1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstddef>
17 #include <cstdint>
18 #include <fcntl.h>
19 #include <unistd.h>
20 #include <sys/stat.h>
21 #include "securec.h"
22
23 #include <iostream>
24 #include "demuxer_sample.h"
25
26
27 #define FUZZ_PROJECT_NAME "demuxer_fuzzer"
28 using namespace std;
29 using namespace OHOS::Media;
30 namespace OHOS {
31 const char *TS_PATH = "/data/test/fuzz_create.ts";
32 const int64_t EXPECT_SIZE = 37;
33 const size_t TIME_SIZE = 5;
34 const size_t URI_SIZE = 25;
35 const size_t URI_BUFFER_SIZE = 21;
36 const int64_t URI_COUNT = 20;
37 const char FLAG = '\0';
38 const size_t TRACK_TYPE_SIZE = 26;
39 const size_t DURATION_SIZE = 27;
40 const size_t HEIGHT_SIZE = 28;
41 const size_t FRAME_RATE_SIZE = 29;
42 const size_t LANGUAGE_SIZE = 31;
43 const size_t LANGUAGE_BUFFER_SIZE = 3;
44 const size_t LANGUAGE_COUNT = 2;
45 const size_t CODEC_CONFIG_SIZE = 32;
46 const size_t SAMPLE_RATE_SIZE = 33;
47 const size_t CHANNEL_COUNT = 34;
48 const size_t VIDEO_HEIGHT_SIZE = 35;
49 const size_t VIDEO_WIDTH_SIZE = 36;
CheckDataValidity(const uint8_t * data,size_t size)50 bool CheckDataValidity(const uint8_t *data, size_t size)
51 {
52 if (size < EXPECT_SIZE) {
53 return false;
54 }
55 int32_t fd = open(TS_PATH, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
56 if (fd < 0) {
57 return false;
58 }
59 int len = write(fd, data, size - 36);
60 if (len <= 0) {
61 close(fd);
62 return false;
63 }
64 close(fd);
65 return true;
66 }
DemuxerFuzzTest(const uint8_t * data,size_t size)67 bool DemuxerFuzzTest(const uint8_t *data, size_t size)
68 {
69 if (!CheckDataValidity(data, size)) {
70 return false;
71 }
72 struct Params params;
73 params.time = data[size - TIME_SIZE];
74 char *uri = new char[URI_BUFFER_SIZE];
75 if (memcpy_s(uri, URI_BUFFER_SIZE, data + size - URI_SIZE, URI_COUNT) != 0) {
76 delete[] uri;
77 return false;
78 }
79 uri[URI_COUNT] = FLAG;
80 params.setTrackType = data[size - TRACK_TYPE_SIZE];
81 params.setDuration = data[size - DURATION_SIZE];
82 params.setHeight = data[size - HEIGHT_SIZE];
83 params.setFrameRate = data[size - FRAME_RATE_SIZE];
84 char *setLanguage = new char[LANGUAGE_BUFFER_SIZE];
85 if (memcpy_s(setLanguage, LANGUAGE_BUFFER_SIZE, data + size - LANGUAGE_SIZE, LANGUAGE_COUNT) != 0) {
86 delete[] uri;
87 delete[] setLanguage;
88 return false;
89 }
90 setLanguage[LANGUAGE_COUNT] = FLAG;
91 params.setCodecConfigSize = data[size - CODEC_CONFIG_SIZE];
92 params.sampleRate = data[size - SAMPLE_RATE_SIZE];
93 params.channelCount = data[size - CHANNEL_COUNT];
94 params.setVideoHeight = data[size - VIDEO_HEIGHT_SIZE];
95 params.setVideoWidth = data[size - VIDEO_WIDTH_SIZE];
96 uint8_t *dataConver = const_cast<uint8_t *>(data);
97 uint32_t *createSize = reinterpret_cast<uint32_t *>(dataConver + size - 4);
98 shared_ptr<DemuxerSample> demuxerSample = make_shared<DemuxerSample>();
99 demuxerSample->filePath = TS_PATH;
100 demuxerSample->RunNormalDemuxer(*createSize, uri, setLanguage, params);
101 delete[] uri;
102 delete[] setLanguage;
103 int ret = remove(TS_PATH);
104 if (ret != 0) {
105 return false;
106 }
107 return true;
108 }
109 } // namespace OHOS
110
111 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)112 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
113 {
114 /* Run your code on data */
115 OHOS::DemuxerFuzzTest(data, size);
116 return 0;
117 }
118