1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "nativewindow_fuzzer.h"
17
18 #include <securec.h>
19 #include <vector>
20 #include <string>
21
22 #include "surface.h"
23 #include "surface_buffer.h"
24 #include "surface_buffer_impl.h"
25 #include "ibuffer_producer.h"
26 #include "native_window.h"
27
28 namespace OHOS {
29 namespace {
30 constexpr size_t STR_LEN = 10;
31 constexpr int DEFAULT_FENCE = 100;
32 const uint8_t* g_data = nullptr;
33 size_t g_size = 0;
34 size_t g_pos;
35 }
36
37 class BufferConsumerListener : public IBufferConsumerListener {
38 public:
OnBufferAvailable()39 void OnBufferAvailable() override
40 {
41 }
42 };
43
44 /*
45 * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T)
46 * tips: only support basic type
47 */
48 template<class T>
GetData()49 T GetData()
50 {
51 T object {};
52 size_t objectSize = sizeof(object);
53 if (g_data == nullptr || objectSize > g_size - g_pos) {
54 return object;
55 }
56 errno_t ret = memcpy_s(&object, objectSize, g_data + g_pos, objectSize);
57 if (ret != EOK) {
58 return {};
59 }
60 g_pos += objectSize;
61 return object;
62 }
63
64 /*
65 * get a string from g_data
66 */
GetStringFromData(int strlen)67 std::string GetStringFromData(int strlen)
68 {
69 char cstr[strlen];
70 cstr[strlen - 1] = '\0';
71 for (int i = 0; i < strlen - 1; i++) {
72 char tmp = GetData<char>();
73 if (tmp == '\0') {
74 tmp = '1';
75 }
76 cstr[i] = tmp;
77 }
78 std::string str(cstr);
79 return str;
80 }
81
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)82 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
83 {
84 if (data == nullptr) {
85 return false;
86 }
87
88 // initialize
89 g_data = data;
90 g_size = size;
91 g_pos = 0;
92
93 // get data
94 uint32_t seqNum = GetData<uint32_t>();
95 int fenceFd = GetData<int>() % 32768; // maximum fd of linux is 32768
96 // fd 0,1,2 represent stdin, stdout and stderr respectively, they should not be closed.
97 if (fenceFd >= 0 && fenceFd <= 2) {
98 fenceFd = DEFAULT_FENCE;
99 }
100 Region::Rect rect = GetData<Region::Rect>();
101 int32_t rectNumber = GetData<int32_t>();
102 Region region = {.rects = &rect, .rectNumber = rectNumber};
103 uint32_t sequence = GetData<uint32_t>();
104 OHScalingMode scalingMode = GetData<OHScalingMode>();
105 OHHDRMetaData metaData = GetData<OHHDRMetaData>();
106 OHHDRMetadataKey key = GetData<OHHDRMetadataKey>();
107 uint8_t metaData2[STR_LEN];
108 for (uint64_t i = 0; i < STR_LEN; i++) {
109 metaData2[i] = GetData<uint8_t>();
110 }
111 uint32_t reserveInts = GetData<uint32_t>() % 0x100000; // no more than 0x100000
112
113 // test
114 sptr<OHOS::Surface> cSurface = Surface::CreateSurfaceAsConsumer();
115 sptr<IBufferConsumerListener> listener = new BufferConsumerListener();
116 cSurface->RegisterConsumerListener(listener);
117 sptr<OHOS::IBufferProducer> producer = cSurface->GetProducer();
118 sptr<OHOS::Surface> pSurface = Surface::CreateSurfaceAsProducer(producer);
119 cSurface->SetDefaultWidthAndHeight(0x100, 0x100); // width and height is 0x100
120 OHNativeWindow* nativeWindow = CreateNativeWindowFromSurface(&pSurface);
121 sptr<OHOS::SurfaceBuffer> sBuffer = new SurfaceBufferImpl(seqNum);
122 OHNativeWindowBuffer* nwBuffer = CreateNativeWindowBufferFromSurfaceBuffer(&sBuffer);
123 NativeWindowRequestBuffer(nativeWindow, &nwBuffer, &fenceFd);
124 NativeObjectReference(nwBuffer);
125 NativeWindowFlushBuffer(nativeWindow, nwBuffer, fenceFd, region);
126 NativeWindowCancelBuffer(nativeWindow, nwBuffer);
127 GetBufferHandleFromNative(nwBuffer);
128 NativeWindowSetScalingMode(nativeWindow, sequence, scalingMode);
129 std::vector<OHHDRMetaData> metaDatas = {metaData};
130 NativeWindowSetMetaData(nativeWindow, sequence, metaDatas.size(), metaDatas.data());
131 NativeWindowSetMetaDataSet(nativeWindow, sequence, key, STR_LEN, metaData2);
132 GraphicExtDataHandle *handle = AllocExtDataHandle(reserveInts);
133 NativeWindowSetTunnelHandle(nativeWindow, reinterpret_cast<OHExtDataHandle *>(handle));
134 FreeExtDataHandle(handle);
135 DestoryNativeWindow(nativeWindow);
136 DestroyNativeWindowBuffer(nwBuffer);
137
138 return true;
139 }
140 } // namespace OHOS
141
142 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)143 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
144 {
145 /* Run your code on data */
146 OHOS::DoSomethingInterestingWithMyAPI(data, size);
147 return 0;
148 }
149
150