1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "camera_manager_fuzzer.h"
17 #include "camera_manager.h"
18 #include "camera_log.h"
19 #include "input/camera_device.h"
20 #include "message_parcel.h"
21 #include <cstddef>
22 #include <cstdint>
23 #include <mutex>
24 #include "token_setproc.h"
25 #include "nativetoken_kit.h"
26 #include "accesstoken_kit.h"
27 #include "securec.h"
28 #include "system_ability_definition.h"
29
30 namespace OHOS {
31 namespace CameraStandard {
32 static constexpr int32_t MAX_CODE_LEN = 512;
33 static constexpr int32_t MIN_SIZE_NUM = 4;
34 const size_t THRESHOLD = 10;
35 sptr<CameraManager> manager = nullptr;
36 const int32_t NUM_10 = 10;
37 const int32_t NUM_100 = 100;
38 static const uint8_t* RAW_DATA = nullptr;
39 static size_t g_dataSize = 0;
40 static size_t g_pos;
41 std::shared_ptr<IDeferredPhotoProcSessionCallbackFuzz> photoSessionCallback =
42 std::make_shared<IDeferredPhotoProcSessionCallbackFuzz>();
43 std::shared_ptr<IDeferredVideoProcSessionCallbackFuzz> videoSessionCallback =
44 std::make_shared<IDeferredVideoProcSessionCallbackFuzz>();
45 std::shared_ptr<CameraManagerCallbackFuzz> managerCallback = std::make_shared<CameraManagerCallbackFuzz>();
46 std::shared_ptr<CameraMuteListenerFuzz> muteListenerCallback = std::make_shared<CameraMuteListenerFuzz>();
47 std::shared_ptr<FoldListenerFuzz> foldListenerCallback = std::make_shared<FoldListenerFuzz>();
48 std::shared_ptr<TorchListenerFuzz> torchListenerCallback = std::make_shared<TorchListenerFuzz>();
49
50 template<class T>
GetData()51 T GetData()
52 {
53 T object {};
54 size_t objectSize = sizeof(object);
55 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
56 return object;
57 }
58 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
59 if (ret != EOK) {
60 return {};
61 }
62 g_pos += objectSize;
63 return object;
64 }
65
66 template<class T>
GetArrLength(T & arr)67 uint32_t GetArrLength(T& arr)
68 {
69 if (arr == nullptr) {
70 MEDIA_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
71 return 0;
72 }
73 return sizeof(arr) / sizeof(arr[0]);
74 }
75
CameraManagerFuzzTest1()76 void CameraManagerFuzzer::CameraManagerFuzzTest1()
77 {
78 if ((RAW_DATA == nullptr) || (g_dataSize > MAX_CODE_LEN) || (g_dataSize < MIN_SIZE_NUM)) {
79 return;
80 }
81 manager = CameraManager::GetInstance();
82 CHECK_ERROR_RETURN_LOG(!manager, "GetInstance Error");
83 auto session = manager->CreateCaptureSession();
84 manager->CreateCaptureSession(&session);
85 int userId = GetData<int>();
86 auto deferedPhotoSession = manager->CreateDeferredPhotoProcessingSession(userId, photoSessionCallback);
87 manager->CreateDeferredPhotoProcessingSession(userId, photoSessionCallback, &deferedPhotoSession);
88 auto deferedVideoSession = manager->CreateDeferredVideoProcessingSession(userId, videoSessionCallback);
89 manager->CreateDeferredVideoProcessingSession(userId, videoSessionCallback, &deferedVideoSession);
90 sptr<IBufferProducer> bufferProducer;
91 auto photoOutput = manager->CreatePhotoOutput(bufferProducer);
92 manager->CreatePhotoOutputWithoutProfile(bufferProducer, &photoOutput);
93 sptr<Surface> surface;
94 sptr<PreviewOutput> previewOutput;
95 manager->CreatePreviewOutputWithoutProfile(surface, &previewOutput);
96 sptr<IStreamRepeat> streamPtr;
97 Profile profile;
98 manager->CreatePreviewOutputStream(streamPtr, profile, bufferProducer);
99 sptr<IStreamCapture> capture;
100 manager->ValidCreateOutputStream(profile, bufferProducer);
101 manager->CreatePreviewOutput(bufferProducer, GetData<int32_t>());
102 int32_t width = GetData<int32_t>();
103 int32_t height = GetData<int32_t>();
104 manager->CreateCustomPreviewOutput(surface, width, height);
105 sptr<MetadataOutput> metadataOutput;
106 std::vector<MetadataObjectType> metadataObjectTypes;
107 manager->CreateMetadataOutput(metadataOutput, metadataObjectTypes);
108 DepthProfile depthProfile;
109 auto depthDataOutput = manager->CreateDepthDataOutput(depthProfile, bufferProducer);
110 manager->CreateDepthDataOutput(depthProfile, bufferProducer, &depthDataOutput);
111 manager->CreateVideoOutput(surface);
112 manager->CreateVideoOutputStream(streamPtr, profile, bufferProducer);
113 sptr<VideoOutput> videoOutput;
114 manager->CreateVideoOutputWithoutProfile(surface, &videoOutput);
115 manager->DestroyStubObj();
116 manager->CameraServerDied(0);
117 manager->SetCallback(managerCallback);
118 manager->RegisterCameraMuteListener(muteListenerCallback);
119 manager->RegisterTorchListener(torchListenerCallback);
120 manager->RegisterFoldListener(foldListenerCallback);
121 }
122
CameraManagerFuzzTest2()123 void CameraManagerFuzzer::CameraManagerFuzzTest2()
124 {
125 if ((RAW_DATA == nullptr) || (g_dataSize > MAX_CODE_LEN) || (g_dataSize < MIN_SIZE_NUM)) {
126 return;
127 }
128 manager = CameraManager::GetInstance();
129 CHECK_ERROR_RETURN_LOG(!manager, "GetInstance Error");
130 std::string cameraId;
131 manager->GetCameraDeviceFromId(cameraId);
132 manager->GetCameras();
133 int32_t testPid = GetData<int32_t>();
134 int32_t status = GetData<int32_t>();
135 manager->GetCameraOutputStatus(testPid, status);
136 manager->foldScreenType_ = "test_type";
137 manager->GetSupportedCameras();
138 sptr<CameraInfo> info;
139 manager->CreateCameraInput(info);
140 manager->ReportEvent(cameraId);
141 CameraPosition position = CameraPosition::CAMERA_POSITION_BACK;
142 CameraType cameraType = CameraType::CAMERA_TYPE_DEFAULT;
143 auto input = manager->CreateCameraInput(position, cameraType);
144 manager->CreateCameraInput(position, cameraType, &input);
145 CameraManager::ProfilesWrapper profilesWrapper = {};
146 std::shared_ptr<OHOS::Camera::CameraMetadata> metadata =
147 std::make_shared<OHOS::Camera::CameraMetadata>(NUM_10, NUM_100);
148 camera_metadata_item_t item;
149 manager->ParseBasicCapability(profilesWrapper, metadata, item);
150 int32_t modeName = SceneMode::VIDEO;
151 manager->ParseExtendCapability(profilesWrapper, modeName, item);
152 modeName = SceneMode::NORMAL;
153 manager->ParseExtendCapability(profilesWrapper, modeName, item);
154 sptr<ICameraServiceCallback> cameraServiceCallback;
155 manager->SetCameraServiceCallback(cameraServiceCallback);
156 CameraFormat cameraFormat = CameraFormat::CAMERA_FORMAT_JPEG;
157 manager->GetCameraMetadataFormat(cameraFormat);
158 }
159
CameraManagerFuzzTest3()160 void CameraManagerFuzzer::CameraManagerFuzzTest3()
161 {
162 if ((RAW_DATA == nullptr) || (g_dataSize > MAX_CODE_LEN) || (g_dataSize < MIN_SIZE_NUM)) {
163 return;
164 }
165 manager = CameraManager::GetInstance();
166 CHECK_ERROR_RETURN_LOG(!manager, "GetInstance Error");
167 ITorchServiceCallbackFuzz torchServiceCallback;
168 TorchStatus torchStatus = TorchStatus::TORCH_STATUS_ON;
169 torchServiceCallback.OnTorchStatusChange(torchStatus);
170 IFoldServiceCallbackFuzz foldServiceCallback;
171 FoldStatus foldStatus = FoldStatus::EXPAND;
172 foldServiceCallback.OnFoldStatusChanged(foldStatus);
173 sptr<ITorchServiceCallback> torchCallback = new ITorchServiceCallbackFuzz();
174 manager->SetTorchServiceCallback(torchCallback);
175 sptr<IFoldServiceCallback> serviceCallback = new IFoldServiceCallbackFuzz();
176 manager->SetFoldServiceCallback(serviceCallback);
177 ICameraMuteServiceCallbackFuzz cameraMuteServiceCallback;
178 cameraMuteServiceCallback.OnCameraMute(GetData<bool>());
179 manager->IsCameraMuteSupported();
180 manager->IsCameraMuted();
181 manager->PrelaunchCamera();
182 manager->IsTorchSupported();
183 TorchMode mode = TorchMode::TORCH_MODE_ON;
184 manager->SetTorchMode(mode);
185 mode = TorchMode::TORCH_MODE_OFF;
186 manager->SetTorchMode(mode);
187 mode = TorchMode::TORCH_MODE_AUTO;
188 manager->SetTorchMode(mode);
189 manager->UpdateTorchMode(mode);
190 manager->GetTorchMode();
191 manager->SetCameraManagerNull();
192 }
193
Test()194 void Test()
195 {
196 auto cameraManager = std::make_unique<CameraManagerFuzzer>();
197 if (cameraManager == nullptr) {
198 MEDIA_INFO_LOG("cameraManager is null");
199 return;
200 }
201 cameraManager->CameraManagerFuzzTest1();
202 cameraManager->CameraManagerFuzzTest2();
203 cameraManager->CameraManagerFuzzTest3();
204 }
205
206 typedef void (*TestFuncs[1])();
207
208 TestFuncs g_testFuncs = {
209 Test,
210 };
211
FuzzTest(const uint8_t * rawData,size_t size)212 bool FuzzTest(const uint8_t* rawData, size_t size)
213 {
214 // initialize data
215 RAW_DATA = rawData;
216 g_dataSize = size;
217 g_pos = 0;
218
219 uint32_t code = GetData<uint32_t>();
220 uint32_t len = GetArrLength(g_testFuncs);
221 if (len > 0) {
222 g_testFuncs[code % len]();
223 } else {
224 MEDIA_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
225 }
226
227 return true;
228 }
229 } // namespace CameraStandard
230 } // namespace OHOS
231
232 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)233 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
234 {
235 if (size < OHOS::CameraStandard::THRESHOLD) {
236 return 0;
237 }
238
239 OHOS::CameraStandard::FuzzTest(data, size);
240 return 0;
241 }