1 /*
2  * Copyright (C) 2021 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at:
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  *
16  */
17 
18 #define LOG_TAG "client_interface_fuzzer"
19 
20 #include <fuzzer/FuzzedDataProvider.h>
21 
22 #include "audio_hal_interface/a2dp_encoding.h"
23 #include "audio_hal_interface/hal_version_manager.h"
24 #include "audio_hal_interface/hidl/client_interface_hidl.h"
25 #include "audio_hal_interface/hidl/codec_status_hidl.h"
26 #include "audio_hal_interface/le_audio_software.h"
27 #include "include/btif_av_co.h"
28 #include "osi/include/properties.h"
29 
30 using ::android::hardware::bluetooth::audio::V2_0::AacObjectType;
31 using ::android::hardware::bluetooth::audio::V2_0::AacParameters;
32 using ::android::hardware::bluetooth::audio::V2_0::AacVariableBitRate;
33 using ::android::hardware::bluetooth::audio::V2_0::AptxParameters;
34 using ::android::hardware::bluetooth::audio::V2_0::CodecType;
35 using ::android::hardware::bluetooth::audio::V2_0::LdacChannelMode;
36 using ::android::hardware::bluetooth::audio::V2_0::LdacParameters;
37 using ::android::hardware::bluetooth::audio::V2_0::LdacQualityIndex;
38 using ::android::hardware::bluetooth::audio::V2_0::SbcAllocMethod;
39 using ::android::hardware::bluetooth::audio::V2_0::SbcBlockLength;
40 using ::android::hardware::bluetooth::audio::V2_0::SbcChannelMode;
41 using ::android::hardware::bluetooth::audio::V2_0::SbcNumSubbands;
42 using ::android::hardware::bluetooth::audio::V2_0::SbcParameters;
43 using ::bluetooth::audio::a2dp::update_codec_offloading_capabilities;
44 using ::bluetooth::audio::hidl::AudioConfiguration;
45 using ::bluetooth::audio::hidl::AudioConfiguration_2_1;
46 using ::bluetooth::audio::hidl::BluetoothAudioSinkClientInterface;
47 using ::bluetooth::audio::hidl::BluetoothAudioSourceClientInterface;
48 using ::bluetooth::audio::hidl::PcmParameters;
49 using ::bluetooth::audio::hidl::PcmParameters_2_1;
50 using ::bluetooth::audio::hidl::SampleRate;
51 using ::bluetooth::audio::hidl::SampleRate_2_1;
52 using ::bluetooth::audio::hidl::SessionType;
53 using ::bluetooth::audio::hidl::SessionType_2_1;
54 using ::bluetooth::audio::hidl::codec::A2dpAacToHalConfig;
55 using ::bluetooth::audio::hidl::codec::A2dpAptxToHalConfig;
56 using ::bluetooth::audio::hidl::codec::A2dpCodecToHalBitsPerSample;
57 using ::bluetooth::audio::hidl::codec::A2dpCodecToHalChannelMode;
58 using ::bluetooth::audio::hidl::codec::A2dpCodecToHalSampleRate;
59 using ::bluetooth::audio::hidl::codec::A2dpLdacToHalConfig;
60 using ::bluetooth::audio::hidl::codec::A2dpSbcToHalConfig;
61 using ::bluetooth::audio::hidl::codec::BitsPerSample;
62 using ::bluetooth::audio::hidl::codec::ChannelMode;
63 using ::bluetooth::audio::hidl::codec::CodecConfiguration;
64 using ::bluetooth::audio::hidl::codec::IsCodecOffloadingEnabled;
65 using ::bluetooth::audio::hidl::codec::UpdateOffloadingCapabilities;
66 
67 extern "C" {
android_get_exported_namespace(const char *)68 struct android_namespace_t* android_get_exported_namespace(const char*) {
69   return nullptr;
70 }
71 }
72 
73 constexpr SessionType kSessionTypes[] = {
74     SessionType::UNKNOWN,
75     SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH,
76     SessionType::A2DP_HARDWARE_OFFLOAD_DATAPATH,
77     SessionType::HEARING_AID_SOFTWARE_ENCODING_DATAPATH,
78 };
79 
80 constexpr bluetooth::audio::hidl::BluetoothAudioCtrlAck
81     kBluetoothAudioCtrlAcks[] = {
82         bluetooth::audio::hidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED,
83         bluetooth::audio::hidl::BluetoothAudioCtrlAck::PENDING,
84         bluetooth::audio::hidl::BluetoothAudioCtrlAck::FAILURE_UNSUPPORTED,
85         bluetooth::audio::hidl::BluetoothAudioCtrlAck::FAILURE_BUSY,
86         bluetooth::audio::hidl::BluetoothAudioCtrlAck::FAILURE_DISCONNECTING,
87         bluetooth::audio::hidl::BluetoothAudioCtrlAck::FAILURE};
88 
89 constexpr SessionType_2_1 kSessionTypes_2_1[] = {
90     SessionType_2_1::UNKNOWN,
91     SessionType_2_1::A2DP_SOFTWARE_ENCODING_DATAPATH,
92     SessionType_2_1::A2DP_HARDWARE_OFFLOAD_DATAPATH,
93     SessionType_2_1::HEARING_AID_SOFTWARE_ENCODING_DATAPATH,
94     SessionType_2_1::LE_AUDIO_SOFTWARE_ENCODING_DATAPATH,
95     SessionType_2_1::LE_AUDIO_SOFTWARE_DECODED_DATAPATH,
96     SessionType_2_1::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH,
97     SessionType_2_1::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH,
98 };
99 
100 constexpr SampleRate kSampleRates[] = {
101     SampleRate::RATE_UNKNOWN, SampleRate::RATE_44100, SampleRate::RATE_48000,
102     SampleRate::RATE_88200,   SampleRate::RATE_96000, SampleRate::RATE_176400,
103     SampleRate::RATE_192000,  SampleRate::RATE_16000, SampleRate::RATE_24000};
104 
105 constexpr btav_a2dp_codec_sample_rate_t kBtavSampleRates[] = {
106     BTAV_A2DP_CODEC_SAMPLE_RATE_NONE,   BTAV_A2DP_CODEC_SAMPLE_RATE_44100,
107     BTAV_A2DP_CODEC_SAMPLE_RATE_48000,  BTAV_A2DP_CODEC_SAMPLE_RATE_88200,
108     BTAV_A2DP_CODEC_SAMPLE_RATE_96000,  BTAV_A2DP_CODEC_SAMPLE_RATE_176400,
109     BTAV_A2DP_CODEC_SAMPLE_RATE_192000, BTAV_A2DP_CODEC_SAMPLE_RATE_16000,
110     BTAV_A2DP_CODEC_SAMPLE_RATE_24000};
111 
112 constexpr SampleRate_2_1 kSampleRates_2_1[] = {
113     SampleRate_2_1::RATE_UNKNOWN, SampleRate_2_1::RATE_8000,
114     SampleRate_2_1::RATE_16000,   SampleRate_2_1::RATE_24000,
115     SampleRate_2_1::RATE_32000,   SampleRate_2_1::RATE_44100,
116     SampleRate_2_1::RATE_48000};
117 
118 constexpr BitsPerSample kBitsPerSamples[] = {
119     BitsPerSample::BITS_UNKNOWN, BitsPerSample::BITS_16, BitsPerSample::BITS_24,
120     BitsPerSample::BITS_32};
121 
122 constexpr btav_a2dp_codec_bits_per_sample_t kBtavA2dpCodecBitsPerSample[] = {
123     BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE, BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16,
124     BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24, BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32};
125 
126 constexpr ChannelMode kChannelModes[] = {
127     ChannelMode::UNKNOWN, ChannelMode::MONO, ChannelMode::STEREO};
128 
129 constexpr btav_a2dp_codec_channel_mode_t kBtavA2dpCodecChannelModes[] = {
130     BTAV_A2DP_CODEC_CHANNEL_MODE_NONE, BTAV_A2DP_CODEC_CHANNEL_MODE_MONO,
131     BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO};
132 
133 constexpr uint16_t kPeerMtus[] = {660, 663, 883, 1005, 1500};
134 
135 constexpr btav_a2dp_codec_index_t kCodecIndices[] = {
136     BTAV_A2DP_CODEC_INDEX_SOURCE_SBC,  BTAV_A2DP_CODEC_INDEX_SOURCE_AAC,
137     BTAV_A2DP_CODEC_INDEX_SOURCE_APTX, BTAV_A2DP_CODEC_INDEX_SOURCE_APTX_HD,
138     BTAV_A2DP_CODEC_INDEX_SOURCE_LDAC, BTAV_A2DP_CODEC_INDEX_SINK_SBC,
139     BTAV_A2DP_CODEC_INDEX_SINK_AAC,    BTAV_A2DP_CODEC_INDEX_SINK_LDAC};
140 
141 class TestSinkTransport
142     : public bluetooth::audio::hidl::IBluetoothSinkTransportInstance {
143  private:
144  public:
TestSinkTransport(SessionType session_type)145   TestSinkTransport(SessionType session_type)
146       : bluetooth::audio::hidl::IBluetoothSinkTransportInstance(session_type,
147                                                                 {}){};
148 
TestSinkTransport(SessionType_2_1 session_type_2_1)149   TestSinkTransport(SessionType_2_1 session_type_2_1)
150       : bluetooth::audio::hidl::IBluetoothSinkTransportInstance(
151             session_type_2_1, (AudioConfiguration_2_1){}){};
152 
StartRequest()153   bluetooth::audio::hidl::BluetoothAudioCtrlAck StartRequest() override {
154     return bluetooth::audio::hidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED;
155   }
156 
SuspendRequest()157   bluetooth::audio::hidl::BluetoothAudioCtrlAck SuspendRequest() override {
158     return bluetooth::audio::hidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED;
159   }
160 
StopRequest()161   void StopRequest() override {}
162 
GetPresentationPosition(uint64_t *,uint64_t *,timespec *)163   bool GetPresentationPosition(uint64_t*, uint64_t*, timespec*) override {
164     return true;
165   }
166 
MetadataChanged(const source_metadata_t &)167   void MetadataChanged(const source_metadata_t&) override {}
168 
ResetPresentationPosition()169   void ResetPresentationPosition() override{};
170 
LogBytesRead(size_t)171   void LogBytesRead(size_t) override{};
172 };
173 
174 class TestSourceTransport
175     : public bluetooth::audio::hidl::IBluetoothSourceTransportInstance {
176  private:
177  public:
TestSourceTransport(SessionType session_type)178   TestSourceTransport(SessionType session_type)
179       : bluetooth::audio::hidl::IBluetoothSourceTransportInstance(session_type,
180                                                                   {}){};
181 
TestSourceTransport(SessionType_2_1 session_type_2_1)182   TestSourceTransport(SessionType_2_1 session_type_2_1)
183       : bluetooth::audio::hidl::IBluetoothSourceTransportInstance(
184             session_type_2_1, (AudioConfiguration_2_1){}){};
185 
StartRequest()186   bluetooth::audio::hidl::BluetoothAudioCtrlAck StartRequest() override {
187     return bluetooth::audio::hidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED;
188   }
189 
SuspendRequest()190   bluetooth::audio::hidl::BluetoothAudioCtrlAck SuspendRequest() override {
191     return bluetooth::audio::hidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED;
192   }
193 
StopRequest()194   void StopRequest() override {}
195 
GetPresentationPosition(uint64_t *,uint64_t *,timespec *)196   bool GetPresentationPosition(uint64_t*, uint64_t*, timespec*) override {
197     return true;
198   }
199 
MetadataChanged(const source_metadata_t &)200   void MetadataChanged(const source_metadata_t&) override {}
201 
ResetPresentationPosition()202   void ResetPresentationPosition() override{};
203 
LogBytesWritten(size_t)204   void LogBytesWritten(size_t) override{};
205 };
206 
207 class ClientInterfaceFuzzer {
208  public:
~ClientInterfaceFuzzer()209   ~ClientInterfaceFuzzer() {
210     delete (mFdp);
211     delete (mTestSinkTransport);
212     delete (mTestSourceTransport);
213     delete (mClientIfSink);
214     delete (mClientIfSource);
215   }
216   void process(const uint8_t* data, size_t size);
217 
218  private:
219   FuzzedDataProvider* mFdp = nullptr;
220   TestSinkTransport* mTestSinkTransport = nullptr;
221   TestSourceTransport* mTestSourceTransport = nullptr;
222   BluetoothAudioSinkClientInterface* mClientIfSink = nullptr;
223   BluetoothAudioSourceClientInterface* mClientIfSource = nullptr;
224 };
225 
SbcCodecConfigurationsGenerator(FuzzedDataProvider * mFdp)226 static CodecConfiguration SbcCodecConfigurationsGenerator(
227     FuzzedDataProvider* mFdp) {
228   SbcNumSubbands numSubbands[] = {SbcNumSubbands::SUBBAND_4,
229                                   SbcNumSubbands::SUBBAND_8};
230 
231   SbcAllocMethod allocMethods[] = {SbcAllocMethod::ALLOC_MD_S,
232                                    SbcAllocMethod::ALLOC_MD_L};
233 
234   SbcChannelMode channelModes[] = {
235       SbcChannelMode::UNKNOWN, SbcChannelMode::JOINT_STEREO,
236       SbcChannelMode::STEREO,  SbcChannelMode::DUAL,
237       SbcChannelMode::MONO,
238   };
239 
240   SbcBlockLength blockLengths[] = {
241       SbcBlockLength::BLOCKS_4, SbcBlockLength::BLOCKS_8,
242       SbcBlockLength::BLOCKS_12, SbcBlockLength::BLOCKS_16};
243 
244   SbcParameters sbc = {};
245   sbc.sampleRate = mFdp->PickValueInArray(kSampleRates);
246   sbc.channelMode = mFdp->PickValueInArray(channelModes);
247   sbc.blockLength = mFdp->PickValueInArray(blockLengths);
248   sbc.numSubbands = mFdp->PickValueInArray(numSubbands);
249   sbc.allocMethod = mFdp->PickValueInArray(allocMethods);
250   sbc.bitsPerSample = mFdp->PickValueInArray(kBitsPerSamples);
251   sbc.minBitpool = mFdp->ConsumeIntegral<uint8_t>();
252   sbc.maxBitpool = mFdp->ConsumeIntegral<uint8_t>();
253 
254   CodecConfiguration codecConfig = {};
255   codecConfig.config.sbcConfig(sbc);
256   codecConfig.codecType = CodecType::SBC;
257   codecConfig.peerMtu = mFdp->PickValueInArray(kPeerMtus);
258   codecConfig.isScmstEnabled = mFdp->ConsumeBool();
259   codecConfig.encodedAudioBitrate = mFdp->ConsumeIntegral<uint32_t>();
260 
261   return codecConfig;
262 }
263 
AacCodecConfigurationsGenerator(FuzzedDataProvider * mFdp)264 static CodecConfiguration AacCodecConfigurationsGenerator(
265     FuzzedDataProvider* mFdp) {
266   AacObjectType objectTypes[] = {
267       AacObjectType::MPEG2_LC, AacObjectType::MPEG4_LC,
268       AacObjectType::MPEG4_LTP, AacObjectType::MPEG4_SCALABLE};
269 
270   AacVariableBitRate variableBitrates[] = {AacVariableBitRate::DISABLED,
271                                            AacVariableBitRate::ENABLED};
272 
273   AacParameters aac = {};
274   aac.objectType = mFdp->PickValueInArray(objectTypes);
275   aac.sampleRate = mFdp->PickValueInArray(kSampleRates);
276   aac.channelMode = mFdp->PickValueInArray(kChannelModes);
277   aac.variableBitRateEnabled = mFdp->PickValueInArray(variableBitrates);
278   aac.bitsPerSample = mFdp->PickValueInArray(kBitsPerSamples);
279 
280   CodecConfiguration codecConfig = {};
281   codecConfig.config.aacConfig(aac);
282   codecConfig.codecType = CodecType::AAC;
283   codecConfig.peerMtu = mFdp->PickValueInArray(kPeerMtus);
284   codecConfig.isScmstEnabled = mFdp->ConsumeBool();
285   codecConfig.encodedAudioBitrate = mFdp->ConsumeIntegral<uint32_t>();
286 
287   return codecConfig;
288 }
289 
LdacCodecConfigurationsGenerator(FuzzedDataProvider * mFdp)290 static CodecConfiguration LdacCodecConfigurationsGenerator(
291     FuzzedDataProvider* mFdp) {
292   LdacQualityIndex qualityIndexes[] = {
293       LdacQualityIndex::QUALITY_HIGH, LdacQualityIndex::QUALITY_MID,
294       LdacQualityIndex::QUALITY_LOW, LdacQualityIndex::QUALITY_ABR};
295 
296   LdacChannelMode kChannelModes[] = {
297       LdacChannelMode::UNKNOWN,
298       LdacChannelMode::STEREO,
299       LdacChannelMode::DUAL,
300       LdacChannelMode::MONO,
301   };
302 
303   LdacParameters ldac = {};
304   ldac.sampleRate = mFdp->PickValueInArray(kSampleRates);
305   ldac.channelMode = mFdp->PickValueInArray(kChannelModes);
306   ldac.qualityIndex = mFdp->PickValueInArray(qualityIndexes);
307   ldac.bitsPerSample = mFdp->PickValueInArray(kBitsPerSamples);
308 
309   CodecConfiguration codecConfig = {};
310   codecConfig.config.ldacConfig(ldac);
311   codecConfig.codecType = CodecType::LDAC;
312   codecConfig.peerMtu = mFdp->PickValueInArray(kPeerMtus);
313   codecConfig.isScmstEnabled = mFdp->ConsumeBool();
314   codecConfig.encodedAudioBitrate = mFdp->ConsumeIntegral<uint32_t>();
315 
316   return codecConfig;
317 }
318 
AptxCodecConfigurationsGenerator(FuzzedDataProvider * mFdp)319 static CodecConfiguration AptxCodecConfigurationsGenerator(
320     FuzzedDataProvider* mFdp) {
321   CodecType codecTypes[] = {CodecType::APTX, CodecType::APTX_HD};
322 
323   AptxParameters aptx = {};
324   aptx.sampleRate = mFdp->PickValueInArray(kSampleRates);
325   aptx.channelMode = mFdp->PickValueInArray(kChannelModes);
326   aptx.bitsPerSample = mFdp->PickValueInArray(kBitsPerSamples);
327 
328   CodecConfiguration codecConfig = {};
329   codecConfig.config.aptxConfig(aptx);
330   codecConfig.codecType = mFdp->PickValueInArray(codecTypes);
331   codecConfig.peerMtu = mFdp->PickValueInArray(kPeerMtus);
332   codecConfig.isScmstEnabled = mFdp->ConsumeBool();
333   codecConfig.encodedAudioBitrate = mFdp->ConsumeIntegral<uint32_t>();
334 
335   return codecConfig;
336 }
337 
338 std::vector<std::vector<btav_a2dp_codec_config_t>>
CodecOffloadingPreferenceGenerator()339 CodecOffloadingPreferenceGenerator() {
340   std::vector<std::vector<btav_a2dp_codec_config_t>> offloadingPreferences = {
341       std::vector<btav_a2dp_codec_config_t>(0)};
342   btav_a2dp_codec_config_t a2dpCodecConfig = {};
343   for (btav_a2dp_codec_index_t i : kCodecIndices) {
344     a2dpCodecConfig.codec_type = i;
345     auto duplicated_preferences = offloadingPreferences;
346     for (auto iter = duplicated_preferences.begin();
347          iter != duplicated_preferences.end(); ++iter) {
348       iter->push_back(a2dpCodecConfig);
349     }
350     offloadingPreferences.insert(offloadingPreferences.end(),
351                                  duplicated_preferences.begin(),
352                                  duplicated_preferences.end());
353   }
354   return offloadingPreferences;
355 }
356 
process(const uint8_t * data,size_t size)357 void ClientInterfaceFuzzer::process(const uint8_t* data, size_t size) {
358   mFdp = new FuzzedDataProvider(data, size);
359   osi_property_set("persist.bluetooth.a2dp_offload.disabled",
360                    mFdp->PickValueInArray({"true", "false"}));
361 
362   btav_a2dp_codec_config_t a2dpCodecConfig = {};
363   a2dpCodecConfig.sample_rate = mFdp->PickValueInArray(kBtavSampleRates);
364   a2dpCodecConfig.bits_per_sample =
365       mFdp->PickValueInArray(kBtavA2dpCodecBitsPerSample);
366   a2dpCodecConfig.channel_mode =
367       mFdp->PickValueInArray(kBtavA2dpCodecChannelModes);
368 
369   A2dpCodecToHalSampleRate(a2dpCodecConfig);
370   A2dpCodecToHalBitsPerSample(a2dpCodecConfig);
371   A2dpCodecToHalChannelMode(a2dpCodecConfig);
372 
373   SessionType sessionType;
374   SessionType_2_1 sessionType_2_1;
375 
376   bool isSessionType_2_1 = mFdp->ConsumeBool();
377   if (isSessionType_2_1) {
378     sessionType_2_1 = mFdp->PickValueInArray(kSessionTypes_2_1);
379     mTestSinkTransport = new TestSinkTransport(sessionType_2_1);
380     mTestSourceTransport = new TestSourceTransport(sessionType_2_1);
381   } else {
382     sessionType = mFdp->PickValueInArray(kSessionTypes);
383     mTestSinkTransport = new TestSinkTransport(sessionType);
384     mTestSourceTransport = new TestSourceTransport(sessionType);
385   }
386 
387   mClientIfSink =
388       new BluetoothAudioSinkClientInterface(mTestSinkTransport, nullptr);
389   mClientIfSink->GetTransportInstance();
390   mClientIfSink->IsValid();
391 
392   mClientIfSource =
393       new BluetoothAudioSourceClientInterface(mTestSourceTransport, nullptr);
394   mClientIfSource->IsValid();
395 
396   CodecConfiguration codecConfig = {};
397   switch (mFdp->ConsumeIntegralInRange<int>(1, 4)) {
398     case 1:
399       codecConfig = SbcCodecConfigurationsGenerator(mFdp);
400       break;
401     case 2:
402       codecConfig = AacCodecConfigurationsGenerator(mFdp);
403       break;
404     case 3:
405       codecConfig = LdacCodecConfigurationsGenerator(mFdp);
406       break;
407     default:
408       codecConfig = AptxCodecConfigurationsGenerator(mFdp);
409       break;
410   }
411 
412   if ((!isSessionType_2_1) &&
413       (sessionType == SessionType::A2DP_HARDWARE_OFFLOAD_DATAPATH)) {
414     for (auto codec_offloading_preference :
415          CodecOffloadingPreferenceGenerator()) {
416       UpdateOffloadingCapabilities(codec_offloading_preference);
417       update_codec_offloading_capabilities(codec_offloading_preference, false);
418     }
419     IsCodecOffloadingEnabled(codecConfig);
420   }
421 
422   if (isSessionType_2_1) {
423     PcmParameters_2_1 pcmConfig = {};
424     pcmConfig.sampleRate = mFdp->PickValueInArray(kSampleRates_2_1);
425     pcmConfig.bitsPerSample = mFdp->PickValueInArray(kBitsPerSamples);
426     pcmConfig.channelMode = mFdp->PickValueInArray(kChannelModes);
427 
428     AudioConfiguration_2_1 audioConfig = {};
429     audioConfig.pcmConfig(pcmConfig);
430     audioConfig.codecConfig(codecConfig);
431 
432     mClientIfSink->StartSession_2_1();
433     mClientIfSink->GetAudioCapabilities_2_1();
434     mClientIfSink->GetAudioCapabilities_2_1(sessionType_2_1);
435     mClientIfSink->UpdateAudioConfig_2_1(audioConfig);
436   } else {
437     PcmParameters pcmConfig = {};
438     pcmConfig.sampleRate = mFdp->PickValueInArray(kSampleRates);
439     pcmConfig.bitsPerSample = mFdp->PickValueInArray(kBitsPerSamples);
440     pcmConfig.channelMode = mFdp->PickValueInArray(kChannelModes);
441 
442     AudioConfiguration audioConfig = {};
443     audioConfig.pcmConfig(pcmConfig);
444     audioConfig.codecConfig(codecConfig);
445 
446     mClientIfSink->StartSession();
447     mClientIfSink->GetAudioCapabilities();
448     mClientIfSink->GetAudioCapabilities(sessionType);
449     mClientIfSink->UpdateAudioConfig(audioConfig);
450   }
451 
452   if (((bluetooth::audio::HalVersionManager::GetHalVersion() ==
453         bluetooth::audio::BluetoothAudioHalVersion::VERSION_2_1) &&
454        (mTestSinkTransport->GetSessionType_2_1() !=
455         SessionType_2_1::UNKNOWN)) ||
456       (mTestSinkTransport->GetSessionType() != SessionType::UNKNOWN)) {
457     mClientIfSink->RenewAudioProviderAndSession();
458   }
459 
460   mClientIfSink->StreamStarted(mFdp->PickValueInArray(kBluetoothAudioCtrlAcks));
461   mClientIfSink->StreamSuspended(
462       mFdp->PickValueInArray(kBluetoothAudioCtrlAcks));
463   mClientIfSink->EndSession();
464 }
465 
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)466 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
467   ClientInterfaceFuzzer clientInterfaceFuzzer;
468   clientInterfaceFuzzer.process(data, size);
469   return 0;
470 }
471