1 /*
2 * Copyright (c) 2022-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "bufferqueue_fuzzer.h"
17
18 #include <securec.h>
19
20 #include "buffer_queue.h"
21 #include "data_generate.h"
22 #include "surface.h"
23 #include "surface_buffer.h"
24 #include "surface_buffer_impl.h"
25 #include "buffer_extra_data.h"
26 #include "buffer_extra_data_impl.h"
27 #include "sync_fence.h"
28
29 using namespace g_fuzzCommon;
30 namespace OHOS {
GetBufferExtraDataFromData()31 sptr<BufferExtraData> GetBufferExtraDataFromData()
32 {
33 // get data
34 std::string keyInt32 = GetStringFromData(STR_LEN);
35 int32_t valueInt32 = GetData<int32_t>();
36 std::string keyInt64 = GetStringFromData(STR_LEN);
37 int64_t valueInt64 = GetData<int64_t>();
38 std::string keyDouble = GetStringFromData(STR_LEN);
39 double valueDouble = GetData<double>();
40 std::string keyStr = GetStringFromData(STR_LEN);
41 std::string valueStr = GetStringFromData(STR_LEN);
42
43 // test
44 sptr<BufferExtraData> bedata = new BufferExtraDataImpl();
45 bedata->ExtraSet(keyInt32, valueInt32);
46 bedata->ExtraSet(keyInt64, valueInt64);
47 bedata->ExtraSet(keyDouble, valueDouble);
48 bedata->ExtraSet(keyStr, valueStr);
49
50 bedata->ExtraGet(keyInt32, valueInt32);
51 bedata->ExtraGet(keyInt64, valueInt64);
52 bedata->ExtraGet(keyDouble, valueDouble);
53 bedata->ExtraGet(keyStr, valueStr);
54 return bedata;
55 }
56
BufferQueueFuzzTest3()57 void BufferQueueFuzzTest3()
58 {
59 std::string name = GetStringFromData(STR_LEN);
60 sptr<BufferQueue> bufferqueue = new BufferQueue(name);
61 BufferRequestConfig requestConfig = GetData<BufferRequestConfig>();
62 BufferRequestConfig Config = GetData<BufferRequestConfig>();
63 sptr<OHOS::SurfaceBuffer> buffer = SurfaceBuffer::Create();
64 sptr<BufferExtraData> bedata = GetBufferExtraDataFromData();
65 IBufferProducer::RequestBufferReturnValue retval;
66 retval.buffer = buffer;
67 std::mutex mutex;
68 std::unique_lock<std::mutex> lock(mutex);
69 bufferqueue->SetupNewBufferLocked(buffer, bedata, requestConfig, Config, retval, lock);
70 }
71
BufferQueueFuzzTest2()72 void BufferQueueFuzzTest2()
73 {
74 std::string name = GetStringFromData(STR_LEN);
75 uint32_t queueSize = GetData<uint32_t>();
76 int32_t width = GetData<int32_t>();
77 int32_t height = GetData<int32_t>();
78 uint64_t usage = GetData<uint64_t>();
79 uint32_t sequence = GetData<uint32_t>();
80 std::vector<GraphicHDRMetaData> metaData;
81 for (int i = 0; i < 10; i++) { // add 10 elements to the vector
82 GraphicHDRMetaData hDRMetaData = GetData<GraphicHDRMetaData>();
83 metaData.push_back(hDRMetaData);
84 }
85 GraphicHDRMetadataKey key = GetData<GraphicHDRMetadataKey>();
86 std::vector<uint8_t> metaDataSet;
87 for (int i = 0; i < 10; i++) { // add 10 elements to the vector
88 uint8_t metaDataElement = GetData<uint8_t>();
89 metaDataSet.push_back(metaDataElement);
90 }
91 bool flag = GetData<bool>();
92 std::string result = GetStringFromData(STR_LEN);
93 bool status = GetData<bool>();
94 GraphicPresentTimestamp timestamp = GetData<GraphicPresentTimestamp>();
95 OHSurfaceSource sourceType = GetData<OHSurfaceSource>();
96 std::string appFrameworkType = GetStringFromData(STR_LEN);
97 // test
98 sptr<BufferQueue> bufferqueue = new BufferQueue(name);
99 bufferqueue->SetQueueSize(queueSize);
100 bufferqueue->SetDefaultWidthAndHeight(width, height);
101 bufferqueue->SetDefaultUsage(usage);
102 GraphicTransformType transform = GetData<GraphicTransformType >();
103 bufferqueue->SetTransform(transform);
104 bufferqueue->SetMetaData(sequence, metaData);
105 bufferqueue->SetMetaDataSet(sequence, key, metaDataSet);
106 bufferqueue->SetProducerCacheCleanFlag(flag);
107 bufferqueue->Dump(result);
108 bufferqueue->SetStatus(status);
109 bufferqueue->SetPresentTimestamp(sequence, timestamp);
110 bufferqueue->SetSurfaceSourceType(sourceType);
111 bufferqueue->SetSurfaceAppFrameworkType(appFrameworkType);
112 int64_t time = 0;
113 GraphicPresentTimestampType timestampType = GetData<GraphicPresentTimestampType>();
114 bufferqueue->GetPresentTimestamp(sequence, timestampType, time);
115 }
116
BufferQueueFuzzTest1()117 void BufferQueueFuzzTest1()
118 {
119 int32_t timeOut = 0;
120 std::string name = GetStringFromData(STR_LEN);
121 sptr<BufferQueue> bufferqueue = new BufferQueue(name);
122 uint32_t seqNum = GetData<uint32_t>();
123 BufferRequestConfig requestConfig = GetData<BufferRequestConfig>();
124 OHOS::Rect rect = GetData<OHOS::Rect>();
125 int64_t timestamp = GetData<int64_t>();
126 BufferFlushConfigWithDamages flushConfig = {.damages = { rect }, .timestamp = timestamp};
127 uint32_t sequence = GetData<uint32_t>();
128 std::vector<Rect> damages;
129 sptr<OHOS::SurfaceBuffer> buffer = new SurfaceBufferImpl(seqNum);
130 sptr<OHOS::SurfaceBuffer> buffer1 = SurfaceBuffer::Create();
131 sptr<BufferExtraData> bedata = GetBufferExtraDataFromData();
132 IBufferProducer::RequestBufferReturnValue retval;
133 retval.buffer = buffer;
134 bufferqueue->RegisterConsumerListener(nullptr);
135 OnReleaseFunc func;
136 bufferqueue->RegisterReleaseListener(func);
137 OnDeleteBufferFunc deleteBufferFunc;
138 bool isForUniRedraw = GetData<bool>();
139 bufferqueue->RegisterDeleteBufferListener(deleteBufferFunc, isForUniRedraw);
140 bufferqueue->RequestBuffer(requestConfig, bedata, retval);
141 {
142 std::mutex mutex;
143 std::unique_lock<std::mutex> lock(mutex);
144 bufferqueue->ReuseBuffer(requestConfig, bedata, retval, lock);
145 }
146 bufferqueue->CancelBuffer(sequence, bedata);
147 sptr<SyncFence> syncFence = SyncFence::INVALID_FENCE;
148 bufferqueue->FlushBuffer(sequence, bedata, syncFence, flushConfig);
149 bufferqueue->DoFlushBuffer(sequence, bedata, syncFence, flushConfig);
150 bufferqueue->AcquireBuffer(buffer, syncFence, timestamp, damages);
151 bufferqueue->ReleaseBuffer(buffer, syncFence);
152 bufferqueue->ListenerBufferReleasedCb(buffer, syncFence);
153 bufferqueue->AttachBuffer(buffer1, timeOut);
154 bufferqueue->DetachBuffer(buffer1);
155 float matrix[16] = {0};
156 uint32_t matrixSize = GetData<uint32_t>();
157 bool isUseNewMatrix = GetData<bool>();
158 bool needRecordSequence = GetData<bool>();
159 bufferqueue->GetLastFlushedBuffer(buffer, syncFence, matrix, matrixSize, isUseNewMatrix, needRecordSequence);
160 bufferqueue->UnregisterConsumerListener();
161 bufferqueue->UnRegisterProducerReleaseListener();
162 GraphicTransformType transformType = GetData<GraphicTransformType>();
163 bufferqueue->SetTransform(transformType);
164 bufferqueue->GetTransform();
165 bufferqueue->SetTransformHint(transformType, GetData<uint64_t>());
166 bufferqueue->GetSurfaceSourceType();
167 float brightness = GetData<float>();
168 bufferqueue->SetHdrWhitePointBrightness(brightness);
169 IConsumerSurface::AcquireBufferReturnValue returnValue;
170 int64_t expectPresentTimestamp = GetData<int64_t>();
171 bool isUsingAutoTimestamp = GetData<bool>();
172 bufferqueue->AcquireBuffer(returnValue, expectPresentTimestamp, isUsingAutoTimestamp);
173 bufferqueue->WaitForCondition();
174 bufferqueue->RequestBufferDebugInfoLocked();
175 bufferqueue->CheckProducerCacheListLocked();
176 {
177 std::mutex mutex;
178 std::unique_lock<std::mutex> lock(mutex);
179 bufferqueue->ReallocBufferLocked(requestConfig, retval, lock);
180 }
181 bufferqueue->DelegatorQueueBuffer(sequence, syncFence);
182 bufferqueue->CallConsumerListener();
183 uint64_t uiTimestamp = GetData<uint64_t>();
184 bufferqueue->SetDesiredPresentTimestampAndUiTimestamp(sequence, expectPresentTimestamp, uiTimestamp);
185 int64_t desiredPresentTimestamp = GetData<int64_t>();
186 bufferqueue->IsPresentTimestampReady(desiredPresentTimestamp, expectPresentTimestamp);
187 bufferqueue->OnBufferDeleteCbForHardwareThreadLocked(buffer);
188 {
189 std::mutex mutex;
190 std::unique_lock<std::mutex> lock(mutex);
191 bufferqueue->DeleteBufferInCache(sequence, lock);
192 }
193 sptr<OHOS::SurfaceBuffer> buffer2 = new SurfaceBufferImpl();
194 bufferqueue->SetSurfaceBufferGlobalAlphaUnlocked(buffer2);
195 int32_t alpha;
196 bufferqueue->GetGlobalAlpha(alpha);
197 std::string result;
198 bufferqueue->DumpCache(result);
199 bufferqueue->GetAvailableBufferCount();
200 }
201
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)202 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
203 {
204 if (data == nullptr) {
205 return false;
206 }
207
208 // initialize
209 g_data = data;
210 g_size = size;
211 g_pos = 0;
212 std::string name = GetStringFromData(STR_LEN);
213 sptr<BufferQueue> bufferqueue = new BufferQueue(name);
214 bool cleanAll = GetData<bool>();
215 bufferqueue->CleanCache(cleanAll, nullptr);
216 bufferqueue->GetHdrWhitePointBrightness();
217 bufferqueue->GetUniqueId();
218 bufferqueue->GoBackground();
219 ScalingMode mode = GetData<ScalingMode>();
220 bufferqueue->SetScalingMode(mode);
221 bool bufferHold = GetData<bool>();
222 bufferqueue->SetBufferHold(bufferHold);
223 bool noBlock = GetData<bool>();
224 bufferqueue->SetRequestBufferNoblockMode(noBlock);
225 bufferqueue->GetRequestBufferNoblockMode(noBlock);
226 uint32_t reserveInts = GetData<uint32_t>() % 0x100000; // no more than 0x100000
227 GraphicExtDataHandle *handle = AllocExtDataHandle(reserveInts);
228 sptr<SurfaceTunnelHandle> tunnelHandle = new SurfaceTunnelHandle();
229 tunnelHandle->SetHandle(handle);
230 bufferqueue->SetTunnelHandle(tunnelHandle);
231 FreeExtDataHandle(handle);
232 BufferQueueFuzzTest1();
233 BufferQueueFuzzTest2();
234 BufferQueueFuzzTest3();
235
236 return true;
237 }
238 }
239
240 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)241 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
242 {
243 /* Run your code on data */
244 OHOS::DoSomethingInterestingWithMyAPI(data, size);
245 return 0;
246 }
247
248