1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "avcodev_task_manager_fuzzer.h"
17 #include "message_parcel.h"
18 #include "securec.h"
19 #include "camera_log.h"
20
21 namespace OHOS {
22 namespace CameraStandard {
23 using namespace DeferredProcessing;
24 static constexpr int32_t MIN_SIZE_NUM = 35;
25 const int32_t CONST_2 = 2;
26 std::shared_ptr<AvcodecTaskManager> AvcodecTaskManagerFuzzer::fuzz_{nullptr};
27
28 /*
29 * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T)
30 * tips: only support basic type
31 */
32
AvcodecTaskManagerFuzzTest(FuzzedDataProvider & fdp)33 void AvcodecTaskManagerFuzzer::AvcodecTaskManagerFuzzTest(FuzzedDataProvider& fdp)
34 {
35 sptr<AudioCapturerSession> session = new AudioCapturerSession();
36 VideoCodecType mode = static_cast<VideoCodecType>(fdp.ConsumeIntegral<uint8_t>()
37 % (VideoCodecType::VIDEO_ENCODE_TYPE_HEVC + CONST_2));
38 ColorSpace color = static_cast<ColorSpace>(fdp.ConsumeIntegral<uint8_t>()
39 % (ColorSpace::DISPLAY_P3 + CONST_2));
40 fuzz_ = std::make_shared<AvcodecTaskManager>(session, mode, color);
41 CHECK_RETURN_ELOG(!fuzz_, "Create fuzz_ Error");
42 fuzz_->GetTaskManager();
43 fuzz_->GetEncoderManager();
44 int64_t timestamp = fdp.ConsumeIntegral<int64_t>();
45 GraphicTransformType formType = static_cast<GraphicTransformType>(fdp.ConsumeIntegral<uint8_t>()
46 % (GraphicTransformType::GRAPHIC_ROTATE_BUTT + CONST_2));
47 sptr<SurfaceBuffer> videoBuffer = SurfaceBuffer::Create();
48 sptr<FrameRecord> frameRecord =
49 new(std::nothrow) FrameRecord(videoBuffer, timestamp, formType);
50 function<void()> task = []() {};
51 fuzz_->SubmitTask(task);
52 std::shared_ptr<PhotoAssetIntf> photoAssetProxy = nullptr;
53 int32_t captureId = fdp.ConsumeIntegral<int32_t>();
54 int32_t captureRotation = fdp.ConsumeIntegral<int32_t>();
55 int64_t taskName = fdp.ConsumeIntegral<int64_t>();
56 fuzz_->SetVideoFd(timestamp, photoAssetProxy, captureId);
57 vector<sptr<FrameRecord>> frameRecords;
58 fuzz_->DoMuxerVideo(frameRecords, taskName, captureRotation, captureId);
59 vector<sptr<FrameRecord>> choosedBuffer;
60 int64_t shutterTime = fdp.ConsumeIntegral<int64_t>();
61 fuzz_->ChooseVideoBuffer(frameRecords, choosedBuffer, shutterTime, captureId);
62 vector<sptr<AudioRecord>> audioRecordVec;
63 sptr<AudioVideoMuxer> muxer;
64 fuzz_->CollectAudioBuffer(audioRecordVec, muxer);
65 fuzz_->videoEncoder_ = nullptr;
66 fuzz_->audioEncoder_ = make_unique<AudioEncoder>();
67 fuzz_->Stop();
68 }
69
Test(uint8_t * data,size_t size)70 void Test(uint8_t* data, size_t size)
71 {
72 auto avcodecTaskManager = std::make_unique<AvcodecTaskManagerFuzzer>();
73 if (avcodecTaskManager == nullptr) {
74 MEDIA_INFO_LOG("avcodecTaskManager is null");
75 return;
76 }
77 FuzzedDataProvider fdp(data, size);
78 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
79 return;
80 }
81 avcodecTaskManager->AvcodecTaskManagerFuzzTest(fdp);
82 }
83 } // namespace CameraStandard
84 } // namespace OHOS
85
86 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)87 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
88 {
89 OHOS::CameraStandard::Test(data, size);
90 return 0;
91 }