Merge "Refactored libaaudio_fuzzer" into main (a866fcc6) · Commits · e / os / android_frameworks_av

media/libaaudio/fuzzer/libaaudio_fuzzer.cpp

+157 −108

Original line number	Original line	Diff line number	Diff line
	@@ -20,7 +20,7 @@
	#include <fuzzer/FuzzedDataProvider.h>		#include <fuzzer/FuzzedDataProvider.h>

	constexpr int32_t kRandomStringLength = 256;		constexpr int32_t kRandomStringLength = 256;
			constexpr int32_t kMaxRuns = 100;
	constexpr int64_t kNanosPerMillisecond = 1000 * 1000;		constexpr int64_t kNanosPerMillisecond = 1000 * 1000;

	constexpr aaudio_direction_t kDirections[] = {		constexpr aaudio_direction_t kDirections[] = {
	@@ -97,6 +97,7 @@ class LibAaudioFuzzer {
	public:		public:
	~LibAaudioFuzzer() { deInit(); }		~LibAaudioFuzzer() { deInit(); }
	bool init();		bool init();
			void invokeAAudioSetAPIs(FuzzedDataProvider &fdp);
	void process(const uint8_t *data, size_t size);		void process(const uint8_t *data, size_t size);
	void deInit();		void deInit();

	@@ -113,47 +114,42 @@ bool LibAaudioFuzzer::init() {
	return true;		return true;
	}		}

	void LibAaudioFuzzer::process(const uint8_t *data, size_t size) {		void LibAaudioFuzzer::invokeAAudioSetAPIs(FuzzedDataProvider &fdp){
	FuzzedDataProvider fdp(data, size);		aaudio_performance_mode_t mode = fdp.PickValueInArray(
	aaudio_performance_mode_t mode =		{fdp.PickValueInArray(kPerformanceModes), fdp.ConsumeIntegral<int32_t>()});
	fdp.PickValueInArray({fdp.PickValueInArray(kPerformanceModes),
	fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setPerformanceMode(mAaudioBuilder, mode);		AAudioStreamBuilder_setPerformanceMode(mAaudioBuilder, mode);

	int32_t deviceId = fdp.PickValueInArray(		int32_t deviceId = fdp.PickValueInArray({AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
	{AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setDeviceId(mAaudioBuilder, deviceId);		AAudioStreamBuilder_setDeviceId(mAaudioBuilder, deviceId);

	std::string packageName = fdp.PickValueInArray<std::string>(		std::string packageName =
	{"android.nativemedia.aaudio", "android.app.appops.cts",		fdp.PickValueInArray<std::string>({"android.nativemedia.aaudio", "android.app.appops.cts",
	fdp.ConsumeRandomLengthString(kRandomStringLength)});		fdp.ConsumeRandomLengthString(kRandomStringLength)});
	AAudioStreamBuilder_setPackageName(mAaudioBuilder, packageName.c_str());		AAudioStreamBuilder_setPackageName(mAaudioBuilder, packageName.c_str());

	std::string attributionTag =		std::string attributionTag = fdp.ConsumeRandomLengthString(kRandomStringLength);
	fdp.ConsumeRandomLengthString(kRandomStringLength);
	AAudioStreamBuilder_setAttributionTag(mAaudioBuilder, attributionTag.c_str());		AAudioStreamBuilder_setAttributionTag(mAaudioBuilder, attributionTag.c_str());

	int32_t sampleRate = fdp.PickValueInArray(kSampleRates);		int32_t sampleRate = fdp.PickValueInArray(kSampleRates);
	AAudioStreamBuilder_setSampleRate(mAaudioBuilder, sampleRate);		AAudioStreamBuilder_setSampleRate(mAaudioBuilder, sampleRate);

	int32_t channelCount = fdp.PickValueInArray(		int32_t channelCount = fdp.PickValueInArray({AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
	{AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setChannelCount(mAaudioBuilder, channelCount);		AAudioStreamBuilder_setChannelCount(mAaudioBuilder, channelCount);

	aaudio_direction_t direction = fdp.PickValueInArray(		aaudio_direction_t direction =
	{fdp.PickValueInArray(kDirections), fdp.ConsumeIntegral<int32_t>()});		fdp.PickValueInArray({fdp.PickValueInArray(kDirections), fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setDirection(mAaudioBuilder, direction);		AAudioStreamBuilder_setDirection(mAaudioBuilder, direction);

	aaudio_format_t format = fdp.PickValueInArray(		aaudio_format_t format =
	{fdp.PickValueInArray(kFormats), fdp.ConsumeIntegral<int32_t>()});		fdp.PickValueInArray({fdp.PickValueInArray(kFormats), fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setFormat(mAaudioBuilder, format);		AAudioStreamBuilder_setFormat(mAaudioBuilder, format);

	aaudio_sharing_mode_t sharingMode = fdp.PickValueInArray(		aaudio_sharing_mode_t sharingMode = fdp.PickValueInArray(
	{fdp.PickValueInArray(kSharingModes), fdp.ConsumeIntegral<int32_t>()});		{fdp.PickValueInArray(kSharingModes), fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setSharingMode(mAaudioBuilder, sharingMode);		AAudioStreamBuilder_setSharingMode(mAaudioBuilder, sharingMode);

	aaudio_usage_t usage = fdp.PickValueInArray(		aaudio_usage_t usage =
	{fdp.PickValueInArray(kUsages), fdp.ConsumeIntegral<int32_t>()});		fdp.PickValueInArray({fdp.PickValueInArray(kUsages), fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setUsage(mAaudioBuilder, usage);		AAudioStreamBuilder_setUsage(mAaudioBuilder, usage);

	aaudio_content_type_t contentType = fdp.PickValueInArray(		aaudio_content_type_t contentType = fdp.PickValueInArray(
	@@ -167,57 +163,78 @@ void LibAaudioFuzzer::process(const uint8_t *data, size_t size) {
	bool privacySensitive = fdp.ConsumeBool();		bool privacySensitive = fdp.ConsumeBool();
	AAudioStreamBuilder_setPrivacySensitive(mAaudioBuilder, privacySensitive);		AAudioStreamBuilder_setPrivacySensitive(mAaudioBuilder, privacySensitive);

	int32_t frames = fdp.PickValueInArray(		int32_t frames = fdp.PickValueInArray({AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
	{AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setBufferCapacityInFrames(mAaudioBuilder, frames);		AAudioStreamBuilder_setBufferCapacityInFrames(mAaudioBuilder, frames);

	aaudio_allowed_capture_policy_t allowedCapturePolicy =		aaudio_allowed_capture_policy_t allowedCapturePolicy = fdp.PickValueInArray(
	fdp.PickValueInArray({fdp.PickValueInArray(kAllowedCapturePolicies),		{fdp.PickValueInArray(kAllowedCapturePolicies), fdp.ConsumeIntegral<int32_t>()});
	fdp.ConsumeIntegral<int32_t>()});		AAudioStreamBuilder_setAllowedCapturePolicy(mAaudioBuilder, allowedCapturePolicy);
	AAudioStreamBuilder_setAllowedCapturePolicy(mAaudioBuilder,
	allowedCapturePolicy);

	aaudio_session_id_t sessionId = fdp.PickValueInArray(		aaudio_session_id_t sessionId =
	{fdp.PickValueInArray(kSessionIds), fdp.ConsumeIntegral<int32_t>()});		fdp.PickValueInArray({fdp.PickValueInArray(kSessionIds), fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setSessionId(mAaudioBuilder, sessionId);		AAudioStreamBuilder_setSessionId(mAaudioBuilder, sessionId);

	AAudioStreamBuilder_setDataCallback(mAaudioBuilder, nullptr, nullptr);		AAudioStreamBuilder_setDataCallback(mAaudioBuilder, nullptr, nullptr);
	AAudioStreamBuilder_setErrorCallback(mAaudioBuilder, nullptr, nullptr);		AAudioStreamBuilder_setErrorCallback(mAaudioBuilder, nullptr, nullptr);

	int32_t framesPerDataCallback = fdp.PickValueInArray(		int32_t framesPerDataCallback =
	{AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});		fdp.PickValueInArray({AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
	AAudioStreamBuilder_setFramesPerDataCallback(mAaudioBuilder,		AAudioStreamBuilder_setFramesPerDataCallback(mAaudioBuilder, framesPerDataCallback);
	framesPerDataCallback);

	aaudio_policy_t policy = fdp.PickValueInArray(		aaudio_policy_t policy =
	{fdp.PickValueInArray(kPolicies), fdp.ConsumeIntegral<int32_t>()});		fdp.PickValueInArray({fdp.PickValueInArray(kPolicies), fdp.ConsumeIntegral<int32_t>()});
	AAudio_setMMapPolicy(policy);		AAudio_setMMapPolicy(policy);
	(void)AAudio_getMMapPolicy();		}

			void LibAaudioFuzzer::process(const uint8_t *data, size_t size) {
			FuzzedDataProvider fdp(data, size);
			int32_t maxFrames = 0;
			int32_t count = 0;
			aaudio_stream_state_t state = AAUDIO_STREAM_STATE_UNKNOWN;

	aaudio_result_t result =		invokeAAudioSetAPIs(fdp);
	AAudioStreamBuilder_openStream(mAaudioBuilder, &mAaudioStream);
			aaudio_result_t result = AAudioStreamBuilder_openStream(mAaudioBuilder, &mAaudioStream);
	if ((result != AAUDIO_OK) \|\| (!mAaudioStream)) {		if ((result != AAUDIO_OK) \|\| (!mAaudioStream)) {
	return;		return;
	}		}
			/* The 'runs' variable serves to set an upper limit on the loop iterations, preventing excessive
			* execution.
			*/
			int32_t runs = kMaxRuns;
			while (fdp.remaining_bytes() > 0 && --runs) {
			auto AAudioapi = fdp.PickValueInArray<const std::function<void()>>({
			[&]() { (void)AAudio_getMMapPolicy(); },

			[&]() {
	int32_t framesPerBurst = AAudioStream_getFramesPerBurst(mAaudioStream);		int32_t framesPerBurst = AAudioStream_getFramesPerBurst(mAaudioStream);
	uint8_t numberOfBursts = fdp.ConsumeIntegral<uint8_t>();		uint8_t numberOfBursts = fdp.ConsumeIntegral<uint8_t>();
	int32_t maxFrames = numberOfBursts * framesPerBurst;		maxFrames = numberOfBursts * framesPerBurst;
	int32_t requestedBufferSize =		int32_t requestedBufferSize = fdp.ConsumeIntegral<uint16_t>() * framesPerBurst;
	fdp.ConsumeIntegral<uint16_t>() * framesPerBurst;
	AAudioStream_setBufferSizeInFrames(mAaudioStream, requestedBufferSize);		AAudioStream_setBufferSizeInFrames(mAaudioStream, requestedBufferSize);
			},
			[&]() {
	int64_t position = 0, nanoseconds = 0;		int64_t position = 0, nanoseconds = 0;
	AAudioStream_getTimestamp(mAaudioStream, CLOCK_MONOTONIC, &position,		AAudioStream_getTimestamp(mAaudioStream, CLOCK_MONOTONIC, &position, &nanoseconds);
	&nanoseconds);		},
			[&]() {
	AAudioStream_requestStart(mAaudioStream);		AAudioStream_requestStart(mAaudioStream);
			},
			[&]() {
			AAudioStream_requestPause(mAaudioStream);
			},
			[&]() {
			AAudioStream_requestFlush(mAaudioStream);
			},
			[&]() {
			AAudioStream_requestStop(mAaudioStream);
			},
			[&]() {
	aaudio_format_t actualFormat = AAudioStream_getFormat(mAaudioStream);		aaudio_format_t actualFormat = AAudioStream_getFormat(mAaudioStream);
	int32_t actualChannelCount = AAudioStream_getChannelCount(mAaudioStream);		int32_t actualChannelCount = AAudioStream_getChannelCount(mAaudioStream);

	int32_t count = fdp.ConsumeIntegral<int32_t>();		count = fdp.ConsumeIntegral<int32_t>();
	direction = AAudioStream_getDirection(mAaudioStream);		aaudio_direction_t direction = AAudioStream_getDirection(mAaudioStream);

	if (actualFormat == AAUDIO_FORMAT_PCM_I16) {		if (actualFormat == AAUDIO_FORMAT_PCM_I16) {
	std::vector<int16_t> inputShortData(maxFrames * actualChannelCount, 0x0);		std::vector<int16_t> inputShortData(maxFrames * actualChannelCount, 0x0);
	@@ -238,35 +255,67 @@ void LibAaudioFuzzer::process(const uint8_t *data, size_t size) {
	count * kNanosPerMillisecond);		count * kNanosPerMillisecond);
	}		}
	}		}
			},
	aaudio_stream_state_t state = AAUDIO_STREAM_STATE_UNKNOWN;		[&]() {
	AAudioStream_waitForStateChange(mAaudioStream, AAUDIO_STREAM_STATE_UNKNOWN,		AAudioStream_waitForStateChange(mAaudioStream, AAUDIO_STREAM_STATE_UNKNOWN, &state,
	&state, count * kNanosPerMillisecond);		count * kNanosPerMillisecond);
	(void)AAudio_convertStreamStateToText(state);		},
			[&]() { (void)AAudio_convertStreamStateToText(state); },
	(void)AAudioStream_getUsage(mAaudioStream);		[&]() {
	(void)AAudioStream_getSampleRate(mAaudioStream);
	(void)AAudioStream_getState(mAaudioStream);		(void)AAudioStream_getState(mAaudioStream);
			},
			[&]() {
			(void)AAudioStream_getUsage(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getSamplesPerFrame(mAaudioStream);		(void)AAudioStream_getSamplesPerFrame(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getContentType(mAaudioStream);		(void)AAudioStream_getContentType(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getInputPreset(mAaudioStream);		(void)AAudioStream_getInputPreset(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_isPrivacySensitive(mAaudioStream);		(void)AAudioStream_isPrivacySensitive(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getAllowedCapturePolicy(mAaudioStream);		(void)AAudioStream_getAllowedCapturePolicy(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getPerformanceMode(mAaudioStream);		(void)AAudioStream_getPerformanceMode(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getDeviceId(mAaudioStream);		(void)AAudioStream_getDeviceId(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getSharingMode(mAaudioStream);		(void)AAudioStream_getSharingMode(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getSessionId(mAaudioStream);		(void)AAudioStream_getSessionId(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getFramesRead(mAaudioStream);		(void)AAudioStream_getFramesRead(mAaudioStream);
	(void)AAudioStream_getFramesWritten(mAaudioStream);		},
			[&]() {
	(void)AAudioStream_getXRunCount(mAaudioStream);		(void)AAudioStream_getXRunCount(mAaudioStream);
			},
			[&]() {
			(void)AAudioStream_getFramesWritten(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getBufferCapacityInFrames(mAaudioStream);		(void)AAudioStream_getBufferCapacityInFrames(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_getBufferSizeInFrames(mAaudioStream);		(void)AAudioStream_getBufferSizeInFrames(mAaudioStream);
			},
			[&]() {
	(void)AAudioStream_isMMapUsed(mAaudioStream);		(void)AAudioStream_isMMapUsed(mAaudioStream);
			},
	AAudioStream_requestPause(mAaudioStream);		});
	AAudioStream_requestFlush(mAaudioStream);		AAudioapi();
			}
	AAudioStream_release(mAaudioStream);		AAudioStream_release(mAaudioStream);
	AAudioStream_requestStop(mAaudioStream);
	}		}

	void LibAaudioFuzzer::deInit() {		void LibAaudioFuzzer::deInit() {