Refactored mediaplayer_fuzzer
The following are the updates to the fuzzer:
1. API and Parameter Randomization.
2. Coverage improved from 47% to 60% with initial corpus feed.
execs/s: 10
Test: ./mediaplayer_fuzzer corpus/
Bug: 313038371
Change-Id: Ife29936adffa7d8c4cab32f1db20baaa7e9f2f8f
diff --git a/media/libmediaplayerservice/fuzzer/mediaplayer_fuzzer.cpp b/media/libmediaplayerservice/fuzzer/mediaplayer_fuzzer.cpp
index a189d04..652b1ee 100644
--- a/media/libmediaplayerservice/fuzzer/mediaplayer_fuzzer.cpp
+++ b/media/libmediaplayerservice/fuzzer/mediaplayer_fuzzer.cpp
@@ -15,9 +15,13 @@
*
*/
+#include <MediaExtractorService.h>
#include <MediaPlayerService.h>
+#include <android/gui/BnSurfaceComposerClient.h>
#include <camera/Camera.h>
#include <datasource/FileSource.h>
+#include <fuzzbinder/random_binder.h>
+#include <gmock/gmock.h>
#include <gui/Surface.h>
#include <gui/SurfaceComposerClient.h>
#include <media/IMediaCodecList.h>
@@ -31,40 +35,37 @@
#include <media/stagefright/RemoteDataSource.h>
#include <media/stagefright/foundation/base64.h>
#include <thread>
+#include "android-base/stringprintf.h"
#include "fuzzer/FuzzedDataProvider.h"
-
-constexpr int32_t kUuidSize = 16;
-constexpr int32_t kMaxSleepTimeInMs = 100;
-constexpr int32_t kMinSleepTimeInMs = 0;
-constexpr int32_t kPlayCountMin = 1;
-constexpr int32_t kPlayCountMax = 10;
-constexpr int32_t kMaxDimension = 8192;
-constexpr int32_t kMinDimension = 0;
-
using namespace std;
using namespace android;
-constexpr audio_session_t kSupportedAudioSessions[] = {
- AUDIO_SESSION_DEVICE, AUDIO_SESSION_OUTPUT_STAGE, AUDIO_SESSION_OUTPUT_MIX};
+constexpr int32_t kUuidSize = 16;
+constexpr int32_t kMinSize = 0;
+constexpr int32_t kMaxSize = 100;
+constexpr int32_t kFourCCVal = android::FOURCC('m', 't', 'r', 'X');
+constexpr int32_t kFlagVal =
+ ISurfaceComposerClient::eCursorWindow | ISurfaceComposerClient::eOpaque;
-constexpr audio_timestretch_stretch_mode_t kAudioStretchModes[] = {
- AUDIO_TIMESTRETCH_STRETCH_DEFAULT, AUDIO_TIMESTRETCH_STRETCH_VOICE};
+const char dumpFile[] = "OutputDumpFile";
-constexpr audio_timestretch_fallback_mode_t kAudioFallbackModes[] = {
- AUDIO_TIMESTRETCH_FALLBACK_CUT_REPEAT, AUDIO_TIMESTRETCH_FALLBACK_DEFAULT,
- AUDIO_TIMESTRETCH_FALLBACK_MUTE, AUDIO_TIMESTRETCH_FALLBACK_FAIL};
+enum DataSourceType { HTTP, FD, STREAM, FILETYPE, SOCKET, kMaxValue = SOCKET };
+
+constexpr PixelFormat kPixelFormat[] = {
+ PIXEL_FORMAT_UNKNOWN, PIXEL_FORMAT_NONE, PIXEL_FORMAT_CUSTOM,
+ PIXEL_FORMAT_TRANSLUCENT, PIXEL_FORMAT_TRANSPARENT, PIXEL_FORMAT_OPAQUE,
+ PIXEL_FORMAT_RGBA_8888, PIXEL_FORMAT_RGBX_8888, PIXEL_FORMAT_RGB_888,
+ PIXEL_FORMAT_RGB_565, PIXEL_FORMAT_BGRA_8888, PIXEL_FORMAT_RGBA_5551,
+ PIXEL_FORMAT_RGBA_4444, PIXEL_FORMAT_RGBA_FP16, PIXEL_FORMAT_RGBA_1010102,
+ PIXEL_FORMAT_R_8, PIXEL_FORMAT_R_16_UINT, PIXEL_FORMAT_RG_1616_UINT,
+ PIXEL_FORMAT_RGBA_10101010,
+};
constexpr media_parameter_keys kMediaParamKeys[] = {
KEY_PARAMETER_CACHE_STAT_COLLECT_FREQ_MS, KEY_PARAMETER_AUDIO_CHANNEL_COUNT,
KEY_PARAMETER_PLAYBACK_RATE_PERMILLE, KEY_PARAMETER_AUDIO_ATTRIBUTES,
KEY_PARAMETER_RTP_ATTRIBUTES};
-constexpr audio_stream_type_t kAudioStreamTypes[] = {
- AUDIO_STREAM_DEFAULT, AUDIO_STREAM_VOICE_CALL, AUDIO_STREAM_SYSTEM,
- AUDIO_STREAM_RING, AUDIO_STREAM_MUSIC, AUDIO_STREAM_ALARM,
- AUDIO_STREAM_NOTIFICATION, AUDIO_STREAM_BLUETOOTH_SCO, AUDIO_STREAM_ENFORCED_AUDIBLE,
- AUDIO_STREAM_DTMF, AUDIO_STREAM_TTS, AUDIO_STREAM_ASSISTANT};
-
constexpr media_event_type kMediaEventTypes[] = {MEDIA_NOP,
MEDIA_PREPARED,
MEDIA_PLAYBACK_COMPLETE,
@@ -140,9 +141,26 @@
DISALLOW_EVIL_CONSTRUCTORS(TestMediaHTTPService);
};
-class BinderDeathNotifier : public IBinder::DeathRecipient {
- public:
- void binderDied(const wp<IBinder> &) { abort(); }
+class FakeBnSurfaceComposerClient : public gui::BnSurfaceComposerClient {
+ public:
+ MOCK_METHOD(binder::Status, createSurface,
+ (const std::string& name, int32_t flags, const sp<IBinder>& parent,
+ const gui::LayerMetadata& metadata, gui::CreateSurfaceResult* outResult),
+ (override));
+
+ MOCK_METHOD(binder::Status, clearLayerFrameStats, (const sp<IBinder>& handle), (override));
+
+ MOCK_METHOD(binder::Status, getLayerFrameStats,
+ (const sp<IBinder>& handle, gui::FrameStats* outStats), (override));
+
+ MOCK_METHOD(binder::Status, mirrorSurface,
+ (const sp<IBinder>& mirrorFromHandle, gui::CreateSurfaceResult* outResult),
+ (override));
+
+ MOCK_METHOD(binder::Status, mirrorDisplay,
+ (int64_t displayId, gui::CreateSurfaceResult* outResult), (override));
+
+ MOCK_METHOD(binder::Status, getSchedulingPolicy, (gui::SchedulingPolicy*), (override));
};
class MediaPlayerServiceFuzzer {
@@ -153,24 +171,40 @@
void process(const uint8_t *data, size_t size);
private:
- bool setDataSource(const uint8_t *data, size_t size);
- void invokeMediaPlayer();
- FuzzedDataProvider mFdp;
- sp<IMediaPlayer> mMediaPlayer = nullptr;
- sp<IMediaPlayerClient> mMediaPlayerClient = nullptr;
- const int32_t mDataSourceFd;
+ FuzzedDataProvider mFdp;
+ const int32_t mDataSourceFd;
+ sp<IMediaPlayer> mMediaPlayer = nullptr;
+ sp<IMediaPlayerClient> mMediaPlayerClient = nullptr;
+ void invokeMediaPlayer();
+ sp<SurfaceControl> makeSurfaceControl();
+ bool setDataSource(const uint8_t* data, size_t size);
};
-bool MediaPlayerServiceFuzzer::setDataSource(const uint8_t *data, size_t size) {
- status_t status = -1;
- enum DataSourceType {http, fd, stream, file, socket, kMaxValue = socket};
- switch (mFdp.ConsumeEnum<DataSourceType>()) {
- case http: {
+sp<SurfaceControl> MediaPlayerServiceFuzzer::makeSurfaceControl() {
+ sp<IBinder> handle = getRandomBinder(&mFdp);
+ const sp<FakeBnSurfaceComposerClient> testClient(new FakeBnSurfaceComposerClient());
+ sp<SurfaceComposerClient> client = new SurfaceComposerClient(testClient);
+ uint32_t width = mFdp.ConsumeIntegral<uint32_t>();
+ uint32_t height = mFdp.ConsumeIntegral<uint32_t>();
+ uint32_t transformHint = mFdp.ConsumeIntegral<uint32_t>();
+ uint32_t flags = mFdp.ConsumeBool() ? kFlagVal : mFdp.ConsumeIntegral<uint32_t>();
+ int32_t format = mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>()
+ : mFdp.PickValueInArray(kPixelFormat);
+ int32_t layerId = mFdp.ConsumeIntegral<int32_t>();
+ std::string layerName = android::base::StringPrintf("#%d", layerId);
+ return new SurfaceControl(client, handle, layerId, layerName, width, height, format,
+ transformHint, flags);
+}
+
+bool MediaPlayerServiceFuzzer::setDataSource(const uint8_t* data, size_t size) {
+ status_t status = UNKNOWN_ERROR;
+ switch (mFdp.ConsumeEnum<DataSourceType>()) {
+ case HTTP: {
KeyedVector<String8, String8> headers;
headers.add(String8(mFdp.ConsumeRandomLengthString().c_str()),
String8(mFdp.ConsumeRandomLengthString().c_str()));
- uint32_t dataBlobSize = mFdp.ConsumeIntegralInRange<uint16_t>(0, size);
+ uint32_t dataBlobSize = mFdp.ConsumeIntegralInRange<uint16_t>(kMinSize, size);
vector<uint8_t> uriSuffix = mFdp.ConsumeBytes<uint8_t>(dataBlobSize);
string uri(mFdp.PickValueInArray(kUrlPrefix));
@@ -183,18 +217,17 @@
mMediaPlayer->setDataSource(testService /*httpService*/, uri.c_str(), &headers);
break;
}
- case fd: {
+ case FD: {
write(mDataSourceFd, data, size);
-
status = mMediaPlayer->setDataSource(mDataSourceFd, 0, size);
break;
}
- case stream: {
+ case STREAM: {
sp<IStreamSource> streamSource = sp<TestStreamSource>::make();
status = mMediaPlayer->setDataSource(streamSource);
break;
}
- case file: {
+ case FILETYPE: {
write(mDataSourceFd, data, size);
sp<DataSource> dataSource = new FileSource(dup(mDataSourceFd), 0, size);
@@ -205,7 +238,7 @@
status = mMediaPlayer->setDataSource(iDataSource);
break;
}
- case socket: {
+ case SOCKET: {
String8 rtpParams = String8(mFdp.ConsumeRandomLengthString().c_str());
struct sockaddr_in endpoint;
endpoint.sin_family = mFdp.ConsumeIntegral<unsigned short>();
@@ -214,190 +247,239 @@
status = mMediaPlayer->setDataSource(rtpParams);
break;
}
- }
-
- if (status != 0) {
+ }
+ if (status != OK) {
return false;
- }
- return true;
+ }
+ return true;
}
void MediaPlayerServiceFuzzer::invokeMediaPlayer() {
- sp<SurfaceComposerClient> composerClient = new SurfaceComposerClient;
- String8 name = String8(mFdp.ConsumeRandomLengthString().c_str());
- uint32_t width = mFdp.ConsumeIntegralInRange<uint32_t>(kMinDimension, kMaxDimension);
- uint32_t height = mFdp.ConsumeIntegralInRange<uint32_t>(kMinDimension, kMaxDimension);
- uint32_t pixelFormat = mFdp.ConsumeIntegral<int32_t>();
- uint32_t flags = mFdp.ConsumeIntegral<int32_t>();
- sp<SurfaceControl> surfaceControl =
- composerClient->createSurface(name, width, height, pixelFormat, flags);
- if (surfaceControl) {
- sp<Surface> surface = surfaceControl->getSurface();
- mMediaPlayer->setVideoSurfaceTexture(surface->getIGraphicBufferProducer());
- }
-
- BufferingSettings buffering;
- buffering.mInitialMarkMs = mFdp.ConsumeIntegral<int32_t>();
- buffering.mResumePlaybackMarkMs = mFdp.ConsumeIntegral<int32_t>();
- mMediaPlayer->setBufferingSettings(buffering);
- mMediaPlayer->getBufferingSettings(&buffering);
-
- mMediaPlayer->prepareAsync();
- size_t playCount = mFdp.ConsumeIntegralInRange<size_t>(kPlayCountMin, kPlayCountMax);
- for (size_t Idx = 0; Idx < playCount; ++Idx) {
- mMediaPlayer->start();
- this_thread::sleep_for(chrono::milliseconds(
- mFdp.ConsumeIntegralInRange<int32_t>(kMinSleepTimeInMs, kMaxSleepTimeInMs)));
- mMediaPlayer->pause();
- this_thread::sleep_for(chrono::milliseconds(
- mFdp.ConsumeIntegralInRange<int32_t>(kMinSleepTimeInMs, kMaxSleepTimeInMs)));
- mMediaPlayer->stop();
- }
- bool state;
- mMediaPlayer->isPlaying(&state);
-
- AudioPlaybackRate rate;
- rate.mSpeed = mFdp.ConsumeFloatingPoint<float>();
- rate.mPitch = mFdp.ConsumeFloatingPoint<float>();
- rate.mStretchMode = mFdp.PickValueInArray(kAudioStretchModes);
- rate.mFallbackMode = mFdp.PickValueInArray(kAudioFallbackModes);
- mMediaPlayer->setPlaybackSettings(rate);
- mMediaPlayer->getPlaybackSettings(&rate);
-
- AVSyncSettings *avSyncSettings = new AVSyncSettings();
- float videoFpsHint = mFdp.ConsumeFloatingPoint<float>();
- mMediaPlayer->setSyncSettings(*avSyncSettings, videoFpsHint);
- mMediaPlayer->getSyncSettings(avSyncSettings, &videoFpsHint);
- delete avSyncSettings;
-
- mMediaPlayer->seekTo(mFdp.ConsumeIntegral<int32_t>());
-
- int32_t msec;
- mMediaPlayer->getCurrentPosition(&msec);
- mMediaPlayer->getDuration(&msec);
- mMediaPlayer->reset();
-
- mMediaPlayer->notifyAt(mFdp.ConsumeIntegral<int64_t>());
-
- mMediaPlayer->setAudioStreamType(mFdp.PickValueInArray(kAudioStreamTypes));
- mMediaPlayer->setLooping(mFdp.ConsumeIntegral<int32_t>());
- float left = mFdp.ConsumeFloatingPoint<float>();
- float right = mFdp.ConsumeFloatingPoint<float>();
- mMediaPlayer->setVolume(left, right);
-
- Parcel request, reply;
- request.writeInt32(mFdp.ConsumeIntegral<int32_t>());
- request.setDataPosition(0);
- mMediaPlayer->invoke(request, &reply);
-
- Parcel filter;
- filter.writeInt32(mFdp.ConsumeIntegral<int32_t>());
- filter.setDataPosition(0);
- mMediaPlayer->setMetadataFilter(filter);
-
- bool updateOnly = mFdp.ConsumeBool();
- bool applyFilter = mFdp.ConsumeBool();
- mMediaPlayer->getMetadata(updateOnly, applyFilter, &reply);
- mMediaPlayer->setAuxEffectSendLevel(mFdp.ConsumeFloatingPoint<float>());
- mMediaPlayer->attachAuxEffect(mFdp.ConsumeIntegral<int32_t>());
-
- int32_t key = mFdp.PickValueInArray(kMediaParamKeys);
- request.writeInt32(mFdp.ConsumeIntegral<int32_t>());
- request.setDataPosition(0);
- mMediaPlayer->setParameter(key, request);
- key = mFdp.PickValueInArray(kMediaParamKeys);
- mMediaPlayer->getParameter(key, &reply);
-
- struct sockaddr_in endpoint;
- mMediaPlayer->getRetransmitEndpoint(&endpoint);
-
- AttributionSourceState attributionSource;
- attributionSource.packageName = mFdp.ConsumeRandomLengthString().c_str();
- attributionSource.token = sp<BBinder>::make();
- const sp<IMediaPlayerService> mpService(IMediaDeathNotifier::getMediaPlayerService());
- sp<IMediaPlayer> mNextMediaPlayer = mpService->create(
- mMediaPlayerClient, mFdp.PickValueInArray(kSupportedAudioSessions), attributionSource);
- mMediaPlayer->setNextPlayer(mNextMediaPlayer);
-
- const sp<media::VolumeShaper::Configuration> configuration =
- sp<media::VolumeShaper::Configuration>::make();
- const sp<media::VolumeShaper::Operation> operation = sp<media::VolumeShaper::Operation>::make();
- mMediaPlayer->applyVolumeShaper(configuration, operation);
-
- mMediaPlayer->getVolumeShaperState(mFdp.ConsumeIntegral<int32_t>());
- uint8_t uuid[kUuidSize];
- for (int32_t index = 0; index < kUuidSize; ++index) {
- uuid[index] = mFdp.ConsumeIntegral<uint8_t>();
- }
- Vector<uint8_t> drmSessionId;
- drmSessionId.push_back(mFdp.ConsumeIntegral<uint8_t>());
- mMediaPlayer->prepareDrm(uuid, drmSessionId);
- mMediaPlayer->releaseDrm();
-
- audio_port_handle_t deviceId = mFdp.ConsumeIntegral<int32_t>();
- mMediaPlayer->setOutputDevice(deviceId);
- mMediaPlayer->getRoutedDeviceId(&deviceId);
-
- mMediaPlayer->enableAudioDeviceCallback(mFdp.ConsumeBool());
-
- sp<MediaPlayer> mediaPlayer = (MediaPlayer *)mMediaPlayer.get();
-
- int32_t msg = mFdp.PickValueInArray(kMediaEventTypes);
- int32_t ext1 = mFdp.PickValueInArray(kMediaInfoTypes);
- int32_t ext2 = mFdp.ConsumeIntegral<int32_t>();
- Parcel obj;
- obj.writeInt32(mFdp.ConsumeIntegral<int32_t>());
- obj.setDataPosition(0);
- mediaPlayer->notify(msg, ext1, ext2, &obj);
-
- int32_t mediaPlayerDumpFd = memfd_create("OutputDumpFile", MFD_ALLOW_SEALING);
- Vector<String16> args;
- args.push_back(String16(mFdp.ConsumeRandomLengthString().c_str()));
- mediaPlayer->dump(mediaPlayerDumpFd, args);
- close(mediaPlayerDumpFd);
-
- mMediaPlayer->disconnect();
+ Parcel request, reply;
+ while (mFdp.remaining_bytes()) {
+ auto invokeMediaPlayerApi = mFdp.PickValueInArray<const std::function<void()>>({
+ [&]() {
+ sp<SurfaceControl> surfaceControl = makeSurfaceControl();
+ if (surfaceControl) {
+ sp<Surface> surface = surfaceControl->getSurface();
+ mMediaPlayer->setVideoSurfaceTexture(surface->getIGraphicBufferProducer());
+ }
+ },
+ [&]() {
+ BufferingSettings buffering;
+ buffering.mInitialMarkMs = mFdp.ConsumeIntegral<int32_t>();
+ buffering.mResumePlaybackMarkMs = mFdp.ConsumeIntegral<int32_t>();
+ mMediaPlayer->setBufferingSettings(buffering);
+ },
+ [&]() {
+ BufferingSettings buffering;
+ mMediaPlayer->getBufferingSettings(&buffering);
+ },
+ [&]() {
+ mMediaPlayer->prepareAsync();
+ this_thread::sleep_for(chrono::milliseconds(100)); // Time to post message
+ },
+ [&]() {
+ mMediaPlayer->start();
+ this_thread::sleep_for(chrono::milliseconds(100)); // Time to post message
+ },
+ [&]() {
+ mMediaPlayer->pause();
+ this_thread::sleep_for(chrono::milliseconds(100)); // Time to post message
+ },
+ [&]() { mMediaPlayer->stop(); },
+ [&]() {
+ bool state;
+ mMediaPlayer->isPlaying(&state);
+ },
+ [&]() {
+ AudioPlaybackRate rate;
+ rate.mSpeed = mFdp.ConsumeFloatingPoint<float>();
+ rate.mPitch = mFdp.ConsumeFloatingPoint<float>();
+ rate.mStretchMode = mFdp.ConsumeBool() ? AUDIO_TIMESTRETCH_STRETCH_DEFAULT
+ : AUDIO_TIMESTRETCH_STRETCH_VOICE;
+ rate.mFallbackMode =
+ (audio_timestretch_fallback_mode_t)mFdp.ConsumeIntegralInRange<int32_t>(
+ AUDIO_TIMESTRETCH_FALLBACK_CUT_REPEAT,
+ AUDIO_TIMESTRETCH_FALLBACK_FAIL);
+ mMediaPlayer->setPlaybackSettings(rate);
+ mMediaPlayer->getPlaybackSettings(&rate);
+ },
+ [&]() {
+ AVSyncSettings* avSyncSettings = new AVSyncSettings();
+ float videoFpsHint = mFdp.ConsumeFloatingPoint<float>();
+ mMediaPlayer->setSyncSettings(*avSyncSettings, videoFpsHint);
+ delete avSyncSettings;
+ },
+ [&]() {
+ AVSyncSettings* avSyncSettings = new AVSyncSettings();
+ float videoFpsHint = 0;
+ mMediaPlayer->getSyncSettings(avSyncSettings, &videoFpsHint);
+ delete avSyncSettings;
+ },
+ [&]() { mMediaPlayer->seekTo(mFdp.ConsumeIntegral<int32_t>()); },
+ [&]() {
+ int32_t msec;
+ mMediaPlayer->getCurrentPosition(&msec);
+ mMediaPlayer->getDuration(&msec);
+ },
+ [&]() { mMediaPlayer->reset(); },
+ [&]() { mMediaPlayer->notifyAt(mFdp.ConsumeIntegral<uint64_t>()); },
+ [&]() {
+ mMediaPlayer->setAudioStreamType(
+ (audio_stream_type_t)mFdp.ConsumeIntegralInRange<int32_t>(
+ AUDIO_STREAM_VOICE_CALL, AUDIO_STREAM_CALL_ASSISTANT));
+ },
+ [&]() { mMediaPlayer->setLooping(mFdp.ConsumeIntegral<int32_t>()); },
+ [&]() {
+ mMediaPlayer->setVolume(mFdp.ConsumeFloatingPoint<float>() /* left */,
+ mFdp.ConsumeFloatingPoint<float>() /* right */);
+ },
+ [&]() {
+ request.writeInt32(mFdp.ConsumeIntegral<int32_t>());
+ request.setDataPosition(0);
+ mMediaPlayer->invoke(request, &reply);
+ },
+ [&]() {
+ Parcel filter;
+ filter.writeInt32(mFdp.ConsumeIntegral<int32_t>());
+ filter.setDataPosition(0);
+ mMediaPlayer->setMetadataFilter(filter);
+ },
+ [&]() {
+ mMediaPlayer->getMetadata(mFdp.ConsumeBool() /* updateOnly */,
+ mFdp.ConsumeBool() /* applyFilter */, &reply);
+ },
+ [&]() { mMediaPlayer->setAuxEffectSendLevel(mFdp.ConsumeFloatingPoint<float>()); },
+ [&]() { mMediaPlayer->attachAuxEffect(mFdp.ConsumeIntegral<int32_t>()); },
+ [&]() {
+ int32_t key = mFdp.PickValueInArray(kMediaParamKeys);
+ request.writeInt32(mFdp.ConsumeIntegral<int32_t>());
+ request.setDataPosition(0);
+ mMediaPlayer->setParameter(key, request);
+ key = mFdp.PickValueInArray(kMediaParamKeys);
+ mMediaPlayer->getParameter(key, &reply);
+ },
+ [&]() {
+ int32_t key =
+ mFdp.ConsumeBool() ? kFourCCVal : mFdp.ConsumeIntegral<uint32_t>();
+ mMediaPlayer->getParameter(key, &reply);
+ },
+ [&]() {
+ struct sockaddr_in endpoint;
+ mMediaPlayer->getRetransmitEndpoint(&endpoint);
+ },
+ [&]() {
+ AttributionSourceState attributionSource;
+ attributionSource.packageName = mFdp.ConsumeRandomLengthString().c_str();
+ attributionSource.token = sp<BBinder>::make();
+ const sp<IMediaPlayerService> mpService(
+ IMediaDeathNotifier::getMediaPlayerService());
+ audio_session_t audioSessionId =
+ (audio_session_t)mFdp.ConsumeIntegralInRange<int32_t>(
+ AUDIO_SESSION_DEVICE, AUDIO_SESSION_OUTPUT_MIX);
+ sp<IMediaPlayer> mNextMediaPlayer = mpService->create(
+ mMediaPlayerClient, audioSessionId, attributionSource);
+ mMediaPlayer->setNextPlayer(mNextMediaPlayer);
+ },
+ [&]() {
+ const sp<media::VolumeShaper::Configuration> configuration =
+ sp<media::VolumeShaper::Configuration>::make();
+ const sp<media::VolumeShaper::Operation> operation =
+ sp<media::VolumeShaper::Operation>::make();
+ mMediaPlayer->applyVolumeShaper(configuration, operation);
+ },
+ [&]() { mMediaPlayer->getVolumeShaperState(mFdp.ConsumeIntegral<int32_t>()); },
+ [&]() {
+ uint8_t uuid[kUuidSize];
+ for (int32_t index = 0; index < kUuidSize; ++index) {
+ uuid[index] = mFdp.ConsumeIntegral<uint8_t>();
+ }
+ Vector<uint8_t> drmSessionId;
+ int32_t length = mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize);
+ while (length--) {
+ drmSessionId.push_back(mFdp.ConsumeIntegral<uint8_t>());
+ }
+ mMediaPlayer->prepareDrm(uuid, drmSessionId);
+ },
+ [&]() { mMediaPlayer->releaseDrm(); },
+ [&]() {
+ audio_port_handle_t deviceId = mFdp.ConsumeIntegral<int32_t>();
+ mMediaPlayer->setOutputDevice(deviceId);
+ },
+ [&]() {
+ audio_port_handle_t deviceId;
+ mMediaPlayer->getRoutedDeviceId(&deviceId);
+ },
+ [&]() { mMediaPlayer->enableAudioDeviceCallback(mFdp.ConsumeBool()); },
+ [&]() {
+ sp<MediaPlayer> mediaPlayer = (MediaPlayer*)mMediaPlayer.get();
+ Parcel obj;
+ obj.writeInt32(mFdp.ConsumeIntegral<int32_t>());
+ obj.setDataPosition(0);
+ mediaPlayer->notify(mFdp.PickValueInArray(kMediaEventTypes) /* msg */,
+ mFdp.PickValueInArray(kMediaInfoTypes) /* ext1 */,
+ mFdp.ConsumeIntegral<int32_t>() /* ext2 */, &obj);
+ },
+ [&]() {
+ sp<MediaPlayer> mediaPlayer = (MediaPlayer*)mMediaPlayer.get();
+ int32_t mediaPlayerDumpFd = memfd_create(dumpFile, MFD_ALLOW_SEALING);
+ Vector<String16> args;
+ args.push_back(String16(mFdp.ConsumeRandomLengthString().c_str()));
+ mediaPlayer->dump(mediaPlayerDumpFd, args);
+ close(mediaPlayerDumpFd);
+ },
+ [&]() { mMediaPlayer->disconnect(); },
+ });
+ invokeMediaPlayerApi();
+ }
}
-void MediaPlayerServiceFuzzer::process(const uint8_t *data, size_t size) {
- MediaPlayerService::instantiate();
-
- const sp<IMediaPlayerService> mpService(IMediaDeathNotifier::getMediaPlayerService());
- if (!mpService) {
+void MediaPlayerServiceFuzzer::process(const uint8_t* data, size_t size) {
+ const sp<IMediaPlayerService> mpService(IMediaDeathNotifier::getMediaPlayerService());
+ if (!mpService) {
return;
- }
+ }
- sp<IMediaCodecList> mediaCodecList = mpService->getCodecList();
+ sp<IMediaCodecList> mediaCodecList = mpService->getCodecList();
- sp<IRemoteDisplayClient> remoteDisplayClient;
- sp<IRemoteDisplay> remoteDisplay = mpService->listenForRemoteDisplay(
- String16(mFdp.ConsumeRandomLengthString().c_str()) /*opPackageName*/, remoteDisplayClient,
- String8(mFdp.ConsumeRandomLengthString().c_str()) /*iface*/);
+ sp<IRemoteDisplayClient> remoteDisplayClient;
+ sp<IRemoteDisplay> remoteDisplay = mpService->listenForRemoteDisplay(
+ String16(mFdp.ConsumeRandomLengthString().c_str()) /*opPackageName*/,
+ remoteDisplayClient, String8(mFdp.ConsumeRandomLengthString().c_str()) /*iface*/);
- mpService->addBatteryData(mFdp.ConsumeIntegral<uint32_t>());
- Parcel reply;
- mpService->pullBatteryData(&reply);
+ mpService->addBatteryData(mFdp.ConsumeIntegral<uint32_t>());
+ Parcel reply;
+ mpService->pullBatteryData(&reply);
- sp<MediaPlayerService> mediaPlayerService = (MediaPlayerService *)mpService.get();
- AttributionSourceState attributionSource;
- attributionSource.packageName = mFdp.ConsumeRandomLengthString().c_str();
- attributionSource.token = sp<BBinder>::make();
- mMediaPlayer = mediaPlayerService->create(
- mMediaPlayerClient, mFdp.PickValueInArray(kSupportedAudioSessions), attributionSource);
+ sp<MediaPlayerService> mediaPlayerService = (MediaPlayerService*)mpService.get();
+ AttributionSourceState attributionSource;
+ attributionSource.packageName = mFdp.ConsumeRandomLengthString().c_str();
+ attributionSource.token = sp<BBinder>::make();
+ mMediaPlayer =
+ mediaPlayerService->create(mMediaPlayerClient,
+ (audio_session_t)mFdp.ConsumeIntegralInRange<int32_t>(
+ AUDIO_SESSION_DEVICE, AUDIO_SESSION_OUTPUT_MIX),
+ attributionSource);
- int32_t mediaPlayerServiceDumpFd = memfd_create("OutputDumpFile", MFD_ALLOW_SEALING);
- Vector<String16> args;
- args.push_back(String16(mFdp.ConsumeRandomLengthString().c_str()));
- mediaPlayerService->dump(mediaPlayerServiceDumpFd, args);
- close(mediaPlayerServiceDumpFd);
+ int32_t mediaPlayerServiceDumpFd = memfd_create(dumpFile, MFD_ALLOW_SEALING);
+ Vector<String16> args;
+ args.push_back(String16(mFdp.ConsumeRandomLengthString().c_str()));
+ mediaPlayerService->dump(mediaPlayerServiceDumpFd, args);
+ close(mediaPlayerServiceDumpFd);
- if (!mMediaPlayer) {
+ if (!mMediaPlayer) {
return;
- }
-
- if (setDataSource(data, size)) {
+ }
+ if (setDataSource(data, size)) {
invokeMediaPlayer();
- }
+ }
+}
+
+extern "C" int LLVMFuzzerInitialize(int* /* argc */, char*** /* argv */) {
+ MediaPlayerService::instantiate();
+ MediaExtractorService::instantiate();
+ return 0;
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {