1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <fcntl.h>
18
19 #include <functional>
20 #include <type_traits>
21
22 #include <android/content/AttributionSourceState.h>
23 #include "fuzzer/FuzzedDataProvider.h"
24 #include "mediautils/ServiceUtilities.h"
25
26 static constexpr int kMaxOperations = 50;
27 static constexpr int kMaxStringLen = 256;
28 static constexpr int kMaxSpaces = 1000;
29
30 using android::content::AttributionSourceState;
31
32 const std::vector<std::function<void(FuzzedDataProvider*, android::MediaPackageManager)>>
33 operations = {
__anon633a442f0102() 34 [](FuzzedDataProvider* data_provider, android::MediaPackageManager pm) -> void {
35 uid_t uid = data_provider->ConsumeIntegral<uid_t>();
36 pm.allowPlaybackCapture(uid);
37 },
__anon633a442f0202() 38 [](FuzzedDataProvider* data_provider, android::MediaPackageManager pm) -> void {
39 /* The large value of spaces was taking time in file write operation.
40 * Limited spaces values in range to avoid timeout.*/
41 int spaces = data_provider->ConsumeIntegralInRange<int>(0, kMaxSpaces);
42
43 // Dump everything into /dev/null
44 int fd = open("/dev/null", O_WRONLY);
45 pm.dump(fd, spaces);
46 close(fd);
47 },
48 };
49
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)50 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
51 FuzzedDataProvider data_provider(data, size);
52 int32_t uid = data_provider.ConsumeIntegral<int32_t>();
53 int32_t pid = data_provider.ConsumeIntegral<int32_t>();
54 audio_source_t source = static_cast<audio_source_t>(data_provider
55 .ConsumeIntegral<std::underlying_type_t<audio_source_t>>());
56 uint32_t deviceId = data_provider.ConsumeIntegral<uint32_t>();
57
58 std::string packageNameStr = data_provider.ConsumeRandomLengthString(kMaxStringLen);
59 std::string msgStr = data_provider.ConsumeRandomLengthString(kMaxStringLen);
60 android::String16 msgStr16(packageNameStr.c_str());
61 AttributionSourceState attributionSource;
62 attributionSource.packageName = packageNameStr;
63 attributionSource.uid = uid;
64 attributionSource.pid = pid;
65 attributionSource.token = android::sp<android::BBinder>::make();
66
67 // There is not state here, and order is not significant,
68 // so we can simply call all of the target functions
69 android::isServiceUid(uid);
70 android::isAudioServerUid(uid);
71 android::isAudioServerOrSystemServerUid(uid);
72 android::isAudioServerOrMediaServerUid(uid);
73 android::recordingAllowed(attributionSource);
74 android::recordingAllowed(attributionSource, deviceId, source);
75 android::startRecording(attributionSource, deviceId, msgStr16, source);
76 android::finishRecording(attributionSource, deviceId, source);
77 android::captureAudioOutputAllowed(attributionSource);
78 android::captureMediaOutputAllowed(attributionSource);
79 android::captureHotwordAllowed(attributionSource);
80 android::modifyPhoneStateAllowed(attributionSource);
81 android::bypassInterruptionPolicyAllowed(attributionSource);
82 android::settingsAllowed();
83 android::modifyAudioRoutingAllowed();
84 android::modifyDefaultAudioEffectsAllowed();
85 android::dumpAllowed();
86
87 // MediaPackageManager does have state, so we need the fuzzer to decide order
88 android::MediaPackageManager packageManager;
89 size_t ops_run = 0;
90 while (data_provider.remaining_bytes() > 0 && ops_run++ < kMaxOperations) {
91 uint8_t op = data_provider.ConsumeIntegralInRange<uint8_t>(0, operations.size() - 1);
92 operations[op](&data_provider, packageManager);
93 }
94
95 return 0;
96 }
97