1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "stream_repeat_stub_fuzzer.h"
17 #include "foundation/multimedia/camera_framework/common/utils/camera_log.h"
18 #include "hstream_repeat.h"
19 #include "iservice_registry.h"
20 #include "nativetoken_kit.h"
21 #include "system_ability_definition.h"
22 #include "token_setproc.h"
23 #include "accesstoken_kit.h"
24 #include "iconsumer_surface.h"
25 #include "metadata_utils.h"
26 #include "camera_service_ipc_interface_code.h"
27
28 namespace OHOS {
29 namespace CameraStandard {
30 namespace StreamRepeatStubFuzzer {
31 const int32_t LIMITSIZE = 2;
32 const int32_t PHOTO_WIDTH = 1280;
33 const int32_t PHOTO_HEIGHT = 960;
34 const int32_t PHOTO_FORMAT = 2000;
35 const RepeatStreamType REPEAT_STREAM_TYPE = RepeatStreamType::PREVIEW;
36
37 bool g_hasPermission = false;
38 sptr<HStreamRepeatStub> fuzz_{nullptr};
39
CheckPermission()40 void CheckPermission()
41 {
42 if (!g_hasPermission) {
43 uint64_t tokenId;
44 const char *perms[0];
45 perms[0] = "ohos.permission.CAMERA";
46 NativeTokenInfoParams infoInstance = { .dcapsNum = 0, .permsNum = 1, .aclsNum = 0, .dcaps = NULL,
47 .perms = perms, .acls = NULL, .processName = "camera_capture", .aplStr = "system_basic",
48 };
49 tokenId = GetAccessTokenId(&infoInstance);
50 SetSelfTokenID(tokenId);
51 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
52 g_hasPermission = true;
53 }
54 }
55
TestHandleAddDeferredSurface(uint8_t * rawData,size_t size)56 void TestHandleAddDeferredSurface(uint8_t *rawData, size_t size)
57 {
58 MessageParcel data;
59 data.WriteInterfaceToken(u"IStreamRepeat");
60 data.RewindRead(0);
61 MessageParcel reply;
62 MessageOption option;
63 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
64 CHECK_ERROR_RETURN(photoSurface == nullptr);
65 sptr<IBufferProducer> producer = photoSurface->GetProducer();
66 sptr<HStreamRepeat> hstreamRepeat = new HStreamRepeat(producer, PHOTO_FORMAT, PHOTO_WIDTH,
67 PHOTO_HEIGHT, REPEAT_STREAM_TYPE);
68 data.WriteRemoteObject(producer->AsObject());
69 data.WriteRawData(rawData, size);
70 uint32_t code = StreamRepeatInterfaceCode::CAMERA_ADD_DEFERRED_SURFACE;
71 hstreamRepeat->OnRemoteRequest(code, data, reply, option);
72 }
73
TestHandleAttachMetaSurface(uint8_t * rawData,size_t size)74 void TestHandleAttachMetaSurface(uint8_t *rawData, size_t size)
75 {
76 MessageParcel data;
77 data.WriteInterfaceToken(u"IStreamRepeat");
78 data.RewindRead(0);
79 MessageParcel reply;
80 MessageOption option;
81 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
82 CHECK_ERROR_RETURN(photoSurface == nullptr);
83 sptr<IBufferProducer> producer = photoSurface->GetProducer();
84 sptr<HStreamRepeat> hstreamRepeat = new HStreamRepeat(producer, PHOTO_FORMAT, PHOTO_WIDTH,
85 PHOTO_HEIGHT, REPEAT_STREAM_TYPE);
86 data.WriteRemoteObject(producer->AsObject());
87 data.WriteRawData(rawData, size);
88 uint32_t code = StreamRepeatInterfaceCode::CAMERA_ATTACH_META_SURFACE;
89 hstreamRepeat->OnRemoteRequest(code, data, reply, option);
90 }
91
TestHandleSetCallback(uint8_t * rawData,size_t size)92 void TestHandleSetCallback(uint8_t *rawData, size_t size)
93 {
94 MessageParcel data;
95 data.WriteInterfaceToken(u"IStreamRepeat");
96 data.RewindRead(0);
97 MessageParcel reply;
98 MessageOption option;
99 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
100 CHECK_ERROR_RETURN(photoSurface == nullptr);
101 sptr<IBufferProducer> producer = photoSurface->GetProducer();
102 sptr<HStreamRepeat> hstreamRepeat = new HStreamRepeat(producer, PHOTO_FORMAT, PHOTO_WIDTH,
103 PHOTO_HEIGHT, REPEAT_STREAM_TYPE);
104
105 sptr<IRemoteObject> object = nullptr;
106 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
107 CHECK_ERROR_RETURN(!samgr);
108 object = samgr->GetSystemAbility(AUDIO_POLICY_SERVICE_ID);
109 sptr<IStreamRepeatCallback> repeatCallback = iface_cast<IStreamRepeatCallback>(object);
110 CHECK_ERROR_RETURN(!repeatCallback);
111 data.WriteRemoteObject(repeatCallback->AsObject());
112 data.WriteRawData(rawData, size);
113 uint32_t code = StreamRepeatInterfaceCode::CAMERA_STREAM_REPEAT_SET_CALLBACK;
114 CHECK_ERROR_RETURN(!hstreamRepeat);
115 hstreamRepeat->OnRemoteRequest(code, data, reply, option);
116 }
117
Test(uint8_t * rawData,size_t size)118 void Test(uint8_t *rawData, size_t size)
119 {
120 CHECK_ERROR_RETURN(rawData == nullptr || size < LIMITSIZE);
121 CheckPermission();
122 Test_OnRemoteRequest(rawData, size);
123 TestHandleSetCallback(rawData, size);
124 TestHandleAddDeferredSurface(rawData, size);
125 TestHandleAttachMetaSurface(rawData, size);
126 }
127
RunCase(MessageParcel & data,uint32_t code)128 void RunCase(MessageParcel &data, uint32_t code)
129 {
130 MessageParcel reply;
131 MessageOption option;
132 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
133 CHECK_ERROR_RETURN(photoSurface == nullptr);
134 sptr<IBufferProducer> producer = photoSurface->GetProducer();
135 sptr<HStreamRepeat> hstreamRepeat = new HStreamRepeat(producer, PHOTO_FORMAT, PHOTO_WIDTH,
136 PHOTO_HEIGHT, REPEAT_STREAM_TYPE);
137 hstreamRepeat->OnRemoteRequest(code, data, reply, option);
138 }
139
Test_OnRemoteRequest(uint8_t * rawData,size_t size)140 void Test_OnRemoteRequest(uint8_t *rawData, size_t size)
141 {
142 static const int32_t MAX_CODE = 20;
143 for (int32_t i = 0; i < MAX_CODE; i++) {
144 MessageParcel data;
145 data.WriteInterfaceToken(u"IStreamRepeat");
146 data.WriteRawData(rawData, size);
147 data.RewindRead(0);
148 RunCase(data, i);
149 }
150 }
151
152 } // namespace StreamRepeatStubFuzzer
153 } // namespace CameraStandard
154 } // namespace OHOS
155
156 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)157 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
158 {
159 /* Run your code on data */
160 OHOS::CameraStandard::StreamRepeatStubFuzzer::Test(data, size);
161 return 0;
162 }