1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "copyframe_fuzzer.h"
17
18 #include <cstring>
19 #include <securec.h>
20 #include <ui/rs_surface_node.h>
21
22 #include "nweb.h"
23 #include "nweb_adapter_helper.h"
24 #include "nweb_handler_impl_test.h"
25
26 #define private public
27 #include "nweb_surface_adapter.h"
28 #include "window.h"
29
30 using namespace OHOS::NWeb;
31
32 namespace OHOS {
33 namespace {
34 std::unordered_map<std::string, std::string> g_argsMap;
35 const std::string ARG_URL = "--url";
36 const std::string ARG_DUMP = "--dump-path";
37 const std::string ARG_FRAME_INFO = "--frame-info";
38 const std::string ARG_ADD_WEB_ENGINE_ARG = "--add-args";
39 const std::string ARG_DELETE_WEB_ENGINE_ARG = "--delete-args";
40 const std::string ARG_MULTI_RENDER_PROCESS = "--multi-renderer-process";
41 const std::string ARG_NWEB_TEST_MOCK_BUNDLEPATH = "--bundle-installation-dir";
42 const std::string MOCK_INSTALLATION_DIR = "/data/app/el1/bundle/public/com.ohos.nweb";
43 const std::string ARG_WIDTH = "--width";
44 const std::string ARG_HEIGHT = "--height";
45 const int DEFAULT_WIDTH = 2560;
46 const int DEFAULT_HEIGHT = 1396;
47 }
48
HasArg(const std::string & arg)49 bool HasArg(const std::string &arg)
50 {
51 return (!g_argsMap.empty()) && (g_argsMap.find(arg) != g_argsMap.end());
52 }
53
GetArgValue(const std::string & arg)54 std::string GetArgValue(const std::string &arg)
55 {
56 if (!HasArg(arg)) {
57 return "";
58 }
59 return g_argsMap.at(arg);
60 }
61
GetNumFromArgs(const std::string & arg)62 uint32_t GetNumFromArgs(const std::string &arg)
63 {
64 if (!HasArg(arg)) {
65 return 0;
66 }
67 return std::stoi(GetArgValue(arg));
68 }
69
GetWebEngineArgs(const std::string & arg)70 std::list<std::string> GetWebEngineArgs(const std::string &arg)
71 {
72 std::string webEngineArgValue = GetArgValue(arg);
73 std::list<std::string> webEngineArgList;
74 if (webEngineArgValue.empty()) {
75 return webEngineArgList;
76 }
77 uint32_t start = 0;
78 uint32_t pos = 0;
79 while (pos < webEngineArgValue.size()) {
80 if (webEngineArgValue[pos] == ',') {
81 webEngineArgList.emplace_back(webEngineArgValue.substr(start, pos - start));
82 pos++;
83 start = pos;
84 } else {
85 pos++;
86 }
87 }
88 webEngineArgList.emplace_back(webEngineArgValue.substr(start, pos - start));
89 webEngineArgList.emplace_back(ARG_NWEB_TEST_MOCK_BUNDLEPATH + "=" + MOCK_INSTALLATION_DIR);
90 return webEngineArgList;
91 }
92
GetInitArgs()93 OHOS::NWeb::NWebInitArgs GetInitArgs()
94 {
95 OHOS::NWeb::NWebInitArgs initArgs = {
96 .dump_path = GetArgValue(ARG_DUMP),
97 .frame_info_dump = HasArg(ARG_FRAME_INFO) ? true : false,
98 .web_engine_args_to_add = GetWebEngineArgs(ARG_ADD_WEB_ENGINE_ARG),
99 .web_engine_args_to_delete = GetWebEngineArgs(ARG_DELETE_WEB_ENGINE_ARG),
100 .multi_renderer_process = HasArg(ARG_MULTI_RENDER_PROCESS) ? true : false,
101 };
102 return initArgs;
103 }
104
CreateWindow()105 sptr<Rosen::Window> CreateWindow()
106 {
107 sptr<Rosen::WindowOption> option = new Rosen::WindowOption();
108 if (option == nullptr) {
109 return nullptr;
110 }
111 int width = HasArg(ARG_WIDTH) ? GetNumFromArgs(ARG_WIDTH) : DEFAULT_WIDTH;
112 int height = HasArg(ARG_HEIGHT) ? GetNumFromArgs(ARG_HEIGHT) : DEFAULT_HEIGHT;
113 option->SetWindowRect({0, 0, width, height});
114 auto window = Rosen::Window::Create("nweb_test_window", option);
115 return window;
116 }
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)117 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
118 {
119 constexpr int BITS_PER_PIXEL = 4;
120 if ((data == nullptr) || (size < sizeof(uint32_t))) {
121 return false;
122 }
123 sptr<Rosen::Window> window = CreateWindow();
124 if (window == nullptr) {
125 return false;
126 }
127 sptr<Surface> surface = window->GetSurfaceNode()->GetSurface();
128 if (surface == nullptr) {
129 return false;
130 }
131 uint32_t width;
132 uint32_t height;
133 if (memcpy_s(&width, sizeof(uint32_t), data, sizeof(uint32_t)) != 0) {
134 return false;
135 }
136 if (memcpy_s(&height, sizeof(uint32_t), data, sizeof(uint32_t)) != 0) {
137 return false;
138 }
139 sptr<SurfaceBuffer> surfaceBuffer = nullptr;
140 int32_t releaseFence = -1;
141 BufferRequestConfig requestConfig = {
142 .width = width,
143 .height = height,
144 .strideAlignment = sizeof(void *),
145 .format = PIXEL_FMT_RGBA_8888,
146 .usage = HBM_USE_CPU_READ | HBM_USE_CPU_WRITE | HBM_USE_MEM_DMA,
147 .timeout = 0,
148 };
149 surface->RequestBuffer(surfaceBuffer, releaseFence, requestConfig);
150 if (surfaceBuffer == nullptr) {
151 return false;
152 }
153 auto surfaceAdapter = NWebSurfaceAdapter::Instance();
154 if (width == 0 || height == 0) {
155 return false;
156 }
157 char *src = new char[width * height * BITS_PER_PIXEL] {0};
158 if (src == nullptr) {
159 return false;
160 }
161 surfaceAdapter.CopyFrame(surfaceBuffer, src, width, height);
162 delete[] src;
163 return true;
164 }
165 }
166
167 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)168 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
169 {
170 /* Run your code on data */
171 OHOS::DoSomethingInterestingWithMyAPI(data, size);
172 return 0;
173 }
174