1 /******************************************************************************
2 *
3 * Copyright (C) 2020 The Android Open Source Project
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 *****************************************************************************
18 */
19
20 #include <binder/Parcel.h>
21 #include <fuzzer/FuzzedDataProvider.h>
22 #include <vibrator/ExternalVibration.h>
23
24 using namespace android;
25
26 constexpr size_t MAX_STRING_LENGTH = 100;
27 constexpr audio_content_type_t AUDIO_CONTENT_TYPE[] = {AUDIO_CONTENT_TYPE_UNKNOWN,
28 AUDIO_CONTENT_TYPE_SPEECH,
29 AUDIO_CONTENT_TYPE_MUSIC,
30 AUDIO_CONTENT_TYPE_MOVIE,
31 AUDIO_CONTENT_TYPE_SONIFICATION};
32 constexpr audio_usage_t AUDIO_USAGE[] = {
33 AUDIO_USAGE_UNKNOWN,
34 AUDIO_USAGE_MEDIA,
35 AUDIO_USAGE_VOICE_COMMUNICATION,
36 AUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING,
37 AUDIO_USAGE_ALARM,
38 AUDIO_USAGE_NOTIFICATION,
39 AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE,
40 AUDIO_USAGE_NOTIFICATION_COMMUNICATION_REQUEST,
41 AUDIO_USAGE_NOTIFICATION_COMMUNICATION_INSTANT,
42 AUDIO_USAGE_NOTIFICATION_COMMUNICATION_DELAYED,
43 AUDIO_USAGE_NOTIFICATION_EVENT,
44 AUDIO_USAGE_ASSISTANCE_ACCESSIBILITY,
45 AUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE,
46 AUDIO_USAGE_ASSISTANCE_SONIFICATION,
47 AUDIO_USAGE_GAME,
48 AUDIO_USAGE_VIRTUAL_SOURCE,
49 AUDIO_USAGE_ASSISTANT,
50 AUDIO_USAGE_CALL_ASSISTANT,
51 AUDIO_USAGE_EMERGENCY,
52 AUDIO_USAGE_SAFETY,
53 AUDIO_USAGE_VEHICLE_STATUS,
54 AUDIO_USAGE_ANNOUNCEMENT,
55 };
56 constexpr audio_source_t AUDIO_SOURCE[] = {
57 AUDIO_SOURCE_DEFAULT, AUDIO_SOURCE_MIC,
58 AUDIO_SOURCE_VOICE_UPLINK, AUDIO_SOURCE_VOICE_DOWNLINK,
59 AUDIO_SOURCE_VOICE_CALL, AUDIO_SOURCE_CAMCORDER,
60 AUDIO_SOURCE_VOICE_RECOGNITION, AUDIO_SOURCE_VOICE_COMMUNICATION,
61 AUDIO_SOURCE_REMOTE_SUBMIX, AUDIO_SOURCE_UNPROCESSED,
62 AUDIO_SOURCE_VOICE_PERFORMANCE, AUDIO_SOURCE_ECHO_REFERENCE,
63 AUDIO_SOURCE_FM_TUNER,
64 };
65 constexpr size_t NUM_AUDIO_CONTENT_TYPE = std::size(AUDIO_CONTENT_TYPE);
66 constexpr size_t NUM_AUDIO_USAGE = std::size(AUDIO_USAGE);
67 constexpr size_t NUM_AUDIO_SOURCE = std::size(AUDIO_SOURCE);
68
69 class TestVibrationController : public os::IExternalVibrationController {
70 public:
TestVibrationController()71 explicit TestVibrationController() {}
onAsBinder()72 IBinder *onAsBinder() override { return nullptr; }
mute(bool * ret)73 binder::Status mute(/*out*/ bool *ret) override {
74 *ret = false;
75 return binder::Status::ok();
76 };
unmute(bool * ret)77 binder::Status unmute(/*out*/ bool *ret) override {
78 *ret = false;
79 return binder::Status::ok();
80 };
81 };
82
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)83 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
84 if (size < 1) {
85 return 0;
86 }
87 FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
88 // Initialize the parameters using FuzzedDataProvider
89 int32_t uid = fdp.ConsumeIntegral<int32_t>();
90 std::string pkg = fdp.ConsumeRandomLengthString(MAX_STRING_LENGTH);
91 audio_attributes_t attributes;
92 attributes.content_type =
93 AUDIO_CONTENT_TYPE[fdp.ConsumeIntegralInRange<uint32_t>(0, NUM_AUDIO_CONTENT_TYPE - 1)];
94 attributes.usage = AUDIO_USAGE[fdp.ConsumeIntegralInRange<uint32_t>(0, NUM_AUDIO_USAGE - 1)];
95 attributes.source = AUDIO_SOURCE[fdp.ConsumeIntegralInRange<uint32_t>(0, NUM_AUDIO_SOURCE - 1)];
96 attributes.flags = static_cast<audio_flags_mask_t>(fdp.ConsumeIntegral<uint32_t>());
97
98 // Create an instance of TestVibrationController
99 sp<TestVibrationController> vibrationController = new TestVibrationController();
100 if (!vibrationController) {
101 return 0;
102 }
103
104 // Set all the parameters in the constructor call
105 sp<os::ExternalVibration> extVibration =
106 new os::ExternalVibration(uid, pkg, attributes, vibrationController);
107 if (!extVibration) {
108 return 0;
109 }
110
111 // Get all the parameters that were previously set
112 extVibration->getUid();
113 extVibration->getPackage();
114 extVibration->getAudioAttributes();
115 extVibration->getController();
116
117 // Set the parameters in a Parcel object and send it to libvibrator
118 // This parcel shall be read by libvibrator
119 Parcel parcel;
120 parcel.writeInt32(uid);
121 parcel.writeString16(String16(pkg.c_str()));
122 parcel.writeStrongBinder(IInterface::asBinder(vibrationController));
123 parcel.setDataPosition(0);
124 extVibration->readFromParcel(&parcel);
125
126 // Send a Parcel to libvibrator
127 // Parameters shall be written to this parcel by libvibrator
128 extVibration->writeToParcel(&parcel);
129 return 0;
130 }
131