Audio Fuzzers : Use Mock HAL services
Use the created audioFlingerService binder instead of fetching from ServiceManager
Use the existing FDP instead of creating a new object
Bug: 298548691
Test: ./audioflinger_aidl_fuzzer
Test: ./audiopolicy_aidl_fuzzer
Change-Id: Ide53be0db52050c457b1f53322aee96a4d4fb66d
diff --git a/media/libaudioclient/aidl/fuzzer/Android.bp b/media/libaudioclient/aidl/fuzzer/Android.bp
index b0d48e6..706b905 100644
--- a/media/libaudioclient/aidl/fuzzer/Android.bp
+++ b/media/libaudioclient/aidl/fuzzer/Android.bp
@@ -19,6 +19,7 @@
static_libs: [
"android.hardware.audio.common@7.0-enums",
"effect-aidl-cpp",
+ "libaudiomockhal",
"libcgrouprc",
"libcgrouprc_format",
"libfakeservicemanager",
@@ -90,6 +91,9 @@
srcs: ["audioflinger_aidl_fuzzer.cpp"],
defaults: [
"libaudioclient_aidl_fuzzer_defaults",
+ "latest_android_hardware_audio_core_ndk_shared",
+ "latest_android_hardware_audio_core_sounddose_ndk_shared",
+ "latest_android_hardware_audio_effect_ndk_shared",
"service_fuzzer_defaults",
],
}
diff --git a/media/libaudioclient/aidl/fuzzer/audioflinger_aidl_fuzzer.cpp b/media/libaudioclient/aidl/fuzzer/audioflinger_aidl_fuzzer.cpp
index f99cc3b..5e4f9a1 100644
--- a/media/libaudioclient/aidl/fuzzer/audioflinger_aidl_fuzzer.cpp
+++ b/media/libaudioclient/aidl/fuzzer/audioflinger_aidl_fuzzer.cpp
@@ -17,8 +17,12 @@
#include <AudioFlinger.h>
#include <android-base/logging.h>
#include <android/binder_interface_utils.h>
+#include <android/binder_manager.h>
#include <android/binder_process.h>
#include <android/media/IAudioPolicyService.h>
+#include <core-mock/ConfigMock.h>
+#include <core-mock/ModuleMock.h>
+#include <effect-mock/FactoryMock.h>
#include <fakeservicemanager/FakeServiceManager.h>
#include <fuzzbinder/libbinder_driver.h>
#include <fuzzbinder/random_binder.h>
@@ -53,14 +57,26 @@
});
gFakeServiceManager->clear();
- for (const char* service :
- {"activity", "sensor_privacy", "permission", "scheduling_policy",
- "android.hardware.audio.core.IConfig", "batterystats", "media.metrics"}) {
+ for (const char* service : {"activity", "sensor_privacy", "permission", "scheduling_policy",
+ "batterystats", "media.metrics"}) {
if (!addService(String16(service), gFakeServiceManager, fdp)) {
return 0;
}
}
+ auto configService = ndk::SharedRefBase::make<ConfigMock>();
+ CHECK_EQ(NO_ERROR, AServiceManager_addService(configService.get()->asBinder().get(),
+ "android.hardware.audio.core.IConfig/default"));
+
+ auto factoryService = ndk::SharedRefBase::make<FactoryMock>();
+ CHECK_EQ(NO_ERROR,
+ AServiceManager_addService(factoryService.get()->asBinder().get(),
+ "android.hardware.audio.effect.IFactory/default"));
+
+ auto moduleService = ndk::SharedRefBase::make<ModuleMock>();
+ CHECK_EQ(NO_ERROR, AServiceManager_addService(moduleService.get()->asBinder().get(),
+ "android.hardware.audio.core.IModule/default"));
+
const auto audioFlinger = sp<AudioFlinger>::make();
const auto afAdapter = sp<AudioFlingerServerAdapter>::make(audioFlinger);
@@ -77,12 +93,7 @@
false /* allowIsolated */,
IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT));
- sp<IBinder> audioFlingerServiceBinder =
- gFakeServiceManager->getService(String16(IAudioFlinger::DEFAULT_SERVICE_NAME));
- sp<media::IAudioFlingerService> audioFlingerService =
- interface_cast<media::IAudioFlingerService>(audioFlingerServiceBinder);
-
- fuzzService(media::IAudioFlingerService::asBinder(audioFlingerService), std::move(fdp));
+ fuzzService(media::IAudioFlingerService::asBinder(afAdapter), std::move(fdp));
return 0;
}
diff --git a/services/audiopolicy/fuzzer/aidl/Android.bp b/services/audiopolicy/fuzzer/aidl/Android.bp
index 38a2cde..671c880 100644
--- a/services/audiopolicy/fuzzer/aidl/Android.bp
+++ b/services/audiopolicy/fuzzer/aidl/Android.bp
@@ -40,6 +40,7 @@
"packagemanager_aidl-cpp",
],
static_libs: [
+ "libaudiomockhal",
"libfakeservicemanager",
"libmediaplayerservice",
],
@@ -69,6 +70,9 @@
srcs: ["audiopolicy_aidl_fuzzer.cpp"],
defaults: [
"audiopolicy_aidl_fuzzer_defaults",
+ "latest_android_hardware_audio_core_ndk_shared",
+ "latest_android_hardware_audio_core_sounddose_ndk_shared",
+ "latest_android_hardware_audio_effect_ndk_shared",
"service_fuzzer_defaults",
],
}
diff --git a/services/audiopolicy/fuzzer/aidl/audiopolicy_aidl_fuzzer.cpp b/services/audiopolicy/fuzzer/aidl/audiopolicy_aidl_fuzzer.cpp
index ca79c49..3d972dc 100644
--- a/services/audiopolicy/fuzzer/aidl/audiopolicy_aidl_fuzzer.cpp
+++ b/services/audiopolicy/fuzzer/aidl/audiopolicy_aidl_fuzzer.cpp
@@ -18,8 +18,12 @@
#include <AudioFlinger.h>
#include <android-base/logging.h>
#include <android/binder_interface_utils.h>
+#include <android/binder_manager.h>
#include <android/binder_process.h>
#include <android/media/IAudioPolicyService.h>
+#include <core-mock/ConfigMock.h>
+#include <core-mock/ModuleMock.h>
+#include <effect-mock/FactoryMock.h>
#include <fakeservicemanager/FakeServiceManager.h>
#include <fuzzbinder/libbinder_driver.h>
#include <fuzzbinder/random_binder.h>
@@ -55,14 +59,26 @@
});
gFakeServiceManager->clear();
- for (const char* service :
- {"activity", "sensor_privacy", "permission", "scheduling_policy",
- "android.hardware.audio.core.IConfig", "batterystats", "media.metrics"}) {
+ for (const char* service : {"activity", "sensor_privacy", "permission", "scheduling_policy",
+ "batterystats", "media.metrics"}) {
if (!addService(String16(service), gFakeServiceManager, fdp)) {
return 0;
}
}
+ auto configService = ndk::SharedRefBase::make<ConfigMock>();
+ CHECK_EQ(NO_ERROR, AServiceManager_addService(configService.get()->asBinder().get(),
+ "android.hardware.audio.core.IConfig/default"));
+
+ auto factoryService = ndk::SharedRefBase::make<FactoryMock>();
+ CHECK_EQ(NO_ERROR,
+ AServiceManager_addService(factoryService.get()->asBinder().get(),
+ "android.hardware.audio.effect.IFactory/default"));
+
+ auto moduleService = ndk::SharedRefBase::make<ModuleMock>();
+ CHECK_EQ(NO_ERROR, AServiceManager_addService(moduleService.get()->asBinder().get(),
+ "android.hardware.audio.core.IModule/default"));
+
const auto audioFlinger = sp<AudioFlinger>::make();
const auto afAdapter = sp<AudioFlingerServerAdapter>::make(audioFlinger);
@@ -79,8 +95,7 @@
false /* allowIsolated */,
IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT));
- fuzzService(media::IAudioPolicyService::asBinder(audioPolicyService),
- FuzzedDataProvider(data, size));
+ fuzzService(media::IAudioPolicyService::asBinder(audioPolicyService), std::move(fdp));
return 0;
}