1 /*
2 * Copyright (c) 2021 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "ipc_stream_operator_fuzzer.h"
17 #include "fuzz_base.h"
18
19 #include <cstddef>
20 #include <cstdint>
21
22 class IPCStreamOperatorFuzzer : public StreamOperatorStub {
23 public:
IsStreamsSupported(OperationMode mode,const std::shared_ptr<CameraMetadata> & modeSetting,const std::vector<std::shared_ptr<StreamInfo>> & info,StreamSupportType & type)24 CamRetCode IsStreamsSupported(
25 OperationMode mode,
26 const std::shared_ptr<CameraMetadata> &modeSetting,
27 const std::vector<std::shared_ptr<StreamInfo>> &info,
28 StreamSupportType &type) override
29 {
30 return OHOS::Camera::NO_ERROR;
31 }
IsStreamsSupported(OperationMode mode,const std::shared_ptr<CameraMetadata> & modeSetting,const std::shared_ptr<StreamInfo> & info,StreamSupportType & type)32 CamRetCode IsStreamsSupported(
33 OperationMode mode,
34 const std::shared_ptr<CameraMetadata> &modeSetting,
35 const std::shared_ptr<StreamInfo> &info,
36 StreamSupportType &type) override
37 {
38 return OHOS::Camera::NO_ERROR;
39 }
CreateStreams(const std::vector<std::shared_ptr<StreamInfo>> & streamInfos)40 CamRetCode CreateStreams(const std::vector<std::shared_ptr<StreamInfo>> &streamInfos) override
41 {
42 return OHOS::Camera::NO_ERROR;
43 }
ReleaseStreams(const std::vector<int> & streamIds)44 CamRetCode ReleaseStreams(const std::vector<int>& streamIds) override
45 {
46 return OHOS::Camera::NO_ERROR;
47 }
CommitStreams(OperationMode mode,const std::shared_ptr<CameraMetadata> & modeSetting)48 CamRetCode CommitStreams(OperationMode mode,
49 const std::shared_ptr<CameraMetadata>& modeSetting) override
50 {
51 return OHOS::Camera::NO_ERROR;
52 }
GetStreamAttributes(std::vector<std::shared_ptr<StreamAttribute>> & attributes)53 CamRetCode GetStreamAttributes(std::vector<std::shared_ptr<StreamAttribute>>& attributes) override
54 {
55 return OHOS::Camera::NO_ERROR;
56 }
AttachBufferQueue(int streamId,const OHOS::sptr<OHOS::IBufferProducer> & producer)57 CamRetCode AttachBufferQueue(int streamId, const OHOS::sptr<OHOS::IBufferProducer>& producer) override
58 {
59 return OHOS::Camera::NO_ERROR;
60 }
DetachBufferQueue(int streamId)61 CamRetCode DetachBufferQueue(int streamId) override
62 {
63 return OHOS::Camera::NO_ERROR;
64 }
Capture(int captureId,const std::shared_ptr<CaptureInfo> & captureInfo,bool isStreaming)65 CamRetCode Capture(int captureId,
66 const std::shared_ptr<CaptureInfo>& captureInfo, bool isStreaming) override {}
67 {
68 return OHOS::Camera::NO_ERROR;
69 }
CancelCapture(int captureId)70 CamRetCode CancelCapture(int captureId) override
71 {
72 return OHOS::Camera::NO_ERROR;
73 }
ChangeToOfflineStream(const std::vector<int> & streamIds,OHOS::sptr<IStreamOperatorCallback> & callback,OHOS::sptr<IOfflineStreamOperator> & offlineOperator)74 CamRetCode ChangeToOfflineStream(const std::vector<int>& streamIds,
75 OHOS::sptr<IStreamOperatorCallback>& callback,
76 OHOS::sptr<IOfflineStreamOperator>& offlineOperator) override
77 {
78 return OHOS::Camera::NO_ERROR;
79 }
80 };
81
U32_AT(const uint8_t * ptr)82 static uint32_t U32_AT(const uint8_t *ptr)
83 {
84 return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3];
85 }
86
onRemoteRequest(uint32_t code,MessageParcel & data)87 static int32_t onRemoteRequest(uint32_t code, MessageParcel &data)
88 {
89 MessageParcel reply;
90 MessageOption option;
91 IPCStreamOperatorFuzzer IPCStreamSer;
92 auto ret = IPCStreamSer.OnRemoteRequest(code, data, reply, option);
93 return ret;
94 }
95
IpcFuzzService(const uint8_t * data,size_t size)96 static void IpcFuzzService(const uint8_t *data, size_t size)
97 {
98 MessageParcel reply;
99 MessageOption option;
100 MessageParcel dataMessageParcel;
101 if (size > sizeof(uint32_t)) {
102 uint32_t code = U32_AT(data);
103 uint8_t *number = data;
104 number = number + sizeof(uint32_t);
105 if (code == 7) { // 7:code size
106 return;
107 }
108 size_t length = size;
109 length = length - sizeof(uint32_t);
110 dataMessageParcel.WriteInterfaceToken(StreamOperatorStub::GetDescriptor());
111 dataMessageParcel.WriteBuffer(number, length);
112 dataMessageParcel.RewindRead(0);
113 onRemoteRequest(code, dataMessageParcel);
114 }
115 }
116
OnRemoteRequestFunc(const uint8_t * data,size_t size)117 static void OnRemoteRequestFunc(const uint8_t *data, size_t size)
118 {
119 IpcFuzzService(data, size);
120 }
121
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)122 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
123 {
124 OnRemoteRequestFunc(data, size);
125 return 0;
126 }