1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "deferred_processing_stub_fuzzer.h"
17 #include "buffer_info.h"
18 #include "deferred_processing_service.h"
19 #include "foundation/multimedia/camera_framework/common/utils/camera_log.h"
20 #include "metadata_utils.h"
21 #include "ipc_skeleton.h"
22 #include "access_token.h"
23 #include "hap_token_info.h"
24 #include "accesstoken_kit.h"
25 #include "nativetoken_kit.h"
26 #include "token_setproc.h"
27 using namespace std;
28
29 namespace OHOS {
30 namespace CameraStandard {
31 const int32_t LIMITSIZE = 2;
32 const int32_t USERID = 1;
33 bool g_isDeferredProcessingPermission = false;
34
DeferredProcessingFuzzTestGetPermission()35 void DeferredProcessingFuzzTestGetPermission()
36 {
37 if (!g_isDeferredProcessingPermission) {
38 uint64_t tokenId;
39 const char *perms[0];
40 perms[0] = "ohos.permission.CAMERA";
41 NativeTokenInfoParams infoInstance = { .dcapsNum = 0, .permsNum = 1, .aclsNum = 0, .dcaps = NULL,
42 .perms = perms, .acls = NULL, .processName = "camera_capture", .aplStr = "system_basic",
43 };
44 tokenId = GetAccessTokenId(&infoInstance);
45 SetSelfTokenID(tokenId);
46 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
47 g_isDeferredProcessingPermission = true;
48 }
49 }
50
DeferredProcessingPhotoFuzzTest(uint8_t * rawData,size_t size)51 void DeferredProcessingPhotoFuzzTest(uint8_t *rawData, size_t size)
52 {
53 CHECK_ERROR_RETURN(rawData == nullptr || size < LIMITSIZE);
54 DeferredProcessingFuzzTestGetPermission();
55
56 MessageParcel data;
57 data.WriteRawData(rawData, size);
58 DeferredProcessing::DeferredProcessingService::GetInstance().Initialize();
59 sptr<IDeferredPhotoProcessingSessionCallbackFuzz> IDPSessionCallbackFuzz =
60 sptr<IDeferredPhotoProcessingSessionCallbackFuzz>::MakeSptr();
61 sptr<IDeferredPhotoProcessingSession> session =
62 DeferredProcessingService::GetInstance().CreateDeferredPhotoProcessingSession(USERID, IDPSessionCallbackFuzz);
63 session->BeginSynchronize();
64 session->EndSynchronize();
65 auto imageId = data.ReadString();
66 bool restorable = data.RewindRead(0);
67 session->RemoveImage(imageId, restorable);
68 session->RestoreImage(imageId);
69 auto appName = data.ReadString();
70 session->ProcessImage(appName, imageId);
71 session->CancelProcessImage(imageId);
72 }
73
DeferredProcessingVideoFuzzTest(uint8_t * rawData,size_t size)74 void DeferredProcessingVideoFuzzTest(uint8_t *rawData, size_t size)
75 {
76 CHECK_ERROR_RETURN(rawData == nullptr || size < LIMITSIZE);
77 DeferredProcessingFuzzTestGetPermission();
78
79 MessageParcel data;
80 data.WriteRawData(rawData, size);
81 DeferredProcessing::DeferredProcessingService::GetInstance().Initialize();
82 sptr<IDeferredVideoProcessingSessionCallbackFuzz> IDPSessionCallbackFuzz =
83 sptr<IDeferredVideoProcessingSessionCallbackFuzz>::MakeSptr();
84 sptr<IDeferredVideoProcessingSession> session =
85 DeferredProcessingService::GetInstance().CreateDeferredVideoProcessingSession(USERID, IDPSessionCallbackFuzz);
86 session->BeginSynchronize();
87 session->EndSynchronize();
88 sptr<IPCFileDescriptor> srcFd = sptr<IPCFileDescriptor>::MakeSptr(data.ReadFileDescriptor());
89 sptr<IPCFileDescriptor> dstFd = sptr<IPCFileDescriptor>::MakeSptr(data.ReadFileDescriptor());
90 auto videoId = data.ReadString();
91 session->AddVideo(videoId, srcFd, dstFd);
92 bool restorable = data.RewindRead(0);
93 session->RemoveVideo(videoId, restorable);
94 session->RestoreVideo(videoId);
95 }
96
TestBufferInfo(uint8_t * rawData,size_t size)97 void TestBufferInfo(uint8_t *rawData, size_t size)
98 {
99 CHECK_ERROR_RETURN(rawData == nullptr || size < LIMITSIZE);
100 MessageParcel data;
101 data.WriteRawData(rawData, size);
102 const int32_t MAX_BUFF_SIZE = 1024 * 1024;
103 int32_t dataSize = (data.ReadInt32() % MAX_BUFF_SIZE) + 1;
104 auto sharedBuffer = make_shared<SharedBuffer>(dataSize);
105 sharedBuffer->GetSize();
106 sharedBuffer->GetFd();
107 sharedBuffer->Initialize();
108 sharedBuffer->GetSize();
109 sharedBuffer->CopyFrom(rawData, size);
110 sharedBuffer->GetFd();
111 sharedBuffer->Reset();
112 bool isHighQuality = data.ReadBool();
113 uint32_t cloudImageEnhanceFlag = 0;
114 BufferInfo info(sharedBuffer, dataSize, isHighQuality, cloudImageEnhanceFlag);
115 info.GetDataSize();
116 info.IsHighQuality();
117 info.GetIPCFileDescriptor();
118 }
119 } // namespace CameraStandard
120 } // namespace OHOS
121
122 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)123 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
124 {
125 /* Run your code on data */
126 OHOS::CameraStandard::DeferredProcessingPhotoFuzzTest(data, size);
127 OHOS::CameraStandard::TestBufferInfo(data, size);
128 OHOS::CameraStandard::DeferredProcessingVideoFuzzTest(data, size);
129 return 0;
130 }
131
132