1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "surface_fuzzer.h"
17
18 #include <securec.h>
19
20 #include "surface.h"
21 #include "surface_buffer.h"
22 #include "surface_buffer_impl.h"
23 #include "sync_fence.h"
24 #include <iostream>
25
26 namespace OHOS {
27 namespace {
28 const uint8_t* g_data = nullptr;
29 size_t g_size = 0;
30 size_t g_pos;
31 constexpr size_t STR_LEN = 10;
32 }
33
34 /*
35 * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T)
36 * tips: only support basic type
37 */
38 template<class T>
GetData()39 T GetData()
40 {
41 T object {};
42 size_t objectSize = sizeof(object);
43 if (g_data == nullptr || objectSize > g_size - g_pos) {
44 return object;
45 }
46 errno_t ret = memcpy_s(&object, objectSize, g_data + g_pos, objectSize);
47 if (ret != EOK) {
48 return {};
49 }
50 g_pos += objectSize;
51 return object;
52 }
53
54 /*
55 * get a string from g_data
56 */
GetStringFromData(int strlen)57 std::string GetStringFromData(int strlen)
58 {
59 char cstr[strlen];
60 cstr[strlen - 1] = '\0';
61 for (int i = 0; i < strlen - 1; i++) {
62 char tmp = GetData<char>();
63 if (tmp == '\0') {
64 tmp = '1';
65 }
66 cstr[i] = tmp;
67 }
68 std::string str(cstr);
69 return str;
70 }
71
SurfaceFuzzTest2()72 void SurfaceFuzzTest2()
73 {
74 // get data
75 std::string name = GetStringFromData(STR_LEN);
76 bool isShared = GetData<bool>();
77 std::string key = GetStringFromData(STR_LEN);
78 std::string val = GetStringFromData(STR_LEN);
79 BufferVerifyAllocInfo info = GetData<BufferVerifyAllocInfo>();
80 bool supported = GetData<bool>();
81 uint32_t sequence = GetData<uint32_t>();
82 ScalingMode scalingMode = GetData<ScalingMode>();
83 GraphicHDRMetaData metaData = GetData<GraphicHDRMetaData>();
84 GraphicHDRMetadataKey metakey = GetData<GraphicHDRMetadataKey>();
85 uint8_t metaData2 = GetData<uint8_t>();
86 HDRMetaDataType metaType = GetData<HDRMetaDataType>();
87 GraphicPresentTimestamp ptimestamp = GetData<GraphicPresentTimestamp>();
88 GraphicPresentTimestampType type = GetData<GraphicPresentTimestampType>();
89 int64_t time = GetData<int64_t>();
90 std::string result = GetStringFromData(STR_LEN);
91
92 std::vector<BufferVerifyAllocInfo> infos = {info};
93 std::vector<bool> supporteds = {supported};
94 std::vector<GraphicHDRMetaData> metaDatas = {metaData};
95 std::vector<uint8_t> metaDatas2 = {metaData2};
96
97 // test
98 sptr<OHOS::Surface> cSurface = OHOS::Surface::CreateSurfaceAsConsumer(name, isShared);
99 auto producer = cSurface->GetProducer();
100 sptr<OHOS::Surface> pSurface = OHOS::Surface::CreateSurfaceAsProducer(producer);
101
102 pSurface->SetUserData(key, val);
103 pSurface->IsSupportedAlloc(infos, supporteds);
104 pSurface->SetScalingMode(sequence, scalingMode);
105 pSurface->GetScalingMode(sequence, scalingMode);
106 pSurface->SetMetaData(sequence, metaDatas);
107 pSurface->SetMetaDataSet(sequence, metakey, metaDatas2);
108 pSurface->QueryMetaDataType(sequence, metaType);
109 pSurface->GetMetaData(sequence, metaDatas);
110 pSurface->GetMetaDataSet(sequence, metakey, metaDatas2);
111 pSurface->SetPresentTimestamp(sequence, ptimestamp);
112 pSurface->GetPresentTimestamp(sequence, type, time);
113 cSurface->SetUserData(key, val);
114 cSurface->IsSupportedAlloc(infos, supporteds);
115 cSurface->SetScalingMode(sequence, scalingMode);
116 cSurface->GetScalingMode(sequence, scalingMode);
117 cSurface->SetMetaData(sequence, metaDatas);
118 cSurface->SetMetaDataSet(sequence, metakey, metaDatas2);
119 cSurface->QueryMetaDataType(sequence, metaType);
120 cSurface->GetMetaData(sequence, metaDatas);
121 cSurface->GetMetaDataSet(sequence, metakey, metaDatas2);
122 cSurface->SetPresentTimestamp(sequence, ptimestamp);
123 cSurface->GetPresentTimestamp(sequence, type, time);
124 cSurface->Dump(result);
125 }
126
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)127 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
128 {
129 if (data == nullptr) {
130 return false;
131 }
132
133 // initialize
134 g_data = data;
135 g_size = size;
136 g_pos = 0;
137
138 // get data
139 std::string name = GetStringFromData(STR_LEN);
140 bool isShared = GetData<bool>();
141 BufferRequestConfig requestConfig = GetData<BufferRequestConfig>();
142 BufferFlushConfig flushConfig = GetData<BufferFlushConfig>();
143 int64_t timestamp = GetData<int64_t>();
144 Rect damage = GetData<Rect>();
145 uint32_t seqNum = GetData<uint32_t>();
146 uint32_t queueSize = GetData<uint32_t>();
147 int32_t width = GetData<int32_t>();
148 int32_t height = GetData<int32_t>();
149 uint32_t usage = GetData<uint32_t>();
150 GraphicTransformType transform = GetData<GraphicTransformType>();
151
152 // test
153 sptr<OHOS::Surface> cSurface = OHOS::Surface::CreateSurfaceAsConsumer(name, isShared);
154 auto producer = cSurface->GetProducer();
155 sptr<OHOS::Surface> pSurface = OHOS::Surface::CreateSurfaceAsProducer(producer);
156 sptr<OHOS::SurfaceBuffer> buffer = new SurfaceBufferImpl(seqNum);
157 sptr<SyncFence> syncFence = SyncFence::INVALID_FENCE;
158 int32_t fenceFd = syncFence->Get();
159
160 pSurface->RequestBuffer(buffer, fenceFd, requestConfig);
161 pSurface->CancelBuffer(buffer);
162 pSurface->FlushBuffer(buffer, fenceFd, flushConfig);
163 pSurface->AcquireBuffer(buffer, fenceFd, timestamp, damage);
164 pSurface->ReleaseBuffer(buffer, fenceFd);
165 pSurface->AttachBuffer(buffer);
166 pSurface->DetachBuffer(buffer);
167 pSurface->SetQueueSize(queueSize);
168 pSurface->SetDefaultWidthAndHeight(width, height);
169 pSurface->SetDefaultUsage(usage);
170 pSurface->SetTransform(transform);
171
172 cSurface->RequestBuffer(buffer, fenceFd, requestConfig);
173 cSurface->CancelBuffer(buffer);
174 cSurface->FlushBuffer(buffer, fenceFd, flushConfig);
175 cSurface->AcquireBuffer(buffer, fenceFd, timestamp, damage);
176 cSurface->ReleaseBuffer(buffer, fenceFd);
177 cSurface->AttachBuffer(buffer);
178 cSurface->DetachBuffer(buffer);
179 cSurface->SetQueueSize(queueSize);
180 cSurface->SetDefaultWidthAndHeight(width, height);
181 cSurface->SetDefaultUsage(usage);
182 cSurface->SetTransform(transform);
183
184 SurfaceFuzzTest2();
185
186 return true;
187 }
188 } // namespace OHOS
189
190 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)191 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
192 {
193 /* Run your code on data */
194 OHOS::DoSomethingInterestingWithMyAPI(data, size);
195 return 0;
196 }
197
198