1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hstream_repeat_fuzzer.h"
17 #include "foundation/multimedia/camera_framework/common/utils/camera_log.h"
18 #include "message_parcel.h"
19 #include "iservice_registry.h"
20 #include <cstddef>
21 #include <cstdint>
22 #include <memory>
23 #include "token_setproc.h"
24 #include "iconsumer_surface.h"
25 #include "nativetoken_kit.h"
26 #include "accesstoken_kit.h"
27 #include "camera_metadata_info.h"
28 #include "metadata_utils.h"
29 #include "camera_service_ipc_interface_code.h"
30 #include "camera_device.h"
31 #include "camera_manager.h"
32 #include "ipc_skeleton.h"
33 #include "securec.h"
34
35 namespace OHOS {
36 namespace CameraStandard {
37 using namespace OHOS::HDI::Camera::V1_0;
38 static constexpr int32_t MAX_CODE_LEN = 512;
39 static constexpr int32_t MIN_SIZE_NUM = 4;
40 static const uint8_t* RAW_DATA = nullptr;
41 const size_t THRESHOLD = 10;
42 static size_t g_dataSize = 0;
43 static size_t g_pos;
44 const int32_t ITEMCOUNT = 10;
45 const int32_t DATASIZE = 100;
46 const int32_t PHOTO_WIDTH = 1280;
47 const int32_t PHOTO_HEIGHT = 960;
48 const int32_t PHOTO_FORMAT = 2000;
49
50 std::shared_ptr<HStreamRepeat> HStreamRepeatFuzzer::fuzz_{nullptr};
51
52 /*
53 * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T)
54 * tips: only support basic type
55 */
56 template<class T>
GetData()57 T GetData()
58 {
59 T object {};
60 size_t objectSize = sizeof(object);
61 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
62 return object;
63 }
64 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
65 if (ret != EOK) {
66 return {};
67 }
68 g_pos += objectSize;
69 return object;
70 }
71
72 template<class T>
GetArrLength(T & arr)73 uint32_t GetArrLength(T& arr)
74 {
75 if (arr == nullptr) {
76 MEDIA_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
77 return 0;
78 }
79 return sizeof(arr) / sizeof(arr[0]);
80 }
81
HStreamRepeatFuzzTest1()82 void HStreamRepeatFuzzer::HStreamRepeatFuzzTest1()
83 {
84 if ((RAW_DATA == nullptr) || (g_dataSize > MAX_CODE_LEN) || (g_dataSize < MIN_SIZE_NUM)) {
85 return;
86 }
87 sptr<Surface> photoSurface;
88 photoSurface = Surface::CreateSurfaceAsConsumer("hstreamrepeat");
89 fuzz_ = std::make_shared<HStreamRepeat>(nullptr,
90 PHOTO_FORMAT, PHOTO_WIDTH, PHOTO_HEIGHT, RepeatStreamType::PREVIEW);
91 CHECK_ERROR_RETURN_LOG(!fuzz_, "Create fuzz_ Error");
92 std::shared_ptr<OHOS::Camera::CameraMetadata> cameraAbility;
93 sptr<OHOS::HDI::Camera::V1_0::IStreamOperator> streamOperator;
94 fuzz_->LinkInput(streamOperator, cameraAbility);
95 StreamInfo_V1_1 streamInfo;
96 fuzz_->SetVideoStreamInfo(streamInfo);
97 fuzz_->SetStreamInfo(streamInfo);
98 sptr<OHOS::IBufferProducer> metaProducer;
99 fuzz_->SetMetaProducer(metaProducer);
100 SketchStatus status = SketchStatus::STOPED;
101 fuzz_->UpdateSketchStatus(status);
102 std::shared_ptr<OHOS::Camera::CameraMetadata> settings;
103 settings = std::make_shared<OHOS::Camera::CameraMetadata>(ITEMCOUNT, DATASIZE);
104 fuzz_->StartSketchStream(settings);
105 camera_position_enum_t cameraPosition = OHOS_CAMERA_POSITION_FRONT;
106 fuzz_->SetUsedAsPosition(cameraPosition);
107 fuzz_->Start(settings, GetData<bool>());
108 fuzz_->Start();
109 fuzz_->OnFrameStarted();
110 fuzz_->OnFrameEnded(GetData<int32_t>());
111 CaptureEndedInfoExt captureEndedInfo = {1, 100, true, "video123"};
112 fuzz_->OnDeferredVideoEnhancementInfo(captureEndedInfo);
113 fuzz_->OnFrameError(GetData<int32_t>());
114 fuzz_->OnSketchStatusChanged(status);
115 fuzz_->Stop();
116 fuzz_->Release();
117 fuzz_->ReleaseStream(GetData<bool>());
118 }
119
HStreamRepeatFuzzTest2()120 void HStreamRepeatFuzzer::HStreamRepeatFuzzTest2()
121 {
122 if ((RAW_DATA == nullptr) || (g_dataSize > MAX_CODE_LEN) || (g_dataSize < MIN_SIZE_NUM)) {
123 return;
124 }
125 sptr<Surface> photoSurface;
126 photoSurface = Surface::CreateSurfaceAsConsumer("hstreamrepeat");
127 if (fuzz_ == nullptr) {
128 fuzz_ = std::make_shared<HStreamRepeat>(nullptr,
129 PHOTO_FORMAT, PHOTO_WIDTH, PHOTO_HEIGHT, RepeatStreamType::PREVIEW);
130 }
131 sptr<IBufferProducer> producer = photoSurface->GetProducer();
132 fuzz_->AddDeferredSurface(producer);
133 fuzz_->SetFrameRate(GetData<int32_t>(), GetData<int32_t>());
134 fuzz_->SetMirror(GetData<bool>());
135 fuzz_->SetMirrorForLivePhoto(GetData<bool>(), GetData<int32_t>());
136 fuzz_->SetCameraRotation(GetData<bool>(), GetData<int32_t>());
137 fuzz_->SetCameraApi(GetData<uint32_t>());
138 std::string deviceClass;
139 fuzz_->SetPreviewRotation(deviceClass);
140 fuzz_->UpdateSketchRatio(GetData<float>());
141 fuzz_->GetSketchStream();
142 fuzz_->GetRepeatStreamType();
143 fuzz_->SyncTransformToSketch();
144 fuzz_->SetStreamTransform(GetData<int>());
145 camera_position_enum_t cameraPosition = OHOS_CAMERA_POSITION_FRONT;
146 int32_t sensorOrientation = GetData<int32_t>();
147 fuzz_->ProcessVerticalCameraPosition(sensorOrientation, cameraPosition);
148 int32_t streamRotation = GetData<int32_t>();
149 fuzz_->ProcessCameraPosition(streamRotation, cameraPosition);
150 fuzz_->ProcessFixedTransform(sensorOrientation, cameraPosition);
151 fuzz_->ProcessFixedDiffDeviceTransform(cameraPosition);
152 fuzz_->ProcessCameraSetRotation(sensorOrientation, cameraPosition);
153 camera_position_enum_t cameraPosition1 = OHOS_CAMERA_POSITION_BACK;
154 int32_t sensorOrientation1 = GetData<int32_t>();
155 fuzz_->ProcessVerticalCameraPosition(sensorOrientation1, cameraPosition1);
156 int32_t streamRotation1 = GetData<int32_t>();
157 fuzz_->ProcessCameraPosition(streamRotation1, cameraPosition1);
158 fuzz_->ProcessFixedTransform(sensorOrientation1, cameraPosition1);
159 fuzz_->ProcessFixedDiffDeviceTransform(cameraPosition1);
160 fuzz_->ProcessCameraSetRotation(sensorOrientation1, cameraPosition1);
161 }
162
HStreamRepeatFuzzTest3()163 void HStreamRepeatFuzzer::HStreamRepeatFuzzTest3()
164 {
165 if ((RAW_DATA == nullptr) || (g_dataSize > MAX_CODE_LEN) || (g_dataSize < MIN_SIZE_NUM)) {
166 return;
167 }
168 sptr<Surface> photoSurface;
169 photoSurface = Surface::CreateSurfaceAsConsumer("hstreamrepeat");
170 if (fuzz_ == nullptr) {
171 fuzz_ = std::make_shared<HStreamRepeat>(nullptr,
172 PHOTO_FORMAT, PHOTO_WIDTH, PHOTO_HEIGHT, RepeatStreamType::PREVIEW);
173 }
174 sptr<IBufferProducer> producer = photoSurface->GetProducer();
175 std::shared_ptr<OHOS::Camera::CameraMetadata> settings;
176 settings = std::make_shared<OHOS::Camera::CameraMetadata>(ITEMCOUNT, DATASIZE);
177 fuzz_->OperatePermissionCheck(GetData<int>());
178 fuzz_->OpenVideoDfxSwitch(settings);
179 fuzz_->EnableSecure(GetData<bool>());
180 fuzz_->UpdateVideoSettings(settings);
181 fuzz_->UpdateFrameRateSettings(settings);
182 std::shared_ptr<OHOS::Camera::CameraMetadata> dynamicSetting;
183 fuzz_->UpdateFrameMuteSettings(settings, dynamicSetting);
184 #ifdef NOTIFICATION_ENABLE
185 fuzz_->UpdateBeautySettings(settings);
186 fuzz_->CancelNotification();
187 fuzz_->IsNeedBeautyNotification();
188 #endif
189 sptr<IStreamCapture> photoOutput = nullptr;
190 fuzz_->AttachMetaSurface(producer, GetData<int32_t>());
191 fuzz_->ToggleAutoVideoFrameRate(GetData<bool>());
192 fuzz_->UpdateAutoFrameRateSettings(settings);
193 std::shared_ptr<HStreamRepeatCallbackStub> callback = std::make_shared<HStreamRepeatCallbackStubDemo>();
194 MessageParcel data;
195 callback->HandleOnDeferredVideoEnhancementInfo(data);
196 }
197
Test()198 void Test()
199 {
200 auto hstreamRepeat = std::make_unique<HStreamRepeatFuzzer>();
201 if (hstreamRepeat == nullptr) {
202 MEDIA_INFO_LOG("hstreamRepeat is null");
203 return;
204 }
205 hstreamRepeat->HStreamRepeatFuzzTest1();
206 hstreamRepeat->HStreamRepeatFuzzTest2();
207 hstreamRepeat->HStreamRepeatFuzzTest3();
208 }
209
210 typedef void (*TestFuncs[1])();
211
212 TestFuncs g_testFuncs = {
213 Test,
214 };
215
FuzzTest(const uint8_t * rawData,size_t size)216 bool FuzzTest(const uint8_t* rawData, size_t size)
217 {
218 // initialize data
219 RAW_DATA = rawData;
220 g_dataSize = size;
221 g_pos = 0;
222
223 uint32_t code = GetData<uint32_t>();
224 uint32_t len = GetArrLength(g_testFuncs);
225 if (len > 0) {
226 g_testFuncs[code % len]();
227 } else {
228 MEDIA_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
229 }
230
231 return true;
232 }
233 } // namespace CameraStandard
234 } // namespace OHOS
235
236 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)237 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
238 {
239 if (size < OHOS::CameraStandard::THRESHOLD) {
240 return 0;
241 }
242
243 OHOS::CameraStandard::FuzzTest(data, size);
244 return 0;
245 }