Added audiopolicy_fuzzer (253887f7) · Commits · e / os / android_frameworks_av

services/audiopolicy/fuzzer/Android.bp

0 → 100644

+55 −0

Original line number	Diff line number	Diff line
		/******************************************************************************
		*
		* Copyright (C) 2021 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at:
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*
		******************************************************************************/

		cc_fuzz {
		name: "audiopolicy_fuzzer",
		srcs: [
		"audiopolicy_fuzzer.cpp",
		],
		include_dirs: [
		"frameworks/av/services/audiopolicy",
		],
		shared_libs: [
		"android.hardware.audio.common-util",
		"capture_state_listener-aidl-cpp",
		"libaudioclient",
		"libaudiofoundation",
		"libbase",
		"libcutils",
		"libhidlbase",
		"libdl",
		"liblog",
		"libmedia_helper",
		"libmediametrics",
		"libutils",
		"libxml2",
		"libbinder",
		"libaudiopolicy",
		"libaudiopolicymanagerdefault",
		],
		static_libs: [
		"android.hardware.audio.common@7.0-enums",
		"libaudiopolicycomponents",
		],
		header_libs: [
		"libaudiopolicycommon",
		"libaudiopolicyengine_interface_headers",
		"libaudiopolicymanager_interface_headers",
		],
		data: [":audiopolicyfuzzer_configuration_files"],
		}

services/audiopolicy/fuzzer/README.md

0 → 100644

+63 −0

Original line number	Diff line number	Diff line
		# Fuzzer for libaudiopolicy

		## Plugin Design Considerations
		The fuzzer plugin for libaudiopolicy is designed based on the
		understanding of the service and tries to achieve the following:

		##### Maximize code coverage
		The configuration parameters are not hardcoded, but instead selected based on
		incoming data. This ensures more code paths are reached by the fuzzer.

		AudioPolicy APIs contain the following parameters:
		1. AudioFormats
		2. AudioChannelMasks
		3. AudioOutputFlags
		4. AudioDevices
		5. MixTypes
		6. MixRouteFlags
		7. SampleRates
		8. AudioUsages
		9. AudioContentTypes
		10. AudioSources
		11. AudioFlagMasks
		12. AudioPolicyDeviceStates

		\| Parameter\| Valid Input Values\| Configured Value\|
		\|------------- \|-------------\| ----- \|
		\| `AudioFormat` \| 77 values of type `audio_format_t` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `AudioChannelMask` \| 83 values of type `audio_channel_mask_t` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `AudioOutputFlag` \| 16 values of type `audio_output_flags_t` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `AudioDevice` \| `AUDIO_DEVICE_OUT_AUX_DIGITAL`, `AUDIO_DEVICE_OUT_STUB`, `AUDIO_DEVICE_IN_VOICE_CALL`, `AUDIO_DEVICE_IN_AUX_DIGITAL`, `AUDIO_DEVICE_IN_STUB` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `MixType` \| `MIX_TYPE_PLAYERS`, `MIX_TYPE_RECORDERS` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `MixRouteFlag` \| `MIX_ROUTE_FLAG_RENDER`, `MIX_ROUTE_FLAG_LOOP_BACK`, `MIX_ROUTE_FLAG_LOOP_BACK_AND_RENDER`, `MIX_ROUTE_FLAG_ALL` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `SampleRate` \| `0` to `UINT32_MAX` \| Value obtained from FuzzedDataProvider \|
		\| `AudioUsage` \| `AUDIO_USAGE_NOTIFICATION_COMMUNICATION_REQUEST`, `AUDIO_USAGE_NOTIFICATION_COMMUNICATION_INSTANT`, `AUDIO_USAGE_NOTIFICATION_COMMUNICATION_DELAYED`, `AUDIO_USAGE_NOTIFICATION_EVENT` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `AudioContentType` \| `AUDIO_CONTENT_TYPE_UNKNOWN`, `AUDIO_CONTENT_TYPE_SPEECH`, `AUDIO_CONTENT_TYPE_MUSIC`, `AUDIO_CONTENT_TYPE_MOVIE`, `AUDIO_CONTENT_TYPE_SONIFICATION` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `AudioSource` \| 14 values of type `audio_source_t` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `AudioFlagMask` \| 15 values of type `audio_flags_mask_t` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|
		\| `AudioPolicyDeviceStates` \| `AUDIO_POLICY_DEVICE_STATE_UNAVAILABLE`, `AUDIO_POLICY_DEVICE_STATE_AVAILABLE`, `AUDIO_POLICY_DEVICE_STATE_CNT` \| Value chosen from valid values by obtaining index from FuzzedDataProvider \|

		This also ensures that the plugin is always deterministic for any given input.

		## Build

		This describes steps to build audiopolicy_fuzzer binary.

		### Android

		#### Steps to build
		Build the fuzzer
		```
		$ mm -j$(nproc) audiopolicy_fuzzer
		```

		#### Steps to run
		To run on device
		```
		$ adb sync data
		$ adb shell /data/fuzz/arm64/audiopolicy_fuzzer/audiopolicy_fuzzer
		```

		## References:
		* http://llvm.org/docs/LibFuzzer.html
		* https://github.com/google/oss-fuzz

services/audiopolicy/fuzzer/audiopolicy_fuzzer.cpp

0 → 100644

+972 −0

File added.

Preview size limit exceeded, changes collapsed.

services/audiopolicy/fuzzer/resources/Android.bp

0 → 100644

+27 −0

Original line number	Diff line number	Diff line
		/******************************************************************************
		*
		* Copyright (C) 2021 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at:
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*
		******************************************************************************/

		filegroup {
		name: "audiopolicyfuzzer_configuration_files",
		srcs: [
		"test_audio_policy_configuration.xml",
		"test_audio_policy_msd_configuration.xml",
		"test_audio_policy_primary_only_configuration.xml",
		"test_tv_apm_configuration.xml",
		],
		}

services/audiopolicy/fuzzer/resources/test_audio_policy_configuration.xml

0 → 100644

+111 −0

Original line number	Diff line number	Diff line
		<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
		<!-- Copyright (C) 2021 The Android Open Source Project

		Licensed under the Apache License, Version 2.0 (the "License");
		you may not use this file except in compliance with the License.
		You may obtain a copy of the License at

		http://www.apache.org/licenses/LICENSE-2.0

		Unless required by applicable law or agreed to in writing, software
		distributed under the License is distributed on an "AS IS" BASIS,
		WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		See the License for the specific language governing permissions and
		limitations under the License.
		-->

		<audioPolicyConfiguration version="1.0" xmlns:xi="http://www.w3.org/2001/XInclude">
		<globalConfiguration speaker_drc_enabled="true"/>

		<modules>
		<!-- Primary module -->
		<module name="primary" halVersion="2.0">
		<attachedDevices>
		<item>Speaker</item>
		<item>Built-In Mic</item>
		</attachedDevices>
		<defaultOutputDevice>Speaker</defaultOutputDevice>
		<mixPorts>
		<mixPort name="primary output" role="source" flags="AUDIO_OUTPUT_FLAG_PRIMARY">
		<profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
		samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
		</mixPort>
		<mixPort name="primary input" role="sink">
		<profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
		samplingRates="48000"
		channelMasks="AUDIO_CHANNEL_IN_STEREO"/>
		</mixPort>
		<mixPort name="mixport_bt_hfp_output" role="source">
		<profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
		samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
		</mixPort>
		<mixPort name="mixport_bt_hfp_input" role="sink">
		<profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
		samplingRates="8000,11025,16000,44100,48000"
		channelMasks="AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_MONO"/>
		</mixPort>
		</mixPorts>
		<devicePorts>
		<devicePort tagName="Speaker" type="AUDIO_DEVICE_OUT_SPEAKER" role="sink">
		</devicePort>
		<devicePort tagName="Built-In Mic" type="AUDIO_DEVICE_IN_BUILTIN_MIC" role="source">
		</devicePort>
		<devicePort tagName="Hdmi" type="AUDIO_DEVICE_OUT_HDMI" role="sink">
		</devicePort>
		<devicePort tagName="Hdmi-In Mic" type="AUDIO_DEVICE_IN_HDMI" role="source">
		</devicePort>
		<devicePort tagName="BT SCO" type="AUDIO_DEVICE_OUT_BLUETOOTH_SCO"
		role="sink" address="hfp_client_out">
		</devicePort>
		<devicePort tagName="BT SCO Headset Mic" type="AUDIO_DEVICE_IN_BLUETOOTH_SCO_HEADSET"
		role="source" address="hfp_client_in">
		</devicePort>
		</devicePorts>
		<routes>
		<route type="mix" sink="Speaker"
		sources="primary output"/>
		<route type="mix" sink="primary input"
		sources="Built-In Mic,Hdmi-In Mic"/>
		<route type="mix" sink="Hdmi"
		sources="primary output"/>
		<route type="mix" sink="BT SCO"
		sources="mixport_bt_hfp_output"/>
		<route type="mix" sink="mixport_bt_hfp_input"
		sources="BT SCO Headset Mic"/>
		</routes>
		</module>

		<!-- Remote Submix module -->
		<module name="r_submix" halVersion="2.0">
		<attachedDevices>
		<item>Remote Submix In</item>
		</attachedDevices>
		<mixPorts>
		<mixPort name="r_submix output" role="source">
		<profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
		samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
		</mixPort>
		<mixPort name="r_submix input" role="sink">
		<profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
		samplingRates="48000" channelMasks="AUDIO_CHANNEL_IN_STEREO"/>
		</mixPort>
		</mixPorts>
		<devicePorts>
		<devicePort tagName="Remote Submix Out" type="AUDIO_DEVICE_OUT_REMOTE_SUBMIX" role="sink">
		<profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
		samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
		</devicePort>
		<devicePort tagName="Remote Submix In" type="AUDIO_DEVICE_IN_REMOTE_SUBMIX" role="source">
		<profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
		samplingRates="48000" channelMasks="AUDIO_CHANNEL_IN_STEREO"/>
		</devicePort>
		</devicePorts>
		<routes>
		<route type="mix" sink="Remote Submix Out"
		sources="r_submix output"/>
		<route type="mix" sink="r_submix input"
		sources="Remote Submix In"/>
		</routes>
		</module>
		</modules>
		</audioPolicyConfiguration>