullptr) {
205 client->onStreamChange(handle, opcode, value);
206 }
207 return android::binder::Status::ok();
208 }
209
210 private:
211 wp<FuzzAAudioClient> mBinderClient;
212 };
213
214 private:
215 sp<AAudioService> mAAudioService;
216 sp<AAudioClient> mAAudioClient;
217 AAudioServiceInterface *mAAudioServiceInterface;
218 int mDeathCount;
219 };
220
FuzzAAudioClient(sp<AAudioService> service)221 FuzzAAudioClient::FuzzAAudioClient(sp<AAudioService> service) : AAudioServiceInterface() {
222 mAAudioService = service;
223 mAAudioServiceInterface = &service->asAAudioServiceInterface();
224 mAAudioClient = new AAudioClient(this);
225 mDeathCount = 0;
226 if (mAAudioClient.get() && mAAudioService.get()) {
227 mAAudioService->linkToDeath(mAAudioClient);
228 mAAudioService->registerClient(mAAudioClient);
229 }
230 }
231
~FuzzAAudioClient()232 FuzzAAudioClient::~FuzzAAudioClient() { dropAAudioService(); }
233
getAAudioService()234 AAudioServiceInterface *FuzzAAudioClient::getAAudioService() {
235 if (!mAAudioServiceInterface && mAAudioService.get()) {
236 mAAudioServiceInterface = &mAAudioService->asAAudioServiceInterface();
237 }
238 return mAAudioServiceInterface;
239 }
240
dropAAudioService()241 void FuzzAAudioClient::dropAAudioService() {
242 mAAudioService.clear();
243 }
244
openStream(const AAudioStreamRequest & request,AAudioStreamConfiguration & configurationOutput)245 aaudio_handle_t FuzzAAudioClient::openStream(const AAudioStreamRequest &request,
246 AAudioStreamConfiguration &configurationOutput) {
247 aaudio_handle_t stream;
248 for (int i = 0; i < 2; ++i) {
249 AAudioServiceInterface *service = getAAudioService();
250 if (!service) {
251 return AAUDIO_ERROR_NO_SERVICE;
252 }
253
254 stream = service->openStream(request, configurationOutput);
255
256 if (stream == AAUDIO_ERROR_NO_SERVICE) {
257 dropAAudioService();
258 } else {
259 break;
260 }
261 }
262 return stream;
263 }
264
closeStream(aaudio_handle_t streamHandle)265 aaudio_result_t FuzzAAudioClient::closeStream(aaudio_handle_t streamHandle) {
266 AAudioServiceInterface *service = getAAudioService();
267 if (!service) {
268 return AAUDIO_ERROR_NO_SERVICE;
269 }
270 return service->closeStream(streamHandle);
271 }
272
getStreamDescription(aaudio_handle_t streamHandle,AudioEndpointParcelable & parcelable)273 aaudio_result_t FuzzAAudioClient::getStreamDescription(aaudio_handle_t streamHandle,
274 AudioEndpointParcelable &parcelable) {
275 AAudioServiceInterface *service = getAAudioService();
276 if (!service) {
277 return AAUDIO_ERROR_NO_SERVICE;
278 }
279 return service->getStreamDescription(streamHandle, parcelable);
280 }
281
startStream(aaudio_handle_t streamHandle)282 aaudio_result_t FuzzAAudioClient::startStream(aaudio_handle_t streamHandle) {
283 AAudioServiceInterface *service = getAAudioService();
284 if (!service) {
285 return AAUDIO_ERROR_NO_SERVICE;
286 }
287 return service->startStream(streamHandle);
288 }
289
pauseStream(aaudio_handle_t streamHandle)290 aaudio_result_t FuzzAAudioClient::pauseStream(aaudio_handle_t streamHandle) {
291 AAudioServiceInterface *service = getAAudioService();
292 if (!service) {
293 return AAUDIO_ERROR_NO_SERVICE;
294 }
295 return service->pauseStream(streamHandle);
296 }
297
stopStream(aaudio_handle_t streamHandle)298 aaudio_result_t FuzzAAudioClient::stopStream(aaudio_handle_t streamHandle) {
299 AAudioServiceInterface *service = getAAudioService();
300 if (!service) {
301 return AAUDIO_ERROR_NO_SERVICE;
302 }
303 return service->stopStream(streamHandle);
304 }
305
flushStream(aaudio_handle_t streamHandle)306 aaudio_result_t FuzzAAudioClient::flushStream(aaudio_handle_t streamHandle) {
307 AAudioServiceInterface *service = getAAudioService();
308 if (!service) {
309 return AAUDIO_ERROR_NO_SERVICE;
310 }
311 return service->flushStream(streamHandle);
312 }
313
registerAudioThread(aaudio_handle_t streamHandle,pid_t clientThreadId,int64_t periodNanoseconds)314 aaudio_result_t FuzzAAudioClient::registerAudioThread(aaudio_handle_t streamHandle,
315 pid_t clientThreadId,
316 int64_t periodNanoseconds) {
317 AAudioServiceInterface *service = getAAudioService();
318 if (!service) {
319 return AAUDIO_ERROR_NO_SERVICE;
320 }
321 return service->registerAudioThread(streamHandle, clientThreadId, periodNanoseconds);
322 }
323
unregisterAudioThread(aaudio_handle_t streamHandle,pid_t clientThreadId)324 aaudio_result_t FuzzAAudioClient::unregisterAudioThread(aaudio_handle_t streamHandle,
325 pid_t clientThreadId) {
326 AAudioServiceInterface *service = getAAudioService();
327 if (!service) {
328 return AAUDIO_ERROR_NO_SERVICE;
329 }
330 return service->unregisterAudioThread(streamHandle, clientThreadId);
331 }
332
333 class OboeserviceFuzzer {
334 public:
335 OboeserviceFuzzer();
336 ~OboeserviceFuzzer() = default;
337 void process(const uint8_t *data, size_t size);
338
339 private:
340 sp<FuzzAAudioClient> mClient;
341 };
342
OboeserviceFuzzer()343 OboeserviceFuzzer::OboeserviceFuzzer() {
344 sp<AAudioService> service = new AAudioService();
345 mClient = new FuzzAAudioClient(service);
346 }
347
process(const uint8_t * data,size_t size)348 void OboeserviceFuzzer::process(const uint8_t *data, size_t size) {
349 FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
350 AAudioStreamRequest request;
351 AAudioStreamConfiguration configurationOutput;
352
353 // Initialize stream request
354 request.getConfiguration().setFormat((audio_format_t)(
355 fdp.ConsumeBool()
356 ? fdp.ConsumeIntegral<int32_t>()
357 : kAAudioFormats[fdp.ConsumeIntegralInRange<int32_t>(0, kNumAAudioFormats - 1)]));
358
359 // TODO b/182392769: use attribution source util
360 android::content::AttributionSourceState attributionSource;
361 attributionSource.uid = getuid();
362 attributionSource.pid = getpid();
363 attributionSource.token = sp<BBinder>::make();
364 request.setAttributionSource(attributionSource);
365 request.setInService(fdp.ConsumeBool());
366
367 request.getConfiguration().setDeviceId(fdp.ConsumeIntegral<int32_t>());
368 request.getConfiguration().setSampleRate(fdp.ConsumeIntegral<int32_t>());
369 request.getConfiguration().setChannelMask((aaudio_channel_mask_t)(
370 fdp.ConsumeBool()
371 ? fdp.ConsumeIntegral<int32_t>()
372 : kAAudioChannelMasks[fdp.ConsumeIntegralInRange<int32_t>(
373 0, kNumAAudioChannelMasks - 1)]));
374 request.getConfiguration().setDirection(
375 fdp.ConsumeBool() ? fdp.ConsumeIntegral<int32_t>()
376 : (fdp.ConsumeBool() ? AAUDIO_DIRECTION_OUTPUT : AAUDIO_DIRECTION_INPUT));
377 request.getConfiguration().setSharingMode(
378 fdp.ConsumeBool()
379 ? fdp.ConsumeIntegral<int32_t>()
380 : (fdp.ConsumeBool() ? AAUDIO_SHARING_MODE_EXCLUSIVE : AAUDIO_SHARING_MODE_SHARED));
381
382 request.getConfiguration().setUsage(
383 fdp.ConsumeBool()
384 ? fdp.ConsumeIntegral<int32_t>()
385 : kAAudioUsages[fdp.ConsumeIntegralInRange<int32_t>(0, kNumAAudioUsages - 1)]);
386 request.getConfiguration().setContentType(
387 fdp.ConsumeBool() ? fdp.ConsumeIntegral<int32_t>()
388 : kAAudioContentTypes[fdp.ConsumeIntegralInRange<int32_t>(
389 0, kNumAAudioContentTypes - 1)]);
390 request.getConfiguration().setInputPreset(
391 fdp.ConsumeBool() ? fdp.ConsumeIntegral<int32_t>()
392 : kAAudioInputPresets[fdp.ConsumeIntegralInRange<int32_t>(
393 0, kNumAAudioInputPresets - 1)]);
394 request.getConfiguration().setPrivacySensitive(fdp.ConsumeBool());
395
396 request.getConfiguration().setBufferCapacity(fdp.ConsumeIntegral<int32_t>());
397
398 aaudio_handle_t stream = mClient->openStream(request, configurationOutput);
399 if (stream < 0) {
400 // invalid request, stream not opened.
401 return;
402 }
403 while (fdp.remaining_bytes()) {
404 AudioEndpointParcelable audioEndpointParcelable;
405 int action = fdp.ConsumeIntegralInRange<int32_t>(0, 4);
406 switch (action) {
407 case 0:
408 mClient->getStreamDescription(stream, audioEndpointParcelable);
409 break;
410 case 1:
411 mClient->startStream(stream);
412 break;
413 case 2:
414 mClient->pauseStream(stream);
415 break;
416 case 3:
417 mClient->stopStream(stream);
418 break;
419 case 4:
420 mClient->flushStream(stream);
421 break;
422 }
423 }
424 mClient->closeStream(stream);
425 assert(mClient->getDeathCount() == 0);
426 }
427
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)428 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
429 if (size < 1) {
430 return 0;
431 }
432 OboeserviceFuzzer oboeserviceFuzzer;
433 oboeserviceFuzzer.process(data, size);
434 return 0;
435 }
436