/* * Copyright (c) 2024 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include #include #include #include #include #include "securec.h" #include #include #include "demuxer_sample.h" #define FUZZ_PROJECT_NAME "demuxer_fuzzer" using namespace std; using namespace OHOS::Media; namespace OHOS { const char *MOV_PATH = "/data/test/fuzz_create.mov"; const int64_t EXPECT_SIZE = 36; const size_t URI_SIZE = 25; const size_t URI_BUFFER_SIZE = 21; const int64_t URI_COUNT = 20; const char FLAG = '\0'; const size_t LANGUAGE_SIZE = 31; const size_t LANGUAGE_BUFFER_SIZE = 3; const size_t LANGUAGE_COUNT = 2; bool CheckDataValidity(const uint8_t *data, size_t size) { if (size <= EXPECT_SIZE) { return false; } int32_t fd = open(MOV_PATH, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR); if (fd < 0) { return false; } int len = write(fd, data, size); if (len <= 0) { close(fd); return false; } close(fd); return true; } bool DemuxerFuzzTest(const uint8_t *data, size_t size) { if (!CheckDataValidity(data, size)) { return false; } FuzzedDataProvider fdp(data, size); struct Params params; params.time = fdp.ConsumeIntegral(); char *uri = new char[URI_BUFFER_SIZE]; if (memcpy_s(uri, URI_BUFFER_SIZE, data + size - URI_SIZE, URI_COUNT) != 0) { delete[] uri; return false; } uri[URI_COUNT] = FLAG; params.setTrackType = fdp.ConsumeIntegral(); params.setDuration = fdp.ConsumeIntegral(); params.setHeight = fdp.ConsumeIntegral(); params.setFrameRate = fdp.ConsumeIntegral(); char *setLanguage = new char[LANGUAGE_BUFFER_SIZE]; if (memcpy_s(setLanguage, LANGUAGE_BUFFER_SIZE, data + size - LANGUAGE_SIZE, LANGUAGE_COUNT) != 0) { delete[] uri; delete[] setLanguage; return false; } setLanguage[LANGUAGE_COUNT] = FLAG; params.setCodecConfigSize = fdp.ConsumeIntegral(); params.sampleRate = fdp.ConsumeIntegral(); params.channelCount = fdp.ConsumeIntegral(); params.setVideoHeight = fdp.ConsumeIntegral(); params.setVideoWidth = fdp.ConsumeIntegral(); uint32_t createSize = fdp.ConsumeIntegral(); shared_ptr demuxerSample = make_shared(); demuxerSample->filePath = MOV_PATH; demuxerSample->RunNormalDemuxer(createSize, uri, setLanguage, params); delete[] uri; delete[] setLanguage; int ret = remove(MOV_PATH); if (ret != 0) { return false; } return true; } } // namespace OHOS /* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* Run your code on data */ OHOS::DemuxerFuzzTest(data, size); return 0; }