1 /*
2  * Copyright (C) 2021 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at:
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  *
16  */
17 
18 /**
19  * NOTE
20  * 1) The input to AudioFlinger binder calls are fuzzed in this fuzzer
21  * 2) AudioFlinger crashes due to the fuzzer are detected by the
22       Binder DeathRecipient, where the fuzzer aborts if AudioFlinger dies
23  */
24 
25 #include <android_audio_policy_configuration_V7_0-enums.h>
26 #include <android/content/AttributionSourceState.h>
27 #include <binder/IServiceManager.h>
28 #include <binder/MemoryDealer.h>
29 #include <media/AidlConversion.h>
30 #include <media/AudioEffect.h>
31 #include <media/AudioRecord.h>
32 #include <media/AudioSystem.h>
33 #include <media/AudioTrack.h>
34 #include <media/IAudioFlinger.h>
35 #include "fuzzer/FuzzedDataProvider.h"
36 
37 #define MAX_STRING_LENGTH 256
38 #define MAX_ARRAY_LENGTH 256
39 
40 constexpr int32_t kMinSampleRateHz = 4000;
41 constexpr int32_t kMaxSampleRateHz = 192000;
42 constexpr int32_t kSampleRateUnspecified = 0;
43 
44 using namespace std;
45 using namespace android;
46 
47 namespace xsd {
48 using namespace ::android::audio::policy::configuration::V7_0;
49 }
50 
51 using android::content::AttributionSourceState;
52 
53 constexpr audio_unique_id_use_t kUniqueIds[] = {
54     AUDIO_UNIQUE_ID_USE_UNSPECIFIED, AUDIO_UNIQUE_ID_USE_SESSION, AUDIO_UNIQUE_ID_USE_MODULE,
55     AUDIO_UNIQUE_ID_USE_EFFECT,      AUDIO_UNIQUE_ID_USE_PATCH,   AUDIO_UNIQUE_ID_USE_OUTPUT,
56     AUDIO_UNIQUE_ID_USE_INPUT,       AUDIO_UNIQUE_ID_USE_CLIENT,  AUDIO_UNIQUE_ID_USE_MAX,
57 };
58 
59 constexpr audio_mode_t kModes[] = {
60     AUDIO_MODE_INVALID, AUDIO_MODE_CURRENT,          AUDIO_MODE_NORMAL,     AUDIO_MODE_RINGTONE,
61     AUDIO_MODE_IN_CALL, AUDIO_MODE_IN_COMMUNICATION, AUDIO_MODE_CALL_SCREEN,
62     AUDIO_MODE_CALL_REDIRECT, AUDIO_MODE_COMMUNICATION_REDIRECT};
63 
64 constexpr audio_session_t kSessionId[] = {AUDIO_SESSION_NONE, AUDIO_SESSION_OUTPUT_STAGE,
65                                           AUDIO_SESSION_DEVICE};
66 
67 constexpr audio_encapsulation_mode_t kEncapsulation[] = {
68     AUDIO_ENCAPSULATION_MODE_NONE,
69     AUDIO_ENCAPSULATION_MODE_ELEMENTARY_STREAM,
70     AUDIO_ENCAPSULATION_MODE_HANDLE,
71 };
72 
73 constexpr audio_port_role_t kPortRoles[] = {
74     AUDIO_PORT_ROLE_NONE,
75     AUDIO_PORT_ROLE_SOURCE,
76     AUDIO_PORT_ROLE_SINK,
77 };
78 
79 constexpr audio_port_type_t kPortTypes[] = {
80     AUDIO_PORT_TYPE_NONE,
81     AUDIO_PORT_TYPE_DEVICE,
82     AUDIO_PORT_TYPE_MIX,
83     AUDIO_PORT_TYPE_SESSION,
84 };
85 
86 template <typename T, typename X, typename FUNC>
getFlags(const xsdc_enum_range<X> & range,const FUNC & func,const std::string & findString={},const std::set<X> & excludedValues={})87 std::vector<T> getFlags(const xsdc_enum_range<X>& range, const FUNC& func,
88                         const std::string& findString = {},
89                         const std::set<X>& excludedValues = {}) {
90     std::vector<T> vec;
91     for (const auto &xsdEnumVal : range) {
92         T enumVal;
93         std::string enumString = toString(xsdEnumVal);
94         if (enumString.find(findString) != std::string::npos &&
95             (excludedValues.find(xsdEnumVal) == excludedValues.end()) &&
96             func(enumString.c_str(), &enumVal)) {
97             vec.push_back(enumVal);
98         }
99     }
100     return vec;
101 }
102 
103 static const std::vector<audio_stream_type_t> kStreamtypes =
104     getFlags<audio_stream_type_t, xsd::AudioStreamType, decltype(audio_stream_type_from_string)>(
105         xsdc_enum_range<xsd::AudioStreamType>{}, audio_stream_type_from_string);
106 
107 /**
108  * AudioFormat - AUDIO_FORMAT_HE_AAC_V1 and AUDIO_FORMAT_HE_AAC_V2
109  * are excluded from kFormats[] in order to avoid the abort triggered
110  * for these two types of AudioFormat in
111  * AidlConversion::legacy2aidl_audio_format_t_AudioFormatDescription()
112  */
113 static const std::vector<audio_format_t> kFormats =
114         getFlags<audio_format_t, xsd::AudioFormat, decltype(audio_format_from_string)>(
115                 xsdc_enum_range<xsd::AudioFormat>{}, audio_format_from_string, {},
116                 {xsd::AudioFormat::AUDIO_FORMAT_HE_AAC_V1,
117                  xsd::AudioFormat::AUDIO_FORMAT_HE_AAC_V2});
118 
119 /**
120  * AudioChannelMask - AUDIO_CHANNEL_IN_6
121  * is excluded from kChannelMasks[] in order to avoid the abort triggered
122  * for this type of AudioChannelMask in
123  * AidlConversion::legacy2aidl_audio_channel_mask_t_AudioChannelLayout()
124  */
125 static const std::vector<audio_channel_mask_t> kChannelMasks =
126         getFlags<audio_channel_mask_t, xsd::AudioChannelMask,
127                  decltype(audio_channel_mask_from_string)>(
128                 xsdc_enum_range<xsd::AudioChannelMask>{}, audio_channel_mask_from_string, {},
129                 {xsd::AudioChannelMask::AUDIO_CHANNEL_IN_6});
130 
131 static const std::vector<audio_usage_t> kUsages =
132     getFlags<audio_usage_t, xsd::AudioUsage, decltype(audio_usage_from_string)>(
133         xsdc_enum_range<xsd::AudioUsage>{}, audio_usage_from_string);
134 
135 static const std::vector<audio_content_type_t> kContentType =
136     getFlags<audio_content_type_t, xsd::AudioContentType, decltype(audio_content_type_from_string)>(
137         xsdc_enum_range<xsd::AudioContentType>{}, audio_content_type_from_string);
138 
139 static const std::vector<audio_source_t> kInputSources =
140     getFlags<audio_source_t, xsd::AudioSource, decltype(audio_source_from_string)>(
141         xsdc_enum_range<xsd::AudioSource>{}, audio_source_from_string);
142 
143 static const std::vector<audio_gain_mode_t> kGainModes =
144     getFlags<audio_gain_mode_t, xsd::AudioGainMode, decltype(audio_gain_mode_from_string)>(
145         xsdc_enum_range<xsd::AudioGainMode>{}, audio_gain_mode_from_string);
146 
147 /**
148  * AudioDevice - AUDIO_DEVICE_IN_AMBIENT and AUDIO_DEVICE_IN_COMMUNICATION
149  * are excluded from kDevices[] in order to avoid the abort triggered
150  * for these two types of AudioDevice in
151  * AidlConversion::aidl2legacy_AudioDeviceDescription_audio_devices_t()
152  */
153 static const std::vector<audio_devices_t> kDevices =
154         getFlags<audio_devices_t, xsd::AudioDevice, decltype(audio_device_from_string)>(
155                 xsdc_enum_range<xsd::AudioDevice>{}, audio_device_from_string, {},
156                 {xsd::AudioDevice::AUDIO_DEVICE_IN_AMBIENT,
157                  xsd::AudioDevice::AUDIO_DEVICE_IN_COMMUNICATION});
158 
159 static const std::vector<audio_input_flags_t> kInputFlags =
160     getFlags<audio_input_flags_t, xsd::AudioInOutFlag, decltype(audio_input_flag_from_string)>(
161         xsdc_enum_range<xsd::AudioInOutFlag>{}, audio_input_flag_from_string, "_INPUT_");
162 
163 static const std::vector<audio_output_flags_t> kOutputFlags =
164     getFlags<audio_output_flags_t, xsd::AudioInOutFlag, decltype(audio_output_flag_from_string)>(
165         xsdc_enum_range<xsd::AudioInOutFlag>{}, audio_output_flag_from_string, "_OUTPUT_");
166 
167 template <typename T, size_t size>
getValue(FuzzedDataProvider * fdp,const T (& arr)[size])168 T getValue(FuzzedDataProvider *fdp, const T (&arr)[size]) {
169     return arr[fdp->ConsumeIntegralInRange<int32_t>(0, size - 1)];
170 }
171 
172 template <typename T>
getValue(FuzzedDataProvider * fdp,std::vector<T> vec)173 T getValue(FuzzedDataProvider *fdp, std::vector<T> vec) {
174     return vec[fdp->ConsumeIntegralInRange<int32_t>(0, vec.size() - 1)];
175 }
176 
getSampleRate(FuzzedDataProvider * fdp)177 int32_t getSampleRate(FuzzedDataProvider *fdp) {
178     if (fdp->ConsumeBool()) {
179         return fdp->ConsumeIntegralInRange<int32_t>(kMinSampleRateHz, kMaxSampleRateHz);
180     }
181     return kSampleRateUnspecified;
182 }
183 
184 class DeathNotifier : public IBinder::DeathRecipient {
185    public:
binderDied(const wp<IBinder> &)186     void binderDied(const wp<IBinder> &) { abort(); }
187 };
188 
189 class AudioFlingerFuzzer {
190    public:
191     AudioFlingerFuzzer(const uint8_t *data, size_t size);
192     void process();
193 
194    private:
195     FuzzedDataProvider mFdp;
196     void invokeAudioTrack();
197     void invokeAudioRecord();
198     status_t invokeAudioEffect();
199     void invokeAudioSystem();
200     status_t invokeAudioInputDevice();
201     status_t invokeAudioOutputDevice();
202     void invokeAudioPatch();
203 
204     sp<DeathNotifier> mDeathNotifier;
205 };
206 
AudioFlingerFuzzer(const uint8_t * data,size_t size)207 AudioFlingerFuzzer::AudioFlingerFuzzer(const uint8_t *data, size_t size) : mFdp(data, size) {
208     sp<IServiceManager> sm = defaultServiceManager();
209     sp<IBinder> binder = sm->getService(String16("media.audio_flinger"));
210     if (binder == nullptr) {
211         return;
212     }
213     mDeathNotifier = new DeathNotifier();
214     binder->linkToDeath(mDeathNotifier);
215 }
216 
invokeAudioTrack()217 void AudioFlingerFuzzer::invokeAudioTrack() {
218     uint32_t sampleRate = getSampleRate(&mFdp);
219     audio_format_t format = getValue(&mFdp, kFormats);
220     audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
221     size_t frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
222     int32_t notificationFrames = mFdp.ConsumeIntegral<int32_t>();
223     uint32_t useSharedBuffer = mFdp.ConsumeBool();
224     audio_output_flags_t flags = getValue(&mFdp, kOutputFlags);
225     audio_session_t sessionId = getValue(&mFdp, kSessionId);
226     audio_usage_t usage = getValue(&mFdp, kUsages);
227     audio_content_type_t contentType = getValue(&mFdp, kContentType);
228     audio_attributes_t attributes = {};
229     sp<IMemory> sharedBuffer;
230     sp<MemoryDealer> heap = nullptr;
231     audio_offload_info_t offloadInfo = AUDIO_INFO_INITIALIZER;
232 
233     bool offload = false;
234     bool fast = ((flags & AUDIO_OUTPUT_FLAG_FAST) != 0);
235 
236     if (useSharedBuffer != 0) {
237         size_t heapSize = audio_channel_count_from_out_mask(channelMask) *
238                           audio_bytes_per_sample(format) * frameCount;
239         heap = new MemoryDealer(heapSize, "AudioTrack Heap Base");
240         sharedBuffer = heap->allocate(heapSize);
241         frameCount = 0;
242         notificationFrames = 0;
243     }
244     if ((flags & AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD) != 0) {
245         offloadInfo.sample_rate = sampleRate;
246         offloadInfo.channel_mask = channelMask;
247         offloadInfo.format = format;
248         offload = true;
249     }
250 
251     attributes.content_type = contentType;
252     attributes.usage = usage;
253     sp<AudioTrack> track = new AudioTrack();
254 
255     // TODO b/182392769: use attribution source util
256     AttributionSourceState attributionSource;
257     attributionSource.uid = VALUE_OR_FATAL(legacy2aidl_uid_t_int32_t(getuid()));
258     attributionSource.pid = VALUE_OR_FATAL(legacy2aidl_pid_t_int32_t(getpid()));
259     attributionSource.token = sp<BBinder>::make();
260     track->set(AUDIO_STREAM_DEFAULT, sampleRate, format, channelMask, frameCount, flags, nullptr,
261                notificationFrames, sharedBuffer, false, sessionId,
262                ((fast && sharedBuffer == 0) || offload) ? AudioTrack::TRANSFER_CALLBACK
263                                                         : AudioTrack::TRANSFER_DEFAULT,
264                offload ? &offloadInfo : nullptr, attributionSource, &attributes, false, 1.0f,
265                AUDIO_PORT_HANDLE_NONE);
266 
267     status_t status = track->initCheck();
268     if (status != NO_ERROR) {
269         track.clear();
270         return;
271     }
272     track->getSampleRate();
273     track->latency();
274     track->getUnderrunCount();
275     track->streamType();
276     track->channelCount();
277     track->getNotificationPeriodInFrames();
278     uint32_t bufferSizeInFrames = mFdp.ConsumeIntegral<uint32_t>();
279     track->setBufferSizeInFrames(bufferSizeInFrames);
280     track->getBufferSizeInFrames();
281 
282     int64_t duration = mFdp.ConsumeIntegral<int64_t>();
283     track->getBufferDurationInUs(&duration);
284     sp<IMemory> sharedBuffer2 = track->sharedBuffer();
285     track->setCallerName(mFdp.ConsumeRandomLengthString(MAX_STRING_LENGTH));
286 
287     track->setVolume(mFdp.ConsumeFloatingPoint<float>(), mFdp.ConsumeFloatingPoint<float>());
288     track->setVolume(mFdp.ConsumeFloatingPoint<float>());
289     track->setAuxEffectSendLevel(mFdp.ConsumeFloatingPoint<float>());
290 
291     float auxEffectSendLevel;
292     track->getAuxEffectSendLevel(&auxEffectSendLevel);
293     track->setSampleRate(getSampleRate(&mFdp));
294     track->getSampleRate();
295     track->getOriginalSampleRate();
296 
297     AudioPlaybackRate playbackRate = {};
298     playbackRate.mSpeed = mFdp.ConsumeFloatingPoint<float>();
299     playbackRate.mPitch = mFdp.ConsumeFloatingPoint<float>();
300     track->setPlaybackRate(playbackRate);
301     track->getPlaybackRate();
302     track->setLoop(mFdp.ConsumeIntegral<uint32_t>(), mFdp.ConsumeIntegral<uint32_t>(),
303                    mFdp.ConsumeIntegral<uint32_t>());
304     track->setMarkerPosition(mFdp.ConsumeIntegral<uint32_t>());
305 
306     uint32_t marker = {};
307     track->getMarkerPosition(&marker);
308     track->setPositionUpdatePeriod(mFdp.ConsumeIntegral<uint32_t>());
309 
310     uint32_t updatePeriod = {};
311     track->getPositionUpdatePeriod(&updatePeriod);
312     track->setPosition(mFdp.ConsumeIntegral<uint32_t>());
313     uint32_t position = {};
314     track->getPosition(&position);
315     track->getBufferPosition(&position);
316     track->reload();
317     track->start();
318     track->pause();
319     track->flush();
320     track->stop();
321     track->stopped();
322 }
323 
invokeAudioRecord()324 void AudioFlingerFuzzer::invokeAudioRecord() {
325     int32_t notificationFrames = mFdp.ConsumeIntegral<int32_t>();
326     uint32_t sampleRate = getSampleRate(&mFdp);
327     size_t frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
328     audio_format_t format = getValue(&mFdp, kFormats);
329     audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
330     audio_input_flags_t flags = getValue(&mFdp, kInputFlags);
331     audio_session_t sessionId = getValue(&mFdp, kSessionId);
332     audio_source_t inputSource = getValue(&mFdp, kInputSources);
333 
334     audio_attributes_t attributes = {};
335     bool fast = ((flags & AUDIO_OUTPUT_FLAG_FAST) != 0);
336 
337     attributes.source = inputSource;
338 
339     // TODO b/182392769: use attribution source util
340     AttributionSourceState attributionSource;
341     attributionSource.packageName = std::string(mFdp.ConsumeRandomLengthString().c_str());
342     attributionSource.token = sp<BBinder>::make();
343     sp<AudioRecord> record = new AudioRecord(attributionSource);
344     record->set(AUDIO_SOURCE_DEFAULT, sampleRate, format, channelMask, frameCount, nullptr,
345                 notificationFrames, false, sessionId,
346                 fast ? AudioRecord::TRANSFER_CALLBACK : AudioRecord::TRANSFER_DEFAULT, flags,
347                 getuid(), getpid(), &attributes, AUDIO_PORT_HANDLE_NONE);
348     status_t status = record->initCheck();
349     if (status != NO_ERROR) {
350         return;
351     }
352     record->latency();
353     record->format();
354     record->channelCount();
355     record->frameCount();
356     record->frameSize();
357     record->inputSource();
358     record->getNotificationPeriodInFrames();
359     record->start();
360     record->stop();
361     record->stopped();
362 
363     uint32_t marker = mFdp.ConsumeIntegral<uint32_t>();
364     record->setMarkerPosition(marker);
365     record->getMarkerPosition(&marker);
366 
367     uint32_t updatePeriod = mFdp.ConsumeIntegral<uint32_t>();
368     record->setPositionUpdatePeriod(updatePeriod);
369     record->getPositionUpdatePeriod(&updatePeriod);
370 
371     uint32_t position;
372     record->getPosition(&position);
373 
374     ExtendedTimestamp timestamp;
375     record->getTimestamp(&timestamp);
376     record->getSessionId();
377     record->getCallerName();
378     android::AudioRecord::Buffer audioBuffer;
379     int32_t waitCount = mFdp.ConsumeIntegral<int32_t>();
380     size_t nonContig = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
381     audioBuffer.frameCount = static_cast<size_t>(mFdp.ConsumeIntegral<uint32_t>());
382     record->obtainBuffer(&audioBuffer, waitCount, &nonContig);
383     bool blocking = false;
384     record->read(audioBuffer.data(), audioBuffer.size(), blocking);
385     record->getInputFramesLost();
386     record->getFlags();
387 
388     std::vector<media::MicrophoneInfoFw> activeMicrophones;
389     record->getActiveMicrophones(&activeMicrophones);
390     record->releaseBuffer(&audioBuffer);
391 
392     audio_port_handle_t deviceId =
393         static_cast<audio_port_handle_t>(mFdp.ConsumeIntegral<int32_t>());
394     record->setInputDevice(deviceId);
395     record->getInputDevice();
396     record->getRoutedDeviceId();
397     record->getPortId();
398 }
399 
400 struct EffectClient : public android::media::BnEffectClient {
EffectClientEffectClient401     EffectClient() {}
controlStatusChangedEffectClient402     binder::Status controlStatusChanged(bool controlGranted __unused) override {
403         return binder::Status::ok();
404     }
enableStatusChangedEffectClient405     binder::Status enableStatusChanged(bool enabled __unused) override {
406         return binder::Status::ok();
407     }
commandExecutedEffectClient408     binder::Status commandExecuted(int32_t cmdCode __unused,
409                                    const std::vector<uint8_t> &cmdData __unused,
410                                    const std::vector<uint8_t> &replyData __unused) override {
411         return binder::Status::ok();
412     }
framesProcessedEffectClient413     binder::Status framesProcessed(int32_t frames __unused) override {
414         return binder::Status::ok();
415     }
416 };
417 
invokeAudioEffect()418 status_t AudioFlingerFuzzer::invokeAudioEffect() {
419     effect_uuid_t type;
420     type.timeLow = mFdp.ConsumeIntegral<uint32_t>();
421     type.timeMid = mFdp.ConsumeIntegral<uint16_t>();
422     type.timeHiAndVersion = mFdp.ConsumeIntegral<uint16_t>();
423     type.clockSeq = mFdp.ConsumeIntegral<uint16_t>();
424     for (int i = 0; i < 6; ++i) {
425         type.node[i] = mFdp.ConsumeIntegral<uint8_t>();
426     }
427 
428     effect_descriptor_t descriptor = {};
429     descriptor.type = type;
430     descriptor.uuid = *EFFECT_UUID_NULL;
431 
432     sp<EffectClient> effectClient(new EffectClient());
433 
434     const int32_t priority = mFdp.ConsumeIntegral<int32_t>();
435     audio_session_t sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
436     const audio_io_handle_t io = mFdp.ConsumeIntegral<int32_t>();
437     std::string opPackageName = static_cast<std::string>(mFdp.ConsumeRandomLengthString().c_str());
438     AudioDeviceTypeAddr device;
439 
440     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
441     if (!af) {
442         return NO_ERROR;
443     }
444 
445     media::CreateEffectRequest request{};
446     request.desc =
447         VALUE_OR_RETURN_STATUS(legacy2aidl_effect_descriptor_t_EffectDescriptor(descriptor));
448     request.client = effectClient;
449     request.priority = priority;
450     request.output = io;
451     request.sessionId = sessionId;
452     request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_AudioDeviceTypeAddress(device));
453     // TODO b/182392769: use attribution source util
454     request.attributionSource.packageName = opPackageName;
455     request.attributionSource.pid = VALUE_OR_RETURN_STATUS(legacy2aidl_pid_t_int32_t(getpid()));
456     request.probe = false;
457     request.notifyFramesProcessed = false;
458 
459     media::CreateEffectResponse response{};
460     status_t status = af->createEffect(request, &response);
461 
462     if (status != OK) {
463         return NO_ERROR;
464     }
465 
466     descriptor =
467         VALUE_OR_RETURN_STATUS(aidl2legacy_EffectDescriptor_effect_descriptor_t(response.desc));
468 
469     uint32_t numEffects;
470     af->queryNumberEffects(&numEffects);
471 
472     uint32_t queryIndex = mFdp.ConsumeIntegral<uint32_t>();
473     af->queryEffect(queryIndex, &descriptor);
474 
475     effect_descriptor_t getDescriptor;
476     uint32_t preferredTypeFlag = mFdp.ConsumeIntegral<int32_t>();
477     af->getEffectDescriptor(&descriptor.uuid, &descriptor.type, preferredTypeFlag, &getDescriptor);
478 
479     sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
480     audio_io_handle_t srcOutput = mFdp.ConsumeIntegral<int32_t>();
481     audio_io_handle_t dstOutput = mFdp.ConsumeIntegral<int32_t>();
482     af->moveEffects(sessionId, srcOutput, dstOutput);
483 
484     int effectId = mFdp.ConsumeIntegral<int32_t>();
485     sessionId = static_cast<audio_session_t>(mFdp.ConsumeIntegral<int32_t>());
486     af->setEffectSuspended(effectId, sessionId, mFdp.ConsumeBool());
487     return NO_ERROR;
488 }
489 
invokeAudioSystem()490 void AudioFlingerFuzzer::invokeAudioSystem() {
491     AudioSystem::muteMicrophone(mFdp.ConsumeBool());
492     AudioSystem::setMasterMute(mFdp.ConsumeBool());
493     AudioSystem::setMasterVolume(mFdp.ConsumeFloatingPoint<float>());
494     AudioSystem::setMasterBalance(mFdp.ConsumeFloatingPoint<float>());
495     AudioSystem::setVoiceVolume(mFdp.ConsumeFloatingPoint<float>());
496 
497     float volume;
498     AudioSystem::getMasterVolume(&volume);
499 
500     bool state;
501     AudioSystem::getMasterMute(&state);
502     AudioSystem::isMicrophoneMuted(&state);
503 
504     audio_stream_type_t stream = getValue(&mFdp, kStreamtypes);
505     AudioSystem::setStreamMute(getValue(&mFdp, kStreamtypes), mFdp.ConsumeBool());
506 
507     stream = getValue(&mFdp, kStreamtypes);
508     AudioSystem::setStreamVolume(stream, mFdp.ConsumeFloatingPoint<float>(),
509                                  mFdp.ConsumeIntegral<int32_t>());
510 
511     audio_mode_t mode = getValue(&mFdp, kModes);
512     AudioSystem::setMode(mode);
513 
514     size_t frameCount;
515     stream = getValue(&mFdp, kStreamtypes);
516     AudioSystem::getOutputFrameCount(&frameCount, stream);
517 
518     uint32_t latency;
519     stream = getValue(&mFdp, kStreamtypes);
520     AudioSystem::getOutputLatency(&latency, stream);
521 
522     stream = getValue(&mFdp, kStreamtypes);
523     AudioSystem::getStreamVolume(stream, &volume, mFdp.ConsumeIntegral<int32_t>());
524 
525     stream = getValue(&mFdp, kStreamtypes);
526     AudioSystem::getStreamMute(stream, &state);
527 
528     uint32_t samplingRate;
529     AudioSystem::getSamplingRate(mFdp.ConsumeIntegral<int32_t>(), &samplingRate);
530 
531     AudioSystem::getFrameCount(mFdp.ConsumeIntegral<int32_t>(), &frameCount);
532     AudioSystem::getLatency(mFdp.ConsumeIntegral<int32_t>(), &latency);
533     AudioSystem::setVoiceVolume(mFdp.ConsumeFloatingPoint<float>());
534 
535     uint32_t halFrames;
536     uint32_t dspFrames;
537     AudioSystem::getRenderPosition(mFdp.ConsumeIntegral<int32_t>(), &halFrames, &dspFrames);
538 
539     AudioSystem::getInputFramesLost(mFdp.ConsumeIntegral<int32_t>());
540     AudioSystem::getInputFramesLost(mFdp.ConsumeIntegral<int32_t>());
541 
542     audio_unique_id_use_t uniqueIdUse = getValue(&mFdp, kUniqueIds);
543     AudioSystem::newAudioUniqueId(uniqueIdUse);
544 
545     audio_session_t sessionId = getValue(&mFdp, kSessionId);
546     pid_t pid = mFdp.ConsumeBool() ? getpid() : mFdp.ConsumeIntegral<int32_t>();
547     uid_t uid = mFdp.ConsumeBool() ? getuid() : mFdp.ConsumeIntegral<int32_t>();
548     AudioSystem::acquireAudioSessionId(sessionId, pid, uid);
549 
550     pid = mFdp.ConsumeBool() ? getpid() : mFdp.ConsumeIntegral<int32_t>();
551     sessionId = getValue(&mFdp, kSessionId);
552     AudioSystem::releaseAudioSessionId(sessionId, pid);
553 
554     sessionId = getValue(&mFdp, kSessionId);
555     AudioSystem::getAudioHwSyncForSession(sessionId);
556 
557     AudioSystem::systemReady();
558     AudioSystem::getFrameCountHAL(mFdp.ConsumeIntegral<int32_t>(), &frameCount);
559 
560     size_t buffSize;
561     uint32_t sampleRate = getSampleRate(&mFdp);
562     audio_format_t format = getValue(&mFdp, kFormats);
563     audio_channel_mask_t channelMask = getValue(&mFdp, kChannelMasks);
564     AudioSystem::getInputBufferSize(sampleRate, format, channelMask, &buffSize);
565 
566     AudioSystem::getPrimaryOutputSamplingRate();
567     AudioSystem::getPrimaryOutputFrameCount();
568     AudioSystem::setLowRamDevice(mFdp.ConsumeBool(), mFdp.ConsumeIntegral<int64_t>());
569 
570     std::vector<media::MicrophoneInfoFw> microphones;
571     AudioSystem::getMicrophones(&microphones);
572 
573     std::vector<pid_t> pids;
574     pids.insert(pids.begin(), getpid());
575     for (int i = 1; i < mFdp.ConsumeIntegralInRange<int32_t>(2, MAX_ARRAY_LENGTH); ++i) {
576         pids.insert(pids.begin() + i, static_cast<pid_t>(mFdp.ConsumeIntegral<int32_t>()));
577     }
578     AudioSystem::setAudioHalPids(pids);
579     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
580     if (!af) {
581         return;
582     }
583     af->setRecordSilenced(mFdp.ConsumeIntegral<uint32_t>(), mFdp.ConsumeBool());
584 
585     float balance = mFdp.ConsumeFloatingPoint<float>();
586     af->getMasterBalance(&balance);
587 
588     std::vector<audio_port_handle_t> tracks;
589     for (int i = 0; i < mFdp.ConsumeIntegralInRange<int32_t>(0, MAX_ARRAY_LENGTH); ++i) {
590         tracks.push_back(static_cast<audio_port_handle_t>(mFdp.ConsumeIntegral<int32_t>()));
591     }
592     af->invalidateTracks(tracks);
593 }
594 
invokeAudioInputDevice()595 status_t AudioFlingerFuzzer::invokeAudioInputDevice() {
596     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
597     if (!af) {
598         return NO_ERROR;
599     }
600 
601     audio_config_t config = {};
602     audio_module_handle_t module = mFdp.ConsumeIntegral<int32_t>();
603     audio_io_handle_t input = mFdp.ConsumeIntegral<int32_t>();
604     config.frame_count = mFdp.ConsumeIntegral<uint32_t>();
605     String8 address = static_cast<String8>(mFdp.ConsumeRandomLengthString().c_str());
606 
607     config.channel_mask = getValue(&mFdp, kChannelMasks);
608     config.format = getValue(&mFdp, kFormats);
609 
610     config.offload_info = AUDIO_INFO_INITIALIZER;
611     config.offload_info.bit_rate = mFdp.ConsumeIntegral<uint32_t>();
612     config.offload_info.bit_width = mFdp.ConsumeIntegral<uint32_t>();
613     config.offload_info.content_id = mFdp.ConsumeIntegral<uint32_t>();
614     config.offload_info.channel_mask = getValue(&mFdp, kChannelMasks);
615     config.offload_info.duration_us = mFdp.ConsumeIntegral<int64_t>();
616     config.offload_info.encapsulation_mode = getValue(&mFdp, kEncapsulation);
617     config.offload_info.format = getValue(&mFdp, kFormats);
618     config.offload_info.has_video = mFdp.ConsumeBool();
619     config.offload_info.is_streaming = mFdp.ConsumeBool();
620     config.offload_info.sample_rate = getSampleRate(&mFdp);
621     config.offload_info.sync_id = mFdp.ConsumeIntegral<uint32_t>();
622     config.offload_info.stream_type = getValue(&mFdp, kStreamtypes);
623     config.offload_info.usage = getValue(&mFdp, kUsages);
624 
625     config.sample_rate = getSampleRate(&mFdp);
626 
627     audio_devices_t device = getValue(&mFdp, kDevices);
628     audio_source_t source = getValue(&mFdp, kInputSources);
629     audio_input_flags_t flags = getValue(&mFdp, kInputFlags);
630 
631     AudioDeviceTypeAddr deviceTypeAddr(device, address.c_str());
632 
633     media::OpenInputRequest request{};
634     request.module = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_module_handle_t_int32_t(module));
635     request.input = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_io_handle_t_int32_t(input));
636     request.config = VALUE_OR_RETURN_STATUS(
637             legacy2aidl_audio_config_t_AudioConfig(config, true /*isInput*/));
638     request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_AudioDeviceTypeAddress(deviceTypeAddr));
639     request.source = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_source_t_AudioSource(source));
640     request.flags = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_input_flags_t_int32_t_mask(flags));
641 
642     media::OpenInputResponse response{};
643     status_t status = af->openInput(request, &response);
644     if (status != NO_ERROR) {
645         return NO_ERROR;
646     }
647 
648     input = VALUE_OR_RETURN_STATUS(aidl2legacy_int32_t_audio_module_handle_t(response.input));
649     af->closeInput(input);
650     return NO_ERROR;
651 }
652 
invokeAudioOutputDevice()653 status_t AudioFlingerFuzzer::invokeAudioOutputDevice() {
654     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
655     if (!af) {
656         return NO_ERROR;
657     }
658 
659     audio_config_t config = {};
660     audio_module_handle_t module = mFdp.ConsumeIntegral<int32_t>();
661     audio_io_handle_t output = mFdp.ConsumeIntegral<int32_t>();
662     config.frame_count = mFdp.ConsumeIntegral<uint32_t>();
663     String8 address = static_cast<String8>(mFdp.ConsumeRandomLengthString().c_str());
664 
665     config.channel_mask = getValue(&mFdp, kChannelMasks);
666 
667     config.offload_info = AUDIO_INFO_INITIALIZER;
668     config.offload_info.bit_rate = mFdp.ConsumeIntegral<uint32_t>();
669     config.offload_info.bit_width = mFdp.ConsumeIntegral<uint32_t>();
670     config.offload_info.channel_mask = getValue(&mFdp, kChannelMasks);
671     config.offload_info.content_id = mFdp.ConsumeIntegral<uint32_t>();
672     config.offload_info.duration_us = mFdp.ConsumeIntegral<int64_t>();
673     config.offload_info.encapsulation_mode = getValue(&mFdp, kEncapsulation);
674     config.offload_info.format = getValue(&mFdp, kFormats);
675     config.offload_info.has_video = mFdp.ConsumeBool();
676     config.offload_info.is_streaming = mFdp.ConsumeBool();
677     config.offload_info.sample_rate = getSampleRate(&mFdp);
678     config.offload_info.stream_type = getValue(&mFdp, kStreamtypes);
679     config.offload_info.sync_id = mFdp.ConsumeIntegral<uint32_t>();
680     config.offload_info.usage = getValue(&mFdp, kUsages);
681 
682     config.format = getValue(&mFdp, kFormats);
683     config.sample_rate = getSampleRate(&mFdp);
684 
685     sp<DeviceDescriptorBase> device = new DeviceDescriptorBase(getValue(&mFdp, kDevices));
686     audio_output_flags_t flags = getValue(&mFdp, kOutputFlags);
687 
688     audio_config_base_t mixerConfig = AUDIO_CONFIG_BASE_INITIALIZER;
689 
690     media::OpenOutputRequest request{};
691     media::OpenOutputResponse response{};
692 
693     request.module = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_module_handle_t_int32_t(module));
694     request.halConfig = VALUE_OR_RETURN_STATUS(
695             legacy2aidl_audio_config_t_AudioConfig(config, false /*isInput*/));
696     request.mixerConfig = VALUE_OR_RETURN_STATUS(
697             legacy2aidl_audio_config_base_t_AudioConfigBase(mixerConfig, false /*isInput*/));
698     request.device = VALUE_OR_RETURN_STATUS(legacy2aidl_DeviceDescriptorBase(device));
699     request.flags = VALUE_OR_RETURN_STATUS(legacy2aidl_audio_output_flags_t_int32_t_mask(flags));
700 
701     status_t status = af->openOutput(request, &response);
702     if (status != NO_ERROR) {
703         return NO_ERROR;
704     }
705     output = VALUE_OR_RETURN_STATUS(aidl2legacy_int32_t_audio_io_handle_t(response.output));
706 
707     audio_io_handle_t output1 = mFdp.ConsumeIntegral<int32_t>();
708     af->openDuplicateOutput(output, output1);
709     af->suspendOutput(output);
710     af->restoreOutput(output);
711     af->closeOutput(output);
712     return NO_ERROR;
713 }
714 
invokeAudioPatch()715 void AudioFlingerFuzzer::invokeAudioPatch() {
716     sp<IAudioFlinger> af = AudioSystem::get_audio_flinger();
717     if (!af) {
718         return;
719     }
720     struct audio_patch patch = {};
721     audio_patch_handle_t handle = mFdp.ConsumeIntegral<int32_t>();
722 
723     patch.id = mFdp.ConsumeIntegral<int32_t>();
724     patch.num_sources = mFdp.ConsumeIntegral<uint32_t>();
725     patch.num_sinks = mFdp.ConsumeIntegral<uint32_t>();
726 
727     for (int i = 0; i < AUDIO_PATCH_PORTS_MAX; ++i) {
728         patch.sources[i].config_mask = mFdp.ConsumeIntegral<uint32_t>();
729         patch.sources[i].channel_mask = getValue(&mFdp, kChannelMasks);
730         patch.sources[i].format = getValue(&mFdp, kFormats);
731         patch.sources[i].gain.channel_mask = getValue(&mFdp, kChannelMasks);
732         patch.sources[i].gain.index = mFdp.ConsumeIntegral<int32_t>();
733         patch.sources[i].gain.mode = getValue(&mFdp, kGainModes);
734         patch.sources[i].gain.ramp_duration_ms = mFdp.ConsumeIntegral<uint32_t>();
735         patch.sources[i].id = static_cast<audio_format_t>(mFdp.ConsumeIntegral<int32_t>());
736         patch.sources[i].role = getValue(&mFdp, kPortRoles);
737         patch.sources[i].sample_rate = getSampleRate(&mFdp);
738         patch.sources[i].type = getValue(&mFdp, kPortTypes);
739 
740         patch.sinks[i].config_mask = mFdp.ConsumeIntegral<uint32_t>();
741         patch.sinks[i].channel_mask = getValue(&mFdp, kChannelMasks);
742         patch.sinks[i].format = getValue(&mFdp, kFormats);
743         patch.sinks[i].gain.channel_mask = getValue(&mFdp, kChannelMasks);
744         patch.sinks[i].gain.index = mFdp.ConsumeIntegral<int32_t>();
745         patch.sinks[i].gain.mode = getValue(&mFdp, kGainModes);
746         patch.sinks[i].gain.ramp_duration_ms = mFdp.ConsumeIntegral<uint32_t>();
747         patch.sinks[i].id = static_cast<audio_format_t>(mFdp.ConsumeIntegral<int32_t>());
748         patch.sinks[i].role = getValue(&mFdp, kPortRoles);
749         patch.sinks[i].sample_rate = getSampleRate(&mFdp);
750         patch.sinks[i].type = getValue(&mFdp, kPortTypes);
751     }
752 
753     status_t status = af->createAudioPatch(&patch, &handle);
754     if (status != NO_ERROR) {
755         return;
756     }
757 
758     unsigned int num_patches = mFdp.ConsumeIntegral<uint32_t>();
759     struct audio_patch patches = {};
760     af->listAudioPatches(&num_patches, &patches);
761     af->releaseAudioPatch(handle);
762 }
763 
process()764 void AudioFlingerFuzzer::process() {
765     invokeAudioEffect();
766     invokeAudioInputDevice();
767     invokeAudioOutputDevice();
768     invokeAudioPatch();
769     invokeAudioRecord();
770     invokeAudioSystem();
771     invokeAudioTrack();
772 }
773 
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)774 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
775     if (size < 1) {
776         return 0;
777     }
778     AudioFlingerFuzzer audioFuzzer(data, size);
779     audioFuzzer.process();
780     return 0;
781 }
782