1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "avmetadatastub_local_fuzzer.h"
17 #include "stub_common.h"
18 #include "media_server.h"
19 #include "media_parcel.h"
20 #include "i_standard_avmetadatahelper_service.h"
21
22 namespace OHOS {
23 namespace Media {
FuzzAVMetadataStub(uint8_t * data,size_t size)24 bool FuzzAVMetadataStub(uint8_t *data, size_t size)
25 {
26 if (data == nullptr || size < sizeof(int64_t)) {
27 return true;
28 }
29 sptr<AVMetadataServiceProxyFuzzer> avmetaProxy = AVMetadataServiceProxyFuzzer::Create();
30 if (avmetaProxy == nullptr) {
31 return false;
32 }
33 for (uint32_t codeId = 0; codeId < AVMetadataServiceProxyFuzzer::MAX_IPC_ID; codeId++) {
34 if (codeId != AVMetadataServiceProxyFuzzer::DESTROY) {
35 avmetaProxy->SendRequest(codeId, data, size, true);
36 }
37 }
38 avmetaProxy->SendRequest(AVMetadataServiceProxyFuzzer::DESTROY, data, size, false);
39 return true;
40 }
41
42 const int32_t SYSTEM_ABILITY_ID = 3002;
43 const bool RUN_ON_CREATE = false;
FuzzAVMetadataStubLocal(uint8_t * data,size_t size)44 bool FuzzAVMetadataStubLocal(uint8_t *data, size_t size)
45 {
46 if (data == nullptr || size < sizeof(int64_t)) {
47 return true;
48 }
49 std::shared_ptr<MediaServer> mediaServer =
50 std::make_shared<MediaServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
51 sptr<IRemoteObject> listener = new(std::nothrow) MediaListenerStubFuzzer();
52 sptr<IRemoteObject> avmetadata = mediaServer->GetSubSystemAbility(
53 IStandardMediaService::MediaSystemAbility::MEDIA_AVMETADATAHELPER, listener);
54 if (avmetadata == nullptr) {
55 return false;
56 }
57
58 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadataStub =
59 iface_cast<IRemoteStub<IStandardAVMetadataHelperService>>(avmetadata);
60 if (avmetadataStub == nullptr) {
61 return false;
62 }
63
64 bool isWirteToken = size > 0 && data[0] % 9 != 0;
65 for (uint32_t code = 0; code <= AVMetadataServiceProxyFuzzer::MAX_IPC_ID; code++) {
66 MessageParcel msg;
67 if (isWirteToken) {
68 msg.WriteInterfaceToken(avmetadataStub->GetDescriptor());
69 }
70 msg.WriteBuffer(data, size);
71 msg.RewindRead(0);
72 MessageParcel reply;
73 MessageOption option;
74 avmetadataStub->OnRemoteRequest(code, msg, reply, option);
75 }
76
77 return true;
78 }
79 }
80 }
81
82 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)83 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
84 {
85 /* Run your code on data */
86 OHOS::Media::FuzzAVMetadataStub(data, size);
87 OHOS::Media::FuzzAVMetadataStubLocal(data, size);
88 return 0;
89 }