Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22a95c82 authored by Anuj Joshi's avatar Anuj Joshi Committed by Kris Alder
Browse files

Added fuzzer for libaaudio 

Test: ./libaaudio_fuzzer
Bug: 189053856

Change-Id: I7444a311b5500eabb1467034ec7d4097afceb0ee
parent 36c0118a

media/libaaudio/fuzzer/Android.bp

0 → 100644
+63 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2021 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at:

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



cc_fuzz {

    name: "libaaudio_fuzzer",

    srcs: [

        "libaaudio_fuzzer.cpp",

    ],

    header_libs: [

        "libaaudio_headers",

    ],

    shared_libs: [

        "libbinder",

        "libaudiomanager",

        "libaudiopolicy",

        "libaudioclient_aidl_conversion",

    ],

    static_libs: [

        "android.media.audio.common.types-V1-cpp",

        "liblog",

        "libutils",

        "libcutils",

        "libaaudio",

        "libjsoncpp",

        "libbase_ndk",

        "libcgrouprc",

        "libaudioutils",

        "libaudioclient",

        "aaudio-aidl-cpp",

        "libmedia_helper",

        "libmediametrics",

        "libprocessgroup",

        "av-types-aidl-cpp",

        "libaaudio_internal",

        "libcgrouprc_format",

        "audiopolicy-aidl-cpp",

        "audioflinger-aidl-cpp",

        "audiopolicy-types-aidl-cpp",

        "audioclient-types-aidl-cpp",

        "shared-file-region-aidl-cpp",

        "framework-permission-aidl-cpp",

        "mediametricsservice-aidl-cpp",

    ],

    fuzz_config: {

        cc: [

            "android-media-fuzzing-reports@google.com",

        ],

        componentid: 155276,

    },

}

media/libaaudio/fuzzer/README.md

0 → 100644
+77 −0
Original line number Diff line number Diff line 
# Fuzzer for libaaudio



## Plugin Design Considerations

The fuzzer plugin for `libaaudio` are designed based on the understanding of the

source code and tries to achieve the following:



##### Maximize code coverage

The configuration parameters are not hardcoded, but instead selected based on

incoming data. This ensures more code paths are reached by the fuzzer.



Fuzzers assigns values to the following parameters to pass on to libaaudio:

1. Device Id (parameter name: `deviceId`)

2. Sampling Rate (parameter name: `sampleRate`)

3. Number of channels (parameter name: `channelCount`)

4. Audio Travel Direction (parameter name: `direction`)

5. Audio Format (parameter name: `format`)

6. Audio Sharing Mode (parameter name: `sharingMode`)

7. Audio Usage (parameter name: `usage`)

8. Audio Content type (parameter name: `contentType`)

9. Audio Input Preset (parameter name: `inputPreset`)

10. Audio Privacy Sensitivity (parameter name: `privacySensitive`)

11. Buffer Capacity In Frames (parameter name: `frames`)

12. Performance Mode (parameter name: `mode`)

13. Allowed Capture Policy (parameter name: `allowedCapturePolicy`)

14. Session Id (parameter name: `sessionId`)

15. Frames per Data Callback (parameter name: `framesPerDataCallback`)

16. MMap Policy (parameter name: `policy`)



| Parameter| Valid Values| Configured Value|

|------------- |-------------| ----- |

| `deviceId` | Any value of type `int32_t`  | Value obtained from FuzzedDataProvider |

| `sampleRate` | Any value of type `int32_t`  | Value obtained from FuzzedDataProvider |

| `channelCount` |  Any value of type `int32_t` | Value obtained from FuzzedDataProvider |

| `direction` | 0. `AAUDIO_DIRECTION_OUTPUT` 1. `AAUDIO_DIRECTION_INPUT` | Value obtained from FuzzedDataProvider |

| `format` | 0. `AAUDIO_FORMAT_INVALID` 1. `AAUDIO_FORMAT_UNSPECIFIED` 2. `AAUDIO_FORMAT_PCM_I16` 3. `AAUDIO_FORMAT_PCM_FLOAT` | Value obtained from FuzzedDataProvider |

| `sharingMode` | 0. `AAUDIO_SHARING_MODE_EXCLUSIVE` 1. `AAUDIO_SHARING_MODE_SHARED` | Value obtained from FuzzedDataProvider |

| `usage` | 0. `AAUDIO_USAGE_MEDIA` 1. `AAUDIO_USAGE_VOICE_COMMUNICATION` 2. `AAUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING` 3. `AAUDIO_USAGE_ALARM` 4. `AAUDIO_USAGE_NOTIFICATION` 5. `AAUDIO_USAGE_NOTIFICATION_RINGTONE` 6. `AAUDIO_USAGE_NOTIFICATION_EVENT` 7. `AAUDIO_USAGE_ASSISTANCE_ACCESSIBILITY` 8. `AAUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE` 9. `AAUDIO_USAGE_ASSISTANCE_SONIFICATION` 10. `AAUDIO_USAGE_GAME` 11. `AAUDIO_USAGE_ASSISTANT` 12. `AAUDIO_SYSTEM_USAGE_EMERGENCY` 13. `AAUDIO_SYSTEM_USAGE_SAFETY` 14. `AAUDIO_SYSTEM_USAGE_VEHICLE_STATUS` 15. `AAUDIO_SYSTEM_USAGE_ANNOUNCEMENT` | Value obtained from FuzzedDataProvider |

| `contentType` | 0. `AAUDIO_CONTENT_TYPE_SPEECH` 1. `AAUDIO_CONTENT_TYPE_MUSIC` 2. `AAUDIO_CONTENT_TYPE_MOVIE` 3. `AAUDIO_CONTENT_TYPE_SONIFICATION` | Value obtained from FuzzedDataProvider |

| `inputPreset` | 0. `AAUDIO_INPUT_PRESET_GENERIC` 1. `AAUDIO_INPUT_PRESET_CAMCORDER` 2. `AAUDIO_INPUT_PRESET_VOICE_RECOGNITION` 3. `AAUDIO_INPUT_PRESET_VOICE_COMMUNICATION` 4. `AAUDIO_INPUT_PRESET_UNPROCESSED` 5. `AAUDIO_INPUT_PRESET_VOICE_PERFORMANCE` | Value obtained from FuzzedDataProvider |

| `privacySensitive` | 0. `true` 1. `false` | Value obtained from FuzzedDataProvider |

| `frames` | Any value of type `int32_t`  | Value obtained from FuzzedDataProvider |

| `mode` | 0. `AAUDIO_PERFORMANCE_MODE_NONE` 1. `AAUDIO_PERFORMANCE_MODE_POWER_SAVING` 2. `AAUDIO_PERFORMANCE_MODE_LOW_LATENCY` | Value obtained from FuzzedDataProvider |

| `allowedCapturePolicy` | 0. `AAUDIO_ALLOW_CAPTURE_BY_ALL` 1. `AAUDIO_ALLOW_CAPTURE_BY_SYSTEM` 2. `AAUDIO_ALLOW_CAPTURE_BY_NONE` | Value obtained from FuzzedDataProvider |

| `sessionId` | 0. `AAUDIO_SESSION_ID_NONE` 1. `AAUDIO_SESSION_ID_ALLOCATE` | Value obtained from FuzzedDataProvider |

| `framesPerDataCallback` | Any value of type `int32_t` | Value obtained from FuzzedDataProvider |

| `policy` | 0. `AAUDIO_POLICY_NEVER` 1. `AAUDIO_POLICY_AUTO` 2. `AAUDIO_POLICY_ALWAYS` | Value obtained from FuzzedDataProvider |



This also ensures that the plugin is always deterministic for any given input.



##### Maximize utilization of input data

The plugin feed the entire input data to the module.

This ensures that the plugins tolerates any kind of input (empty, huge,

malformed, etc) and doesn't `exit()` on any input and thereby increasing the

chance of identifying vulnerabilities.



## Build



This describes steps to build libaaudio_fuzzer binary.



### Android



#### Steps to build

Build the fuzzer

```

  $ mm -j$(nproc) libaaudio_fuzzer

```

### Steps to run



To run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/libaaudio_fuzzer/libaaudio_fuzzer

```



## References:

 * http://llvm.org/docs/LibFuzzer.html

 * https://github.com/google/oss-fuzz

media/libaaudio/fuzzer/libaaudio_fuzzer.cpp

0 → 100644
+289 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2021 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at:

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 *

 */



#include "aaudio/AAudio.h"

#include "aaudio/AAudioTesting.h"

#include <fuzzer/FuzzedDataProvider.h>



constexpr int32_t kRandomStringLength = 256;



constexpr int64_t kNanosPerMillisecond = 1000 * 1000;



constexpr aaudio_direction_t kDirections[] = {

    AAUDIO_DIRECTION_OUTPUT, AAUDIO_DIRECTION_INPUT, AAUDIO_UNSPECIFIED};



constexpr aaudio_performance_mode_t kPerformanceModes[] = {

    AAUDIO_PERFORMANCE_MODE_NONE, AAUDIO_PERFORMANCE_MODE_POWER_SAVING,

    AAUDIO_PERFORMANCE_MODE_LOW_LATENCY, AAUDIO_UNSPECIFIED};



constexpr aaudio_format_t kFormats[] = {

    AAUDIO_FORMAT_INVALID,        AAUDIO_FORMAT_UNSPECIFIED,

    AAUDIO_FORMAT_PCM_I16,        AAUDIO_FORMAT_PCM_FLOAT,

    AAUDIO_FORMAT_PCM_I24_PACKED, AAUDIO_FORMAT_PCM_I32};



constexpr aaudio_sharing_mode_t kSharingModes[] = {

    AAUDIO_SHARING_MODE_EXCLUSIVE, AAUDIO_SHARING_MODE_SHARED};



constexpr int32_t kSampleRates[] = {AAUDIO_UNSPECIFIED,

                                    8000,

                                    11025,

                                    16000,

                                    22050,

                                    32000,

                                    44100,

                                    48000,

                                    88200,

                                    96000};



constexpr aaudio_usage_t kUsages[] = {

    AAUDIO_USAGE_MEDIA,

    AAUDIO_USAGE_VOICE_COMMUNICATION,

    AAUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING,

    AAUDIO_USAGE_ALARM,

    AAUDIO_USAGE_NOTIFICATION,

    AAUDIO_USAGE_NOTIFICATION_RINGTONE,

    AAUDIO_USAGE_NOTIFICATION_EVENT,

    AAUDIO_USAGE_ASSISTANCE_ACCESSIBILITY,

    AAUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE,

    AAUDIO_USAGE_ASSISTANCE_SONIFICATION,

    AAUDIO_USAGE_GAME,

    AAUDIO_USAGE_ASSISTANT,

    AAUDIO_SYSTEM_USAGE_EMERGENCY,

    AAUDIO_SYSTEM_USAGE_SAFETY,

    AAUDIO_SYSTEM_USAGE_VEHICLE_STATUS,

    AAUDIO_SYSTEM_USAGE_ANNOUNCEMENT,

    AAUDIO_UNSPECIFIED};



constexpr aaudio_content_type_t kContentTypes[] = {

    AAUDIO_CONTENT_TYPE_SPEECH, AAUDIO_CONTENT_TYPE_MUSIC,

    AAUDIO_CONTENT_TYPE_MOVIE, AAUDIO_CONTENT_TYPE_SONIFICATION,

    AAUDIO_UNSPECIFIED};



constexpr aaudio_input_preset_t kInputPresets[] = {

    AAUDIO_INPUT_PRESET_GENERIC,

    AAUDIO_INPUT_PRESET_CAMCORDER,

    AAUDIO_INPUT_PRESET_VOICE_RECOGNITION,

    AAUDIO_INPUT_PRESET_VOICE_COMMUNICATION,

    AAUDIO_INPUT_PRESET_UNPROCESSED,

    AAUDIO_INPUT_PRESET_VOICE_PERFORMANCE,

    AAUDIO_UNSPECIFIED};



constexpr aaudio_allowed_capture_policy_t kAllowedCapturePolicies[] = {

    AAUDIO_ALLOW_CAPTURE_BY_ALL, AAUDIO_ALLOW_CAPTURE_BY_SYSTEM,

    AAUDIO_ALLOW_CAPTURE_BY_NONE, AAUDIO_UNSPECIFIED};



constexpr aaudio_session_id_t kSessionIds[] = {

    AAUDIO_SESSION_ID_NONE, AAUDIO_SESSION_ID_ALLOCATE, AAUDIO_UNSPECIFIED};



constexpr aaudio_policy_t kPolicies[] = {

    AAUDIO_POLICY_NEVER, AAUDIO_POLICY_AUTO, AAUDIO_POLICY_ALWAYS,

    AAUDIO_UNSPECIFIED};



class LibAaudioFuzzer {

public:

  ~LibAaudioFuzzer() { deInit(); }

  bool init();

  void process(const uint8_t *data, size_t size);

  void deInit();



private:

  AAudioStreamBuilder *mAaudioBuilder = nullptr;

  AAudioStream *mAaudioStream = nullptr;

};



bool LibAaudioFuzzer::init() {

  aaudio_result_t result = AAudio_createStreamBuilder(&mAaudioBuilder);

  if ((result != AAUDIO_OK) || (!mAaudioBuilder)) {

    return false;

  }

  return true;

}



void LibAaudioFuzzer::process(const uint8_t *data, size_t size) {

  FuzzedDataProvider fdp(data, size);

  aaudio_performance_mode_t mode =

      fdp.PickValueInArray({fdp.PickValueInArray(kPerformanceModes),

                            fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setPerformanceMode(mAaudioBuilder, mode);



  int32_t deviceId = fdp.PickValueInArray(

      {AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setDeviceId(mAaudioBuilder, deviceId);



  std::string packageName = fdp.PickValueInArray<std::string>(

      {"android.nativemedia.aaudio", "android.app.appops.cts",

       fdp.ConsumeRandomLengthString(kRandomStringLength)});

  AAudioStreamBuilder_setPackageName(mAaudioBuilder, packageName.c_str());



  std::string attributionTag =

      fdp.ConsumeRandomLengthString(kRandomStringLength);

  AAudioStreamBuilder_setAttributionTag(mAaudioBuilder, attributionTag.c_str());



  int32_t sampleRate = fdp.PickValueInArray(kSampleRates);

  AAudioStreamBuilder_setSampleRate(mAaudioBuilder, sampleRate);



  int32_t channelCount = fdp.PickValueInArray(

      {AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setChannelCount(mAaudioBuilder, channelCount);



  aaudio_direction_t direction = fdp.PickValueInArray(

      {fdp.PickValueInArray(kDirections), fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setDirection(mAaudioBuilder, direction);



  aaudio_format_t format = fdp.PickValueInArray(

      {fdp.PickValueInArray(kFormats), fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setFormat(mAaudioBuilder, format);



  aaudio_sharing_mode_t sharingMode = fdp.PickValueInArray(

      {fdp.PickValueInArray(kSharingModes), fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setSharingMode(mAaudioBuilder, sharingMode);



  aaudio_usage_t usage = fdp.PickValueInArray(

      {fdp.PickValueInArray(kUsages), fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setUsage(mAaudioBuilder, usage);



  aaudio_content_type_t contentType = fdp.PickValueInArray(

      {fdp.PickValueInArray(kContentTypes), fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setContentType(mAaudioBuilder, contentType);



  aaudio_input_preset_t inputPreset = fdp.PickValueInArray(

      {fdp.PickValueInArray(kInputPresets), fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setInputPreset(mAaudioBuilder, inputPreset);



  bool privacySensitive = fdp.ConsumeBool();

  AAudioStreamBuilder_setPrivacySensitive(mAaudioBuilder, privacySensitive);



  int32_t frames = fdp.PickValueInArray(

      {AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setBufferCapacityInFrames(mAaudioBuilder, frames);



  aaudio_allowed_capture_policy_t allowedCapturePolicy =

      fdp.PickValueInArray({fdp.PickValueInArray(kAllowedCapturePolicies),

                            fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setAllowedCapturePolicy(mAaudioBuilder,

                                              allowedCapturePolicy);



  aaudio_session_id_t sessionId = fdp.PickValueInArray(

      {fdp.PickValueInArray(kSessionIds), fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setSessionId(mAaudioBuilder, sessionId);



  AAudioStreamBuilder_setDataCallback(mAaudioBuilder, nullptr, nullptr);

  AAudioStreamBuilder_setErrorCallback(mAaudioBuilder, nullptr, nullptr);



  int32_t framesPerDataCallback = fdp.PickValueInArray(

      {AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});

  AAudioStreamBuilder_setFramesPerDataCallback(mAaudioBuilder,

                                               framesPerDataCallback);



  aaudio_policy_t policy = fdp.PickValueInArray(

      {fdp.PickValueInArray(kPolicies), fdp.ConsumeIntegral<int32_t>()});

  AAudio_setMMapPolicy(policy);

  (void)AAudio_getMMapPolicy();



  aaudio_result_t result =

      AAudioStreamBuilder_openStream(mAaudioBuilder, &mAaudioStream);

  if ((result != AAUDIO_OK) || (!mAaudioStream)) {

    return;

  }



  int32_t framesPerBurst = AAudioStream_getFramesPerBurst(mAaudioStream);

  uint8_t numberOfBursts = fdp.ConsumeIntegral<uint8_t>();

  int32_t maxInputFrames = numberOfBursts * framesPerBurst;

  int32_t requestedBufferSize =

      fdp.ConsumeIntegral<uint16_t>() * framesPerBurst;

  AAudioStream_setBufferSizeInFrames(mAaudioStream, requestedBufferSize);



  int64_t position = 0, nanoseconds = 0;

  AAudioStream_getTimestamp(mAaudioStream, CLOCK_MONOTONIC, &position,

                            &nanoseconds);



  AAudioStream_requestStart(mAaudioStream);



  aaudio_format_t actualFormat = AAudioStream_getFormat(mAaudioStream);

  int32_t actualChannelCount = AAudioStream_getChannelCount(mAaudioStream);



  int32_t count = fdp.ConsumeIntegral<int32_t>();

  direction = AAudioStream_getDirection(mAaudioStream);

  framesPerDataCallback = AAudioStream_getFramesPerDataCallback(mAaudioStream);



  if (actualFormat == AAUDIO_FORMAT_PCM_I16) {

    std::vector<int16_t> inputShortData(maxInputFrames * actualChannelCount,

                                        0x0);

    if (direction == AAUDIO_DIRECTION_INPUT) {

      AAudioStream_read(mAaudioStream, inputShortData.data(),

                        framesPerDataCallback, count * kNanosPerMillisecond);

    } else if (direction == AAUDIO_DIRECTION_OUTPUT) {

      AAudioStream_write(mAaudioStream, inputShortData.data(),

                         framesPerDataCallback, count * kNanosPerMillisecond);

    }

  } else if (actualFormat == AAUDIO_FORMAT_PCM_FLOAT) {

    std::vector<float> inputFloatData(maxInputFrames * actualChannelCount, 0x0);

    if (direction == AAUDIO_DIRECTION_INPUT) {

      AAudioStream_read(mAaudioStream, inputFloatData.data(),

                        framesPerDataCallback, count * kNanosPerMillisecond);

    } else if (direction == AAUDIO_DIRECTION_OUTPUT) {

      AAudioStream_write(mAaudioStream, inputFloatData.data(),

                         framesPerDataCallback, count * kNanosPerMillisecond);

    }

  }



  aaudio_stream_state_t state = AAUDIO_STREAM_STATE_UNKNOWN;

  AAudioStream_waitForStateChange(mAaudioStream, AAUDIO_STREAM_STATE_UNKNOWN,

                                  &state, count * kNanosPerMillisecond);

  (void)AAudio_convertStreamStateToText(state);



  (void)AAudioStream_getUsage(mAaudioStream);

  (void)AAudioStream_getSampleRate(mAaudioStream);

  (void)AAudioStream_getState(mAaudioStream);

  (void)AAudioStream_getSamplesPerFrame(mAaudioStream);

  (void)AAudioStream_getContentType(mAaudioStream);

  (void)AAudioStream_getInputPreset(mAaudioStream);

  (void)AAudioStream_isPrivacySensitive(mAaudioStream);

  (void)AAudioStream_getAllowedCapturePolicy(mAaudioStream);

  (void)AAudioStream_getPerformanceMode(mAaudioStream);

  (void)AAudioStream_getDeviceId(mAaudioStream);

  (void)AAudioStream_getSharingMode(mAaudioStream);

  (void)AAudioStream_getSessionId(mAaudioStream);

  (void)AAudioStream_getFramesRead(mAaudioStream);

  (void)AAudioStream_getFramesWritten(mAaudioStream);

  (void)AAudioStream_getXRunCount(mAaudioStream);

  (void)AAudioStream_getBufferCapacityInFrames(mAaudioStream);

  (void)AAudioStream_getBufferSizeInFrames(mAaudioStream);

  (void)AAudioStream_isMMapUsed(mAaudioStream);



  AAudioStream_requestPause(mAaudioStream);

  AAudioStream_requestFlush(mAaudioStream);

  AAudioStream_release(mAaudioStream);

  AAudioStream_requestStop(mAaudioStream);

}



void LibAaudioFuzzer::deInit() {

  if (mAaudioBuilder) {

    AAudioStreamBuilder_delete(mAaudioBuilder);

  }

  if (mAaudioStream) {

    AAudioStream_close(mAaudioStream);

  }

}



extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

  LibAaudioFuzzer libAaudioFuzzer;

  if (libAaudioFuzzer.init()) {

    libAaudioFuzzer.process(data, size);

  }

  return 0;

}