1 /*
2 * Copyright (c) 2021-2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "camera_host_fuzzer.h"
17 #include "camera.h"
18
19 namespace OHOS {
20 const size_t THRESHOLD = 10;
21
22 enum HostCmdId {
23 CAMERA_HOST_PRELAUNCH,
24 CAMERA_HOST_GET_CAMERA_IDS,
25 CAMERA_HOST_GET_CAMERA_ABILITY,
26 CAMERA_HOST_OPEN_CAMERA,
27 CAMERA_HOST_OPEN_CAMERA_V1_1,
28 CAMERA_HOST_SET_FLASH_LIGHTS,
29 };
30
31 enum BitOperat {
32 INDEX_0 = 0,
33 INDEX_1,
34 INDEX_2,
35 INDEX_3,
36 MOVE_EIGHT_BITS = 8,
37 MOVE_SIXTEEN_BITS = 16,
38 MOVE_TWENTY_FOUR_BITS = 24,
39 };
40
ConvertUint32(const uint8_t * bitOperat)41 static uint32_t ConvertUint32(const uint8_t *bitOperat)
42 {
43 if (bitOperat == nullptr) {
44 return 0;
45 }
46
47 return (bitOperat[INDEX_0] << MOVE_TWENTY_FOUR_BITS) | (bitOperat[INDEX_1] << MOVE_SIXTEEN_BITS) |
48 (bitOperat[INDEX_2] << MOVE_EIGHT_BITS) | (bitOperat[INDEX_3]);
49 }
50
HostFuncSwitch(uint32_t cmd,const uint8_t * & rawData)51 static void HostFuncSwitch(uint32_t cmd, const uint8_t *&rawData)
52 {
53 switch (cmd) {
54 case CAMERA_HOST_PRELAUNCH: {
55 cameraTest->serviceV1_1->Prelaunch(reinterpret_cast<const HDI::Camera::V1_1::PrelaunchConfig &>(rawData));
56 break;
57 }
58 case CAMERA_HOST_GET_CAMERA_IDS: {
59 std::vector<std::string> cameraIds = {};
60 std::string *data = const_cast<std::string *>(reinterpret_cast<const std::string *>(rawData));
61 cameraIds.push_back(*data);
62 cameraTest->serviceV1_1->GetCameraIds(cameraIds);
63 break;
64 }
65 case CAMERA_HOST_GET_CAMERA_ABILITY: {
66 std::vector<uint8_t> abilityVec = {};
67 uint8_t *data = const_cast<uint8_t *>(rawData);
68 abilityVec.push_back(*data);
69 cameraTest->serviceV1_1->GetCameraAbility(*reinterpret_cast<const std::string *>(rawData), abilityVec);
70 break;
71 }
72 case CAMERA_HOST_OPEN_CAMERA: {
73 sptr<HDI::Camera::V1_0::ICameraDevice> g_CameraDevice = nullptr;
74 const sptr<HDI::Camera::V1_0::ICameraDeviceCallback> callback =
75 const_cast<HDI::Camera::V1_0::ICameraDeviceCallback *>(
76 reinterpret_cast<const HDI::Camera::V1_0::ICameraDeviceCallback *>(rawData));
77
78 cameraTest->serviceV1_1->OpenCamera(
79 *reinterpret_cast<const std::string *>(rawData), callback, g_CameraDevice);
80 break;
81 }
82 case CAMERA_HOST_OPEN_CAMERA_V1_1: {
83 sptr<HDI::Camera::V1_1::ICameraDevice> g_CameraDevice = nullptr;
84 const sptr<HDI::Camera::V1_0::ICameraDeviceCallback> callback =
85 const_cast<HDI::Camera::V1_0::ICameraDeviceCallback *>(
86 reinterpret_cast<const HDI::Camera::V1_0::ICameraDeviceCallback *>(rawData));
87 cameraTest->serviceV1_1->OpenCamera_V1_1(
88 *reinterpret_cast<const std::string *>(rawData), callback, g_CameraDevice);
89 break;
90 }
91 case CAMERA_HOST_SET_FLASH_LIGHTS: {
92 cameraTest->serviceV1_1->SetFlashlight(*reinterpret_cast<const std::string *>(rawData), true);
93 break;
94 }
95 default:
96 return;
97 }
98 }
99
DoSomethingInterestingWithMyApi(const uint8_t * rawData,size_t size)100 bool DoSomethingInterestingWithMyApi(const uint8_t *rawData, size_t size)
101 {
102 (void)size;
103 if (rawData == nullptr) {
104 return false;
105 }
106
107 uint32_t cmd = ConvertUint32(rawData);
108 rawData += sizeof(cmd);
109
110 cameraTest = std::make_shared<OHOS::Camera::CameraManager>();
111 cameraTest->Init();
112 if (cameraTest->serviceV1_1 == nullptr) {
113 return false;
114 }
115 cameraTest->Open();
116 if (cameraTest->cameraDeviceV1_1 == nullptr) {
117 return false;
118 }
119
120 HostFuncSwitch(cmd, rawData);
121 cameraTest->Close();
122 return true;
123 }
124
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)125 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
126 {
127 if (size < OHOS::THRESHOLD) {
128 return 0;
129 }
130
131 OHOS::DoSomethingInterestingWithMyApi(data, size);
132 return 0;
133 }
134 } // namespace OHOS
135