Merge "Audio Fuzzers : Use Mock HAL services" into main (791c42a6) · Commits · e / os / android_frameworks_av

media/libaudioclient/aidl/fuzzer/Android.bp

+4 −0

Original line number	Diff line number	Diff line
		@@ -19,6 +19,7 @@ cc_defaults {
		static_libs: [
		"android.hardware.audio.common@7.0-enums",
		"effect-aidl-cpp",
		"libaudiomockhal",
		"libcgrouprc",
		"libcgrouprc_format",
		"libfakeservicemanager",
		@@ -90,6 +91,9 @@ cc_fuzz {
		srcs: ["audioflinger_aidl_fuzzer.cpp"],
		defaults: [
		"libaudioclient_aidl_fuzzer_defaults",
		"latest_android_hardware_audio_core_ndk_shared",
		"latest_android_hardware_audio_core_sounddose_ndk_shared",
		"latest_android_hardware_audio_effect_ndk_shared",
		"service_fuzzer_defaults",
		],
		}

media/libaudioclient/aidl/fuzzer/audioflinger_aidl_fuzzer.cpp

+20 −9

Original line number	Diff line number	Diff line
		@@ -17,8 +17,12 @@
		#include <AudioFlinger.h>
		#include <android-base/logging.h>
		#include <android/binder_interface_utils.h>
		#include <android/binder_manager.h>
		#include <android/binder_process.h>
		#include <android/media/IAudioPolicyService.h>
		#include <core-mock/ConfigMock.h>
		#include <core-mock/ModuleMock.h>
		#include <effect-mock/FactoryMock.h>
		#include <fakeservicemanager/FakeServiceManager.h>
		#include <fuzzbinder/libbinder_driver.h>
		#include <fuzzbinder/random_binder.h>
		@@ -53,14 +57,26 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		});
		gFakeServiceManager->clear();

		for (const char* service :
		{"activity", "sensor_privacy", "permission", "scheduling_policy",
		"android.hardware.audio.core.IConfig", "batterystats", "media.metrics"}) {
		for (const char* service : {"activity", "sensor_privacy", "permission", "scheduling_policy",
		"batterystats", "media.metrics"}) {
		if (!addService(String16(service), gFakeServiceManager, fdp)) {
		return 0;
		}
		}

		auto configService = ndk::SharedRefBase::make<ConfigMock>();
		CHECK_EQ(NO_ERROR, AServiceManager_addService(configService.get()->asBinder().get(),
		"android.hardware.audio.core.IConfig/default"));

		auto factoryService = ndk::SharedRefBase::make<FactoryMock>();
		CHECK_EQ(NO_ERROR,
		AServiceManager_addService(factoryService.get()->asBinder().get(),
		"android.hardware.audio.effect.IFactory/default"));

		auto moduleService = ndk::SharedRefBase::make<ModuleMock>();
		CHECK_EQ(NO_ERROR, AServiceManager_addService(moduleService.get()->asBinder().get(),
		"android.hardware.audio.core.IModule/default"));

		const auto audioFlinger = sp<AudioFlinger>::make();
		const auto afAdapter = sp<AudioFlingerServerAdapter>::make(audioFlinger);

		@@ -77,12 +93,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		false /* allowIsolated */,
		IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT));

		sp<IBinder> audioFlingerServiceBinder =
		gFakeServiceManager->getService(String16(IAudioFlinger::DEFAULT_SERVICE_NAME));
		sp<media::IAudioFlingerService> audioFlingerService =
		interface_cast<media::IAudioFlingerService>(audioFlingerServiceBinder);

		fuzzService(media::IAudioFlingerService::asBinder(audioFlingerService), std::move(fdp));
		fuzzService(media::IAudioFlingerService::asBinder(afAdapter), std::move(fdp));

		return 0;
		}

services/audiopolicy/fuzzer/aidl/Android.bp

+4 −0

Original line number	Diff line number	Diff line
		@@ -40,6 +40,7 @@ cc_defaults {
		"packagemanager_aidl-cpp",
		],
		static_libs: [
		"libaudiomockhal",
		"libfakeservicemanager",
		"libmediaplayerservice",
		],
		@@ -69,6 +70,9 @@ cc_fuzz {
		srcs: ["audiopolicy_aidl_fuzzer.cpp"],
		defaults: [
		"audiopolicy_aidl_fuzzer_defaults",
		"latest_android_hardware_audio_core_ndk_shared",
		"latest_android_hardware_audio_core_sounddose_ndk_shared",
		"latest_android_hardware_audio_effect_ndk_shared",
		"service_fuzzer_defaults",
		],
		}

services/audiopolicy/fuzzer/aidl/audiopolicy_aidl_fuzzer.cpp

+20 −5

Original line number	Diff line number	Diff line
		@@ -18,8 +18,12 @@
		#include <AudioFlinger.h>
		#include <android-base/logging.h>
		#include <android/binder_interface_utils.h>
		#include <android/binder_manager.h>
		#include <android/binder_process.h>
		#include <android/media/IAudioPolicyService.h>
		#include <core-mock/ConfigMock.h>
		#include <core-mock/ModuleMock.h>
		#include <effect-mock/FactoryMock.h>
		#include <fakeservicemanager/FakeServiceManager.h>
		#include <fuzzbinder/libbinder_driver.h>
		#include <fuzzbinder/random_binder.h>
		@@ -55,14 +59,26 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		});
		gFakeServiceManager->clear();

		for (const char* service :
		{"activity", "sensor_privacy", "permission", "scheduling_policy",
		"android.hardware.audio.core.IConfig", "batterystats", "media.metrics"}) {
		for (const char* service : {"activity", "sensor_privacy", "permission", "scheduling_policy",
		"batterystats", "media.metrics"}) {
		if (!addService(String16(service), gFakeServiceManager, fdp)) {
		return 0;
		}
		}

		auto configService = ndk::SharedRefBase::make<ConfigMock>();
		CHECK_EQ(NO_ERROR, AServiceManager_addService(configService.get()->asBinder().get(),
		"android.hardware.audio.core.IConfig/default"));

		auto factoryService = ndk::SharedRefBase::make<FactoryMock>();
		CHECK_EQ(NO_ERROR,
		AServiceManager_addService(factoryService.get()->asBinder().get(),
		"android.hardware.audio.effect.IFactory/default"));

		auto moduleService = ndk::SharedRefBase::make<ModuleMock>();
		CHECK_EQ(NO_ERROR, AServiceManager_addService(moduleService.get()->asBinder().get(),
		"android.hardware.audio.core.IModule/default"));

		const auto audioFlinger = sp<AudioFlinger>::make();
		const auto afAdapter = sp<AudioFlingerServerAdapter>::make(audioFlinger);

		@@ -79,8 +95,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		false /* allowIsolated */,
		IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT));

		fuzzService(media::IAudioPolicyService::asBinder(audioPolicyService),
		FuzzedDataProvider(data, size));
		fuzzService(media::IAudioPolicyService::asBinder(audioPolicyService), std::move(fdp));

		return 0;
		}