1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "bufferqueue_fuzzer.h"
17
18 #include <securec.h>
19
20 #include "buffer_queue.h"
21 #include "data_generate.h"
22 #include "surface.h"
23 #include "surface_buffer.h"
24 #include "surface_buffer_impl.h"
25 #include "buffer_extra_data.h"
26 #include "buffer_extra_data_impl.h"
27 #include "sync_fence.h"
28
29 using namespace g_fuzzCommon;
30 namespace OHOS {
GetBufferExtraDataFromData()31 sptr<BufferExtraData> GetBufferExtraDataFromData()
32 {
33 // get data
34 std::string keyInt32 = GetStringFromData(STR_LEN);
35 int32_t valueInt32 = GetData<int32_t>();
36 std::string keyInt64 = GetStringFromData(STR_LEN);
37 int64_t valueInt64 = GetData<int64_t>();
38 std::string keyDouble = GetStringFromData(STR_LEN);
39 double valueDouble = GetData<double>();
40 std::string keyStr = GetStringFromData(STR_LEN);
41 std::string valueStr = GetStringFromData(STR_LEN);
42
43 // test
44 sptr<BufferExtraData> bedata = new BufferExtraDataImpl();
45 bedata->ExtraSet(keyInt32, valueInt32);
46 bedata->ExtraSet(keyInt64, valueInt64);
47 bedata->ExtraSet(keyDouble, valueDouble);
48 bedata->ExtraSet(keyStr, valueStr);
49
50 bedata->ExtraGet(keyInt32, valueInt32);
51 bedata->ExtraGet(keyInt64, valueInt64);
52 bedata->ExtraGet(keyDouble, valueDouble);
53 bedata->ExtraGet(keyStr, valueStr);
54 return bedata;
55 }
56
BufferQueueFuzzTest2()57 void BufferQueueFuzzTest2()
58 {
59 std::string name = GetStringFromData(STR_LEN);
60 uint32_t queueSize = GetData<uint32_t>();
61 int32_t width = GetData<int32_t>();
62 int32_t height = GetData<int32_t>();
63 uint64_t usage = GetData<uint64_t>();
64 uint32_t sequence = GetData<uint32_t>();
65 std::vector<GraphicHDRMetaData> metaData;
66 for (int i = 0; i < 10; i++) { // add 10 elements to the vector
67 GraphicHDRMetaData hDRMetaData = GetData<GraphicHDRMetaData>();
68 metaData.push_back(hDRMetaData);
69 }
70 GraphicHDRMetadataKey key = GetData<GraphicHDRMetadataKey>();
71 std::vector<uint8_t> metaDataSet;
72 for (int i = 0; i < 10; i++) { // add 10 elements to the vector
73 uint8_t metaDataElement = GetData<uint8_t>();
74 metaDataSet.push_back(metaDataElement);
75 }
76 bool flag = GetData<bool>();
77 std::string result = GetStringFromData(STR_LEN);
78 bool status = GetData<bool>();
79 GraphicPresentTimestamp timestamp = GetData<GraphicPresentTimestamp>();
80 OHSurfaceSource sourceType = GetData<OHSurfaceSource>();
81 std::string appFrameworkType = GetStringFromData(STR_LEN);
82 // test
83 sptr<BufferQueue> bufferqueue = new BufferQueue(name);
84 bufferqueue->SetQueueSize(queueSize);
85 bufferqueue->SetDefaultWidthAndHeight(width, height);
86 bufferqueue->SetDefaultUsage(usage);
87 GraphicTransformType transform = GetData<GraphicTransformType >();
88 bufferqueue->SetTransform(transform);
89 bufferqueue->SetMetaData(sequence, metaData);
90 bufferqueue->SetMetaDataSet(sequence, key, metaDataSet);
91 bufferqueue->SetProducerCacheCleanFlag(flag);
92 bufferqueue->Dump(result);
93 bufferqueue->SetStatus(status);
94 bufferqueue->SetPresentTimestamp(sequence, timestamp);
95 bufferqueue->SetSurfaceSourceType(sourceType);
96 bufferqueue->SetSurfaceAppFrameworkType(appFrameworkType);
97 int64_t time = 0;
98 GraphicPresentTimestampType timestampType = GetData<GraphicPresentTimestampType>();
99 bufferqueue->GetPresentTimestamp(sequence, timestampType, time);
100 }
101
BufferQueueFuzzTest1()102 void BufferQueueFuzzTest1()
103 {
104 int32_t timeOut = 0;
105 std::string name = GetStringFromData(STR_LEN);
106 sptr<BufferQueue> bufferqueue = new BufferQueue(name);
107 uint32_t seqNum = GetData<uint32_t>();
108 BufferRequestConfig requestConfig = GetData<BufferRequestConfig>();
109 OHOS::Rect rect = GetData<OHOS::Rect>();
110 int64_t timestamp = GetData<int64_t>();
111 BufferFlushConfigWithDamages flushConfig = {.damages = { rect }, .timestamp = timestamp};
112 uint32_t sequence = GetData<uint32_t>();
113 std::vector<Rect> damages;
114 sptr<OHOS::SurfaceBuffer> buffer = new SurfaceBufferImpl(seqNum);
115 sptr<OHOS::SurfaceBuffer> buffer1 = SurfaceBuffer::Create();
116 sptr<BufferExtraData> bedata = GetBufferExtraDataFromData();
117 IBufferProducer::RequestBufferReturnValue retval;
118 retval.buffer = buffer;
119 bufferqueue->RegisterConsumerListener(nullptr);
120 OnReleaseFunc func;
121 bufferqueue->RegisterReleaseListener(func);
122 OnDeleteBufferFunc deleteBufferFunc;
123 bool isForUniRedraw = GetData<bool>();
124 bufferqueue->RegisterDeleteBufferListener(deleteBufferFunc, isForUniRedraw);
125 bufferqueue->RequestBuffer(requestConfig, bedata, retval);
126 {
127 std::mutex mutex;
128 std::unique_lock<std::mutex> lock(mutex);
129 bufferqueue->ReuseBuffer(requestConfig, bedata, retval, lock);
130 }
131 bufferqueue->CancelBuffer(sequence, bedata);
132 sptr<SyncFence> syncFence = SyncFence::INVALID_FENCE;
133 bufferqueue->FlushBuffer(sequence, bedata, syncFence, flushConfig);
134 bufferqueue->DoFlushBuffer(sequence, bedata, syncFence, flushConfig);
135 bufferqueue->AcquireBuffer(buffer, syncFence, timestamp, damages);
136 bufferqueue->ReleaseBuffer(buffer, syncFence);
137 bufferqueue->AttachBuffer(buffer1, timeOut);
138 bufferqueue->DetachBuffer(buffer1);
139 float matrix[16] = {0};
140 uint32_t matrixSize = GetData<uint32_t>();
141 bool isUseNewMatrix = GetData<bool>();
142 bool needRecordSequence = GetData<bool>();
143 bufferqueue->GetLastFlushedBuffer(buffer, syncFence, matrix, matrixSize, isUseNewMatrix, needRecordSequence);
144 bufferqueue->UnregisterConsumerListener();
145 bufferqueue->UnRegisterProducerReleaseListener();
146 GraphicTransformType transformType = GetData<GraphicTransformType>();
147 bufferqueue->SetTransform(transformType);
148 bufferqueue->GetTransform();
149 bufferqueue->SetTransformHint(transformType, GetData<uint64_t>());
150 bufferqueue->GetSurfaceSourceType();
151 float brightness = GetData<float>();
152 bufferqueue->SetHdrWhitePointBrightness(brightness);
153 IConsumerSurface::AcquireBufferReturnValue returnValue;
154 int64_t expectPresentTimestamp = GetData<int64_t>();
155 bool isUsingAutoTimestamp = GetData<bool>();
156 bufferqueue->AcquireBuffer(returnValue, expectPresentTimestamp, isUsingAutoTimestamp);
157 bufferqueue->WaitForCondition();
158 bufferqueue->RequestBufferDebugInfoLocked();
159 bufferqueue->CheckProducerCacheListLocked();
160 {
161 std::mutex mutex;
162 std::unique_lock<std::mutex> lock(mutex);
163 bufferqueue->ReallocBufferLocked(requestConfig, retval, lock);
164 }
165 bufferqueue->DelegatorQueueBuffer(sequence, syncFence);
166 bufferqueue->CallConsumerListener();
167 uint64_t uiTimestamp = GetData<uint64_t>();
168 bufferqueue->SetDesiredPresentTimestampAndUiTimestamp(sequence, expectPresentTimestamp, uiTimestamp);
169 int64_t desiredPresentTimestamp = GetData<int64_t>();
170 bufferqueue->IsPresentTimestampReady(desiredPresentTimestamp, expectPresentTimestamp);
171 bufferqueue->ListenerBufferReleasedCb(buffer, syncFence);
172 bufferqueue->OnBufferDeleteCbForHardwareThreadLocked(buffer);
173 {
174 std::mutex mutex;
175 std::unique_lock<std::mutex> lock(mutex);
176 bufferqueue->DeleteBufferInCache(sequence, lock);
177 }
178 sptr<OHOS::SurfaceBuffer> buffer2 = new SurfaceBufferImpl();
179 bufferqueue->SetSurfaceBufferGlobalAlphaUnlocked(buffer2);
180 int32_t alpha;
181 bufferqueue->GetGlobalAlpha(alpha);
182 std::string result;
183 bufferqueue->DumpCache(result);
184 bufferqueue->GetAvailableBufferCount();
185 }
186
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)187 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
188 {
189 if (data == nullptr) {
190 return false;
191 }
192
193 // initialize
194 g_data = data;
195 g_size = size;
196 g_pos = 0;
197 std::string name = GetStringFromData(STR_LEN);
198 sptr<BufferQueue> bufferqueue = new BufferQueue(name);
199 bool cleanAll = GetData<bool>();
200 bufferqueue->CleanCache(cleanAll, nullptr);
201 bufferqueue->GetHdrWhitePointBrightness();
202 bufferqueue->GetUniqueId();
203 bufferqueue->GoBackground();
204 ScalingMode mode = GetData<ScalingMode>();
205 bufferqueue->SetScalingMode(mode);
206 bool bufferHold = GetData<bool>();
207 bufferqueue->SetBufferHold(bufferHold);
208 uint32_t reserveInts = GetData<uint32_t>() % 0x100000; // no more than 0x100000
209 GraphicExtDataHandle *handle = AllocExtDataHandle(reserveInts);
210 sptr<SurfaceTunnelHandle> tunnelHandle = new SurfaceTunnelHandle();
211 tunnelHandle->SetHandle(handle);
212 bufferqueue->SetTunnelHandle(tunnelHandle);
213 FreeExtDataHandle(handle);
214 BufferQueueFuzzTest1();
215 BufferQueueFuzzTest2();
216
217 return true;
218 }
219 }
220
221 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)222 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
223 {
224 /* Run your code on data */
225 OHOS::DoSomethingInterestingWithMyAPI(data, size);
226 return 0;
227 }
228
229