1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "preview_output_fuzzer.h"
17 #include "camera_device.h"
18 #include "camera_log.h"
19 #include "camera_output_capability.h"
20 #include "capture_scene_const.h"
21 #include "input/camera_manager.h"
22 #include "message_parcel.h"
23 #include <cstdint>
24 #include <memory>
25 #include "token_setproc.h"
26 #include "nativetoken_kit.h"
27 #include "accesstoken_kit.h"
28 #include "securec.h"
29
30 namespace OHOS {
31 namespace CameraStandard {
32 namespace PreviewOutputFuzzer {
33 const int32_t LIMITSIZE = 4;
34 const int32_t NUM_TWO = 2;
35 static const uint8_t* RAW_DATA = nullptr;
36 const size_t THRESHOLD = 10;
37 static size_t g_dataSize = 0;
38 static size_t g_pos;
39
GetPermission()40 void GetPermission()
41 {
42 uint64_t tokenId;
43 const char* perms[2];
44 perms[0] = "ohos.permission.DISTRIBUTED_DATASYNC";
45 perms[1] = "ohos.permission.CAMERA";
46 NativeTokenInfoParams infoInstance = {
47 .dcapsNum = 0,
48 .permsNum = 2,
49 .aclsNum = 0,
50 .dcaps = NULL,
51 .perms = perms,
52 .acls = NULL,
53 .processName = "native_camera_tdd",
54 .aplStr = "system_basic",
55 };
56 tokenId = GetAccessTokenId(&infoInstance);
57 SetSelfTokenID(tokenId);
58 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
59 }
60
61 template<class T>
GetData()62 T GetData()
63 {
64 T object {};
65 size_t objectSize = sizeof(object);
66 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
67 return object;
68 }
69 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
70 if (ret != EOK) {
71 return {};
72 }
73 g_pos += objectSize;
74 return object;
75 }
76
TestOutput(sptr<PreviewOutput> output,uint8_t * rawData,size_t size)77 void TestOutput(sptr<PreviewOutput> output, uint8_t *rawData, size_t size)
78 {
79 RAW_DATA = rawData;
80 g_dataSize = size;
81 g_pos = 0;
82 MEDIA_INFO_LOG("PreviewOutputFuzzer: ENTER");
83 sptr<IConsumerSurface> previewSurface = IConsumerSurface::Create();
84 CHECK_ERROR_RETURN_LOG(!previewSurface, "previewOutputFuzzer: Create previewSurface Error");
85 sptr<IBufferProducer> producer = previewSurface->GetProducer();
86 CHECK_ERROR_RETURN_LOG(!producer, "previewOutputFuzzer: GetProducer Error");
87 sptr<Surface> sf = Surface::CreateSurfaceAsProducer(producer);
88 output->AddDeferredSurface(sf);
89 output->Start();
90 output->IsSketchSupported();
91 output->GetSketchRatio();
92 bool isEnable = GetData<bool>();
93 output->EnableSketch(isEnable);
94 output->CreateStream();
95 output->GetFrameRateRange();
96 int32_t minFrameRate = GetData<int32_t>();
97 int32_t maxFrameRate = GetData<int32_t>();
98 output->SetFrameRateRange(minFrameRate, maxFrameRate);
99 output->SetOutputFormat(minFrameRate);
100 output->SetFrameRate(minFrameRate, maxFrameRate);
101 output->GetSupportedFrameRates();
102 output->StartSketch();
103 output->StopSketch();
104 output->GetDeviceMetadata();
105 output->FindSketchSize();
106 output->GetObserverControlTags();
107
108 output->canSetFrameRateRange(minFrameRate, maxFrameRate);
109 output->GetPreviewRotation(minFrameRate);
110 output->JudegRotationFunc(minFrameRate);
111 output->SetPreviewRotation(minFrameRate, isEnable);
112 output->Stop();
113 }
114
Test(uint8_t * rawData,size_t size)115 void Test(uint8_t *rawData, size_t size)
116 {
117 CHECK_ERROR_RETURN(rawData == nullptr || size < LIMITSIZE);
118 GetPermission();
119 auto manager = CameraManager::GetInstance();
120 CHECK_ERROR_RETURN_LOG(!manager, "previewOutputFuzzer: Get CameraManager instance Error");
121 auto cameras = manager->GetSupportedCameras();
122 CHECK_ERROR_RETURN_LOG(cameras.size() < NUM_TWO, "previewOutputFuzzer: GetSupportedCameras Error");
123 MessageParcel data;
124 data.WriteRawData(rawData, size);
125 auto camera = cameras[data.ReadUint32() % cameras.size()];
126 CHECK_ERROR_RETURN_LOG(!camera, "previewOutputFuzzer: camera is null");
127 int32_t mode = data.ReadInt32() % (SceneMode::NORMAL + NUM_TWO);
128 auto capability = manager->GetSupportedOutputCapability(camera, mode);
129 CHECK_ERROR_RETURN_LOG(!capability, "previewOutputFuzzer: GetSupportedOutputCapability Error");
130 auto profiles = capability->GetPreviewProfiles();
131 CHECK_ERROR_RETURN_LOG(profiles.empty(), "previewOutputFuzzer: GetPreviewProfiles empty");
132 Profile profile = profiles[data.ReadUint32() % profiles.size()];
133 sptr<IConsumerSurface> previewSurface = IConsumerSurface::Create();
134 CHECK_ERROR_RETURN_LOG(!previewSurface, "previewOutputFuzzer: create previewSurface Error");
135 sptr<IBufferProducer> producer = previewSurface->GetProducer();
136 CHECK_ERROR_RETURN_LOG(!producer, "previewOutputFuzzer: GetProducer Error");
137 sptr<Surface> pSurface = Surface::CreateSurfaceAsProducer(producer);
138 CHECK_ERROR_RETURN_LOG(!pSurface, "previewOutputFuzzer: GetProducer Error");
139 auto output = manager->CreatePreviewOutput(profile, pSurface);
140 CHECK_ERROR_RETURN_LOG(!output, "previewOutputFuzzer: CreatePhotoOutput Error");
141 TestOutput(output, rawData, size);
142 }
143
144 } // namespace StreamRepeatStubFuzzer
145 } // namespace CameraStandard
146 } // namespace OHOS
147
148 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)149 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
150 {
151 if (size < OHOS::CameraStandard::PreviewOutputFuzzer::THRESHOLD) {
152 return 0;
153 }
154 /* Run your code on data */
155 OHOS::CameraStandard::PreviewOutputFuzzer::Test(data, size);
156 return 0;
157 }