1*ec779b8eSAndroid Build Coastguard Worker# Fuzzer for libaudiopolicy 2*ec779b8eSAndroid Build Coastguard Worker 3*ec779b8eSAndroid Build Coastguard Worker## Plugin Design Considerations 4*ec779b8eSAndroid Build Coastguard WorkerThe fuzzer plugin for libaudiopolicy is designed based on the 5*ec779b8eSAndroid Build Coastguard Workerunderstanding of the service and tries to achieve the following: 6*ec779b8eSAndroid Build Coastguard Worker 7*ec779b8eSAndroid Build Coastguard Worker##### Maximize code coverage 8*ec779b8eSAndroid Build Coastguard WorkerThe configuration parameters are not hardcoded, but instead selected based on 9*ec779b8eSAndroid Build Coastguard Workerincoming data. This ensures more code paths are reached by the fuzzer. 10*ec779b8eSAndroid Build Coastguard Worker 11*ec779b8eSAndroid Build Coastguard WorkerAudioPolicy APIs contain the following parameters: 12*ec779b8eSAndroid Build Coastguard Worker1. AudioFormats 13*ec779b8eSAndroid Build Coastguard Worker2. AudioChannelMasks 14*ec779b8eSAndroid Build Coastguard Worker3. AudioOutputFlags 15*ec779b8eSAndroid Build Coastguard Worker4. AudioDevices 16*ec779b8eSAndroid Build Coastguard Worker5. MixTypes 17*ec779b8eSAndroid Build Coastguard Worker6. MixRouteFlags 18*ec779b8eSAndroid Build Coastguard Worker7. SampleRates 19*ec779b8eSAndroid Build Coastguard Worker8. AudioUsages 20*ec779b8eSAndroid Build Coastguard Worker9. AudioContentTypes 21*ec779b8eSAndroid Build Coastguard Worker10. AudioSources 22*ec779b8eSAndroid Build Coastguard Worker11. AudioFlagMasks 23*ec779b8eSAndroid Build Coastguard Worker12. AudioPolicyDeviceStates 24*ec779b8eSAndroid Build Coastguard Worker 25*ec779b8eSAndroid Build Coastguard Worker| Parameter| Valid Input Values| Configured Value| 26*ec779b8eSAndroid Build Coastguard Worker|------------- |-------------| ----- | 27*ec779b8eSAndroid Build Coastguard Worker| `AudioFormat` | 77 values of type `audio_format_t` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 28*ec779b8eSAndroid Build Coastguard Worker| `AudioChannelMask` | 83 values of type `audio_channel_mask_t` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 29*ec779b8eSAndroid Build Coastguard Worker| `AudioOutputFlag` | 16 values of type `audio_output_flags_t` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 30*ec779b8eSAndroid Build Coastguard Worker| `AudioDevice` | `AUDIO_DEVICE_OUT_AUX_DIGITAL`, `AUDIO_DEVICE_OUT_STUB`, `AUDIO_DEVICE_IN_VOICE_CALL`, `AUDIO_DEVICE_IN_AUX_DIGITAL`, `AUDIO_DEVICE_IN_STUB` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 31*ec779b8eSAndroid Build Coastguard Worker| `MixType` | `MIX_TYPE_PLAYERS`, `MIX_TYPE_RECORDERS` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 32*ec779b8eSAndroid Build Coastguard Worker| `MixRouteFlag` | `MIX_ROUTE_FLAG_RENDER`, `MIX_ROUTE_FLAG_LOOP_BACK`, `MIX_ROUTE_FLAG_LOOP_BACK_AND_RENDER`, `MIX_ROUTE_FLAG_ALL` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 33*ec779b8eSAndroid Build Coastguard Worker| `SampleRate` | `0` to `UINT32_MAX` | Value obtained from FuzzedDataProvider | 34*ec779b8eSAndroid Build Coastguard Worker| `AudioUsage` | `AUDIO_USAGE_NOTIFICATION_COMMUNICATION_REQUEST`, `AUDIO_USAGE_NOTIFICATION_COMMUNICATION_INSTANT`, `AUDIO_USAGE_NOTIFICATION_COMMUNICATION_DELAYED`, `AUDIO_USAGE_NOTIFICATION_EVENT` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 35*ec779b8eSAndroid Build Coastguard Worker| `AudioContentType` | `AUDIO_CONTENT_TYPE_UNKNOWN`, `AUDIO_CONTENT_TYPE_SPEECH`, `AUDIO_CONTENT_TYPE_MUSIC`, `AUDIO_CONTENT_TYPE_MOVIE`, `AUDIO_CONTENT_TYPE_SONIFICATION` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 36*ec779b8eSAndroid Build Coastguard Worker| `AudioSource` | 14 values of type `audio_source_t` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 37*ec779b8eSAndroid Build Coastguard Worker| `AudioFlagMask` | 15 values of type `audio_flags_mask_t` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 38*ec779b8eSAndroid Build Coastguard Worker| `AudioPolicyDeviceStates` | `AUDIO_POLICY_DEVICE_STATE_UNAVAILABLE`, `AUDIO_POLICY_DEVICE_STATE_AVAILABLE`, `AUDIO_POLICY_DEVICE_STATE_CNT` | Value chosen from valid values by obtaining index from FuzzedDataProvider | 39*ec779b8eSAndroid Build Coastguard Worker 40*ec779b8eSAndroid Build Coastguard WorkerThis also ensures that the plugin is always deterministic for any given input. 41*ec779b8eSAndroid Build Coastguard Worker 42*ec779b8eSAndroid Build Coastguard Worker## Build 43*ec779b8eSAndroid Build Coastguard Worker 44*ec779b8eSAndroid Build Coastguard WorkerThis describes steps to build audiopolicy_fuzzer binary. 45*ec779b8eSAndroid Build Coastguard Worker 46*ec779b8eSAndroid Build Coastguard Worker### Android 47*ec779b8eSAndroid Build Coastguard Worker 48*ec779b8eSAndroid Build Coastguard Worker#### Steps to build 49*ec779b8eSAndroid Build Coastguard WorkerBuild the fuzzer 50*ec779b8eSAndroid Build Coastguard Worker``` 51*ec779b8eSAndroid Build Coastguard Worker $ mm -j$(nproc) audiopolicy_fuzzer 52*ec779b8eSAndroid Build Coastguard Worker``` 53*ec779b8eSAndroid Build Coastguard Worker 54*ec779b8eSAndroid Build Coastguard Worker#### Steps to run 55*ec779b8eSAndroid Build Coastguard WorkerTo run on device 56*ec779b8eSAndroid Build Coastguard Worker``` 57*ec779b8eSAndroid Build Coastguard Worker $ adb sync data 58*ec779b8eSAndroid Build Coastguard Worker $ adb shell /data/fuzz/arm64/audiopolicy_fuzzer/audiopolicy_fuzzer 59*ec779b8eSAndroid Build Coastguard Worker``` 60*ec779b8eSAndroid Build Coastguard Worker 61*ec779b8eSAndroid Build Coastguard Worker## References: 62*ec779b8eSAndroid Build Coastguard Worker * http://llvm.org/docs/LibFuzzer.html 63*ec779b8eSAndroid Build Coastguard Worker * https://github.com/google/oss-fuzz 64