1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "surface_fuzzer.h"
17
18 #include <securec.h>
19
20 #include "data_generate.h"
21 #include "iconsumer_surface.h"
22 #include "metadata_helper.h"
23 #include "producer_surface_delegator.h"
24 #include "surface.h"
25 #include "surface_buffer.h"
26 #include "surface_buffer_impl.h"
27 #include "sync_fence.h"
28 #include <iostream>
29
30 using namespace g_fuzzCommon;
31 using namespace OHOS::HDI::Display::Graphic::Common::V1_0;
32 namespace OHOS {
33 class TestConsumerListenerClazz : public IBufferConsumerListenerClazz {
34 public:
OnBufferAvailable()35 void OnBufferAvailable() override
36 {
37 }
38 };
OnBufferRelease(sptr<SurfaceBuffer> & buffer)39 GSError OnBufferRelease(sptr<SurfaceBuffer> &buffer)
40 {
41 return GSERROR_OK;
42 }
43
BufferDeleteCbFunc(int32_t seqNum)44 void BufferDeleteCbFunc(int32_t seqNum)
45 {
46 (void)seqNum;
47 }
48
MetadataHelperFuzzTest()49 void MetadataHelperFuzzTest()
50 {
51 CM_ColorSpaceInfo colorSpaceInfo1;
52 MetadataHelper::ConvertColorSpaceTypeToInfo(CM_SRGB_FULL, colorSpaceInfo1);
53 CM_ColorSpaceInfo colorSpaceInfo = GetData<CM_ColorSpaceInfo>();
54 CM_ColorSpaceType colorSpaceType;
55 MetadataHelper::ConvertColorSpaceInfoToType(colorSpaceInfo, colorSpaceType);
56
57 sptr<SurfaceBuffer> buffer = SurfaceBuffer::Create();
58 MetadataHelper::SetColorSpaceInfo(buffer, colorSpaceInfo);
59 MetadataHelper::GetColorSpaceInfo(buffer, colorSpaceInfo);
60
61 MetadataHelper::SetColorSpaceType(buffer, CM_SRGB_FULL);
62 MetadataHelper::GetColorSpaceType(buffer, colorSpaceType);
63
64 MetadataHelper::SetHDRMetadataType(buffer, CM_VIDEO_HDR_VIVID);
65 CM_HDR_Metadata_Type hdrMetadataType;
66 MetadataHelper::GetHDRMetadataType(buffer, hdrMetadataType);
67
68 HdrStaticMetadata metadataSet = GetData<HdrStaticMetadata>();
69 MetadataHelper::SetHDRStaticMetadata(buffer, metadataSet);
70 MetadataHelper::GetHDRStaticMetadata(buffer, metadataSet);
71 std::vector<uint8_t> metadataSets;
72 for (uint32_t i = 0; i < UINT8_MAX; i++) {
73 metadataSets.emplace_back(GetData<uint8_t>());
74 }
75 MetadataHelper::SetHDRDynamicMetadata(buffer, metadataSets);
76 MetadataHelper::GetHDRDynamicMetadata(buffer, metadataSets);
77
78 std::vector<uint8_t> hdrStaticMetadata;
79 for (uint32_t i = 0; i < UINT8_MAX; i++) {
80 hdrStaticMetadata.emplace_back(GetData<uint8_t>());
81 }
82 MetadataHelper::SetHDRStaticMetadata(buffer, hdrStaticMetadata);
83 MetadataHelper::GetHDRStaticMetadata(buffer, hdrStaticMetadata);
84 }
85
SurfaceFuzzTest4(sptr<OHOS::Surface> pSurface,sptr<OHOS::IConsumerSurface> cSurface)86 void SurfaceFuzzTest4(sptr<OHOS::Surface> pSurface, sptr<OHOS::IConsumerSurface> cSurface)
87 {
88 int32_t width = GetData<int32_t>();
89 int32_t height = GetData<int32_t>();
90 cSurface->SetDefaultWidthAndHeight(width, height);
91 uint64_t usage = GetData<uint64_t>();
92 cSurface->SetDefaultUsage(usage);
93 GraphicTransformType transform = GetData<GraphicTransformType>();
94 pSurface->SetTransform(transform);
95 cSurface->SetTransform(transform);
96 OHSurfaceSource sourceType = GetData<OHSurfaceSource>();
97 pSurface->SetSurfaceSourceType(sourceType);
98 cSurface->SetSurfaceSourceType(sourceType);
99 std::string appFrameworkType = GetStringFromData(STR_LEN);
100 cSurface->SetSurfaceAppFrameworkType(appFrameworkType);
101 pSurface->SetSurfaceAppFrameworkType(appFrameworkType);
102 std::string key = "";
103 cSurface->GetUserData(key);
104 cSurface->GetQueueSize();
105 cSurface->GetSurfaceSourceType();
106 GraphicExtDataHandle *handle = static_cast<GraphicExtDataHandle *>(
107 malloc(sizeof(GraphicExtDataHandle) + sizeof(int32_t)));
108 if (handle != nullptr) {
109 handle->fd = -1;
110 handle->reserveInts = 1;
111 handle->reserve[0] = GetData<int32_t>();
112 cSurface->SetTunnelHandle(handle);
113 free(handle);
114 handle = nullptr;
115 }
116 cSurface->GetSurfaceAppFrameworkType();
117 }
118
SurfaceFuzzTest3(sptr<OHOS::Surface> pSurface,sptr<OHOS::IConsumerSurface> cSurface)119 void SurfaceFuzzTest3(sptr<OHOS::Surface> pSurface, sptr<OHOS::IConsumerSurface> cSurface)
120 {
121 std::vector<sptr<SurfaceBuffer>> buffers;
122 std::vector<sptr<SyncFence>> fences;
123 BufferRequestConfig config = GetData<BufferRequestConfig>();
124 config.timeout %= 3000;
125 pSurface->RequestBuffers(buffers, fences, config);
126 BufferFlushConfigWithDamages flushConfig;
127 std::vector<Rect> rects{GetData<Rect>()};
128 flushConfig.damages = rects;
129 flushConfig.timestamp = GetData<int64_t>();
130 std::vector<BufferFlushConfigWithDamages> flushConfigs;
131 for (size_t i = 0; i < buffers.size(); i++) {
132 flushConfigs.emplace_back(flushConfig);
133 fences.emplace_back(SyncFence::INVALID_FENCE);
134 }
135 pSurface->FlushBuffers(buffers, fences, flushConfigs);
136 ScalingMode scalingMode = GetData<ScalingMode>();
137 uint32_t sequence = GetData<uint32_t>();
138 cSurface->SetScalingMode(sequence, scalingMode);
139 cSurface->SetScalingMode(scalingMode);
140 cSurface->GetScalingMode(sequence, scalingMode);
141 GraphicHDRMetaData metaData = GetData<GraphicHDRMetaData>();
142 std::vector<GraphicHDRMetaData> metaDatas = {metaData};
143 uint8_t metaData2 = GetData<uint8_t>();
144 std::vector<uint8_t> metaDatas2 = {metaData2};
145
146 cSurface->SetMetaData(sequence, metaDatas);
147 GraphicHDRMetadataKey metakey = GetData<GraphicHDRMetadataKey>();
148 cSurface->SetMetaDataSet(sequence, metakey, metaDatas2);
149 HDRMetaDataType metaType = GetData<HDRMetaDataType>();
150 cSurface->QueryMetaDataType(sequence, metaType);
151 cSurface->GetMetaData(sequence, metaDatas);
152 cSurface->GetMetaDataSet(sequence, metakey, metaDatas2);
153 GraphicPresentTimestamp ptimestamp = GetData<GraphicPresentTimestamp>();
154 cSurface->SetPresentTimestamp(sequence, ptimestamp);
155 cSurface->GetTunnelHandle();
156 bool hold = GetData<bool>();
157 cSurface->SetBufferHold(hold);
158 cSurface->GoBackground();
159 cSurface->GetTransform();
160 GraphicTransformType hintType = GetData<GraphicTransformType>();
161 cSurface->SetTransformHint(hintType);
162 cSurface->GetTransformHint();
163 cSurface->UnregisterConsumerListener();
164 bool isIncache = GetData<bool>();
165 cSurface->IsSurfaceBufferInCache(sequence, isIncache);
166 pSurface->UnRegisterReleaseListener();
167 pSurface->SetWindowConfig(config);
168 (void)pSurface->GetWindowConfig();
169 cSurface->SetWindowConfig(config);
170 (void)cSurface->GetWindowConfig();
171 }
172
SurfaceFuzzTest1(sptr<OHOS::Surface> pSurface,sptr<OHOS::IConsumerSurface> cSurface)173 void SurfaceFuzzTest1(sptr<OHOS::Surface> pSurface, sptr<OHOS::IConsumerSurface> cSurface)
174 {
175 pSurface->IsConsumer();
176 cSurface->IsConsumer();
177 bool cleanAll = GetData<bool>();
178 pSurface->CleanCache(cleanAll);
179 pSurface->QueryIfBufferAvailable();
180 pSurface->GetName();
181 pSurface->GoBackground();
182 pSurface->Connect();
183 uint64_t defaultUsage = GetData<uint64_t>();
184 pSurface->SetDefaultUsage(defaultUsage);
185 pSurface->GetDefaultUsage();
186 std::string userKey = GetStringFromData(STR_LEN);
187 pSurface->GetUserData(userKey);
188 sptr<SyncFence> syncFence = new SyncFence(-1);
189 uint32_t queueSize = GetData<uint32_t>();
190 int32_t fenceFd = syncFence->Get();
191 sptr<OHOS::SurfaceBuffer> buffer = new SurfaceBufferImpl(GetData<uint32_t>());
192 BufferRequestConfig requestConfig = GetData<BufferRequestConfig>();
193 BufferFlushConfig flushConfig = GetData<BufferFlushConfig>();
194 pSurface->RequestBuffer(buffer, fenceFd, requestConfig);
195 pSurface->CancelBuffer(buffer);
196 pSurface->FlushBuffer(buffer, fenceFd, flushConfig);
197 pSurface->AttachBuffer(buffer);
198 pSurface->DetachBuffer(buffer);
199 int32_t timeout = 0;
200 pSurface->AttachBuffer(buffer, timeout);
201 pSurface->DetachBuffer(buffer);
202 pSurface->SetQueueSize(queueSize);
203 Rect damage = GetData<Rect>();
204 int64_t timestamp = GetData<int64_t>();
205 cSurface->AcquireBuffer(buffer, fenceFd, timestamp, damage);
206 cSurface->ReleaseBuffer(buffer, fenceFd);
207 cSurface->AttachBuffer(buffer);
208 cSurface->DetachBuffer(buffer);
209 sptr<SurfaceBuffer> buffer1 = SurfaceBuffer::Create();
210 cSurface->AttachBuffer(buffer1, timeout);
211 cSurface->DetachBuffer(buffer1);
212 cSurface->AttachBufferToQueue(buffer);
213 cSurface->DetachBufferFromQueue(buffer);
214 syncFence = nullptr;
215 buffer = nullptr;
216 cSurface->SetQueueSize(queueSize);
217 }
218
SurfaceFuzzTest2()219 void SurfaceFuzzTest2()
220 {
221 // get data
222 std::string name = GetStringFromData(STR_LEN);
223 std::string key = GetStringFromData(STR_LEN);
224 std::string val = GetStringFromData(STR_LEN);
225 uint32_t sequence = GetData<uint32_t>();
226 ScalingMode scalingMode = GetData<ScalingMode>();
227 GraphicPresentTimestampType type = GetData<GraphicPresentTimestampType>();
228 int64_t time = GetData<int64_t>();
229 std::string result = GetStringFromData(STR_LEN);
230 sptr<OHOS::IConsumerSurface> cSurface = OHOS::IConsumerSurface::Create(name);
231 auto producer = cSurface->GetProducer();
232 sptr<OHOS::Surface> pSurface = OHOS::Surface::CreateSurfaceAsProducer(producer);
233 sptr<ProducerSurfaceDelegator> surfaceDelegator = ProducerSurfaceDelegator::Create();
234 cSurface->RegisterSurfaceDelegator(surfaceDelegator->AsObject());
235 cSurface->QueryIfBufferAvailable();
236 sptr<IBufferConsumerListener> listener = new BufferConsumerListener();
237 cSurface->RegisterConsumerListener(listener);
238 TestConsumerListenerClazz* listenerClazz = new TestConsumerListenerClazz();
239 cSurface->RegisterConsumerListener(listenerClazz);
240 cSurface->RegisterReleaseListener([](sptr<SurfaceBuffer> &buffer) { return GSERROR_OK; });
241 cSurface->RegisterDeleteBufferListener(BufferDeleteCbFunc);
242 std::string funcName = GetStringFromData(STR_LEN);
243 cSurface->RegisterUserDataChangeListener(funcName,
244 [](const std::string& key, const std::string& val) {});
245 pSurface->SetUserData(key, val);
246 pSurface->SetScalingMode(sequence, scalingMode);
247 pSurface->GetPresentTimestamp(sequence, type, time);
248 cSurface->SetUserData(key, val);
249 cSurface->Dump(result);
250 cSurface->GetDefaultWidth();
251 cSurface->GetDefaultUsage();
252 cSurface->GetHdrWhitePointBrightness();
253 cSurface->GetName();
254 cSurface->GetDefaultHeight();
255 cSurface->GetSdrWhitePointBrightness();
256 SurfaceFuzzTest1(pSurface, cSurface);
257 SurfaceFuzzTest3(pSurface, cSurface);
258 SurfaceFuzzTest4(pSurface, cSurface);
259 listener = nullptr;
260 free(listenerClazz);
261 pSurface = nullptr;
262 cSurface = nullptr;
263 MetadataHelperFuzzTest();
264 }
265
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)266 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
267 {
268 if (data == nullptr) {
269 return false;
270 }
271 g_data = data;
272 g_size = size;
273 g_pos = 0;
274 std::string name = GetStringFromData(STR_LEN);
275 uint32_t seqNum = GetData<uint32_t>();
276 sptr<OHOS::IConsumerSurface> cSurface = OHOS::IConsumerSurface::Create(name);
277 auto producer = cSurface->GetProducer();
278 sptr<OHOS::Surface> pSurface = OHOS::Surface::CreateSurfaceAsProducer(producer);
279 sptr<ProducerSurfaceDelegator> surfaceDelegator = ProducerSurfaceDelegator::Create();
280 pSurface->RegisterSurfaceDelegator(surfaceDelegator->AsObject());
281 pSurface->RegisterReleaseListener([](sptr<SurfaceBuffer> &buffer) ->
282 GSError {
283 return GSERROR_OK;
284 });
285 pSurface->RegisterReleaseListener([](const sptr<SurfaceBuffer> &buffer, const sptr<SyncFence> &fence) ->
286 GSError {
287 return GSERROR_OK;
288 });
289 std::string funcName = GetStringFromData(STR_LEN);
290 pSurface->RegisterUserDataChangeListener(funcName,
291 [](const std::string& key, const std::string& value) -> void {});
292 sptr<OHOS::SurfaceBuffer> buffer = new SurfaceBufferImpl(seqNum);
293 sptr<SyncFence> syncFence = SyncFence::INVALID_FENCE;
294 float matrix[16];
295 uint32_t matrixSize = GetData<uint32_t>();
296 bool isUseNewMatrix = GetData<bool>();
297 pSurface->AcquireLastFlushedBuffer(buffer, syncFence, matrix, matrixSize, isUseNewMatrix);
298 pSurface->ReleaseLastFlushedBuffer(buffer);
299 GraphicTransformType transformType;
300 cSurface->GetSurfaceBufferTransformType(buffer, &transformType);
301 buffer = nullptr;
302 SurfaceFuzzTest2();
303 pSurface->UnRegisterUserDataChangeListener(funcName);
304 pSurface->ClearUserDataChangeListener();
305 cSurface->ClearUserDataChangeListener();
306 sptr<OHOS::Surface> tmp = OHOS::Surface::CreateSurfaceAsConsumer();
307 tmp->RegisterConsumerListener(nullptr);
308 pSurface = nullptr;
309 cSurface = nullptr;
310 tmp = nullptr;
311 return true;
312 }
313 } // namespace OHOS
314
315 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)316 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
317 {
318 /* Run your code on data */
319 OHOS::DoSomethingInterestingWithMyAPI(data, size);
320 return 0;
321 }
322
323