1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "stream_metadata_stub_fuzzer.h"
17 #include "foundation/multimedia/camera_framework/common/utils/camera_log.h"
18 #include "hstream_metadata.h"
19 #include "nativetoken_kit.h"
20 #include "token_setproc.h"
21 #include "accesstoken_kit.h"
22 #include "camera_metadata_info.h"
23 #include "iconsumer_surface.h"
24 #include "metadata_utils.h"
25 #include "camera_service_ipc_interface_code.h"
26 #include <fuzzer/FuzzedDataProvider.h>
27
28 namespace {
29
30 const int32_t LIMITSIZE = 2;
31 const size_t LIMITCOUNT = 4;
32 const int32_t PHOTO_FORMAT = 2000;
33 const uint32_t INVALID_CODE = 9999;
34 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IStreamCapture";
35
MakeMetadata(uint8_t * rawData,size_t size)36 std::shared_ptr<OHOS::Camera::CameraMetadata> MakeMetadata(uint8_t *rawData, size_t size)
37 {
38 int32_t itemCount = 10;
39 int32_t dataSize = 100;
40 FuzzedDataProvider fdp(rawData, size);
41
42 int32_t *streams = reinterpret_cast<int32_t *>(rawData);
43 std::shared_ptr<OHOS::Camera::CameraMetadata> ability;
44 ability = std::make_shared<OHOS::Camera::CameraMetadata>(itemCount, dataSize);
45 ability->addEntry(OHOS_ABILITY_STREAM_AVAILABLE_EXTEND_CONFIGURATIONS, streams, size / LIMITCOUNT);
46 int32_t compensationRange[2] = {rawData[0], rawData[1]};
47 ability->addEntry(OHOS_CONTROL_AE_COMPENSATION_RANGE, compensationRange,
48 sizeof(compensationRange) / sizeof(compensationRange[0]));
49 float focalLength = fdp.ConsumeFloatingPoint<float>();
50 ability->addEntry(OHOS_ABILITY_FOCAL_LENGTH, &focalLength, 1);
51
52 int32_t sensorOrientation = fdp.ConsumeIntegral<int32_t>();
53 ability->addEntry(OHOS_SENSOR_ORIENTATION, &sensorOrientation, 1);
54
55 int32_t cameraPosition = fdp.ConsumeIntegral<int32_t>();
56 ability->addEntry(OHOS_ABILITY_CAMERA_POSITION, &cameraPosition, 1);
57
58 const camera_rational_t aeCompensationStep[] = {{rawData[0], rawData[1]}};
59 ability->addEntry(OHOS_CONTROL_AE_COMPENSATION_STEP, &aeCompensationStep,
60 sizeof(aeCompensationStep) / sizeof(aeCompensationStep[0]));
61 return ability;
62 }
63
64 }
65
66 namespace OHOS {
67 namespace CameraStandard {
68 namespace StreamMetadataStubFuzzer {
69
70 bool g_hasPermission = false;
71 sptr<HStreamMetadataStub> fuzz_{nullptr};
72
CheckPermission()73 void CheckPermission()
74 {
75 if (!g_hasPermission) {
76 uint64_t tokenId;
77 const char *perms[0];
78 perms[0] = "ohos.permission.CAMERA";
79 NativeTokenInfoParams infoInstance = { .dcapsNum = 0, .permsNum = 1, .aclsNum = 0, .dcaps = NULL,
80 .perms = perms, .acls = NULL, .processName = "camera_capture", .aplStr = "system_basic",
81 };
82 tokenId = GetAccessTokenId(&infoInstance);
83 SetSelfTokenID(tokenId);
84 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
85 g_hasPermission = true;
86 }
87 }
88
Test(uint8_t * rawData,size_t size)89 void Test(uint8_t *rawData, size_t size)
90 {
91 if (rawData == nullptr || size < LIMITSIZE) {
92 return;
93 }
94 CheckPermission();
95
96 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
97 CHECK_ERROR_RETURN_LOG(!photoSurface, "StreamMetadataStubFuzzer: Create photoSurface Error");
98 sptr<IBufferProducer> producer = photoSurface->GetProducer();
99 const int32_t face = 0;
100 std::vector<int32_t> type = {face};
101 fuzz_ = new HStreamMetadata(producer, PHOTO_FORMAT, type);
102 CHECK_ERROR_RETURN_LOG(!fuzz_, "Create fuzz_ Error");
103
104 Test_OnRemoteRequest(rawData, size);
105 }
106
Test_OnRemoteRequest(uint8_t * rawData,size_t size)107 void Test_OnRemoteRequest(uint8_t *rawData, size_t size)
108 {
109 MessageParcel data;
110 data.WriteInterfaceToken(fuzz_->GetDescriptor());
111 auto metadata = MakeMetadata(rawData, size);
112 CHECK_ERROR_RETURN_LOG(!(OHOS::Camera::MetadataUtils::EncodeCameraMetadata(metadata, data)),
113 "StreamMetadataStubFuzzer: EncodeCameraMetadata Error");
114 uint32_t code;
115 MessageParcel reply;
116 MessageOption option;
117 code = static_cast<uint32_t>(StreamMetadataInterfaceCode::CAMERA_STREAM_META_START);
118 data.RewindRead(0);
119 fuzz_->OnRemoteRequest(code, data, reply, option);
120
121 code = static_cast<uint32_t>(StreamMetadataInterfaceCode::CAMERA_STREAM_META_STOP);
122 data.RewindRead(0);
123 fuzz_->OnRemoteRequest(code, data, reply, option);
124
125 code = static_cast<uint32_t>(StreamMetadataInterfaceCode::CAMERA_STREAM_META_RELEASE);
126 data.RewindRead(0);
127 fuzz_->OnRemoteRequest(code, data, reply, option);
128
129 code = INVALID_CODE;
130 data.RewindRead(0);
131 fuzz_->OnRemoteRequest(code, data, reply, option);
132 }
133
134 } // namespace StreamMetadataStubFuzzer
135 } // namespace CameraStandard
136 } // namespace OHOS
137
138 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)139 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
140 {
141 /* Run your code on data */
142 OHOS::CameraStandard::StreamMetadataStubFuzzer::Test(data, size);
143 return 0;
144 }