1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "camera_device_service_proxy_fuzzer.h"
17 #include "camera_log.h"
18 #include "iconsumer_surface.h"
19 #include "securec.h"
20 #include "system_ability_definition.h"
21 #include "securec.h"
22 #include "iservice_registry.h"
23 #include "token_setproc.h"
24 #include <cstddef>
25 #include <cstdint>
26 #include <memory>
27 #include <mutex>
28
29 namespace OHOS {
30 namespace CameraStandard {
31 const size_t THRESHOLD = 10;
32 const int32_t MAX_BUFFER_SIZE = 16;
33 const int32_t NUM_10 = 10;
34 const int32_t NUM_100 = 100;
35 std::shared_ptr<CameraDeviceServiceProxy> CameraDeviceServiceProxyFuzz::fuzz_{nullptr};
36
CameraDeviceServiceProxyTest(FuzzedDataProvider & fdp)37 void CameraDeviceServiceProxyFuzz::CameraDeviceServiceProxyTest(FuzzedDataProvider &fdp)
38 {
39 auto mgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
40 if (mgr == nullptr) {
41 return;
42 }
43 auto object = mgr->GetSystemAbility(CAMERA_SERVICE_ID);
44 if (object == nullptr) {
45 return;
46 }
47 fuzz_ = std::make_shared<CameraDeviceServiceProxy>(object);
48 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
49 fuzz_->Close();
50 uint8_t vectorSize = fdp.ConsumeIntegralInRange<uint8_t>(0, MAX_BUFFER_SIZE);
51 std::vector<int32_t> results;
52 for (int i = 0; i < vectorSize; ++i) {
53 results.push_back(fdp.ConsumeIntegral<int32_t>());
54 }
55 fuzz_->GetEnabledResults(results);
56 fuzz_->EnableResult(results);
57 fuzz_->DisableResult(results);
58
59 std::shared_ptr<OHOS::Camera::CameraMetadata> metaIn = nullptr;
60 const int32_t defaultItems = 10;
61 const int32_t defaultDataLength = 100;
62 int32_t count = 1;
63 int32_t isOcclusionDetected = 1;
64 metaIn = std::make_shared<OHOS::Camera::CameraMetadata>(defaultItems, defaultDataLength);
65 metaIn->addEntry(OHOS_STATUS_CAMERA_OCCLUSION_DETECTION, &isOcclusionDetected, count);
66 std::shared_ptr<OHOS::Camera::CameraMetadata> metaOut =
67 std::make_shared<OHOS::Camera::CameraMetadata>(NUM_10, NUM_100);
68 fuzz_->GetStatus(metaIn, metaOut);
69
70 auto value = fdp.ConsumeIntegral<uint8_t>();
71 fuzz_->SetUsedAsPosition(value);
72 fuzz_->closeDelayed();
73 int32_t concurrentTypeofcamera = fdp.ConsumeIntegral<int32_t>();
74 fuzz_->Open(concurrentTypeofcamera);
75 fuzz_->SetDeviceRetryTime();
76 uint64_t secureSeqId = fdp.ConsumeIntegral<uint64_t>();
77 fuzz_->OpenSecureCamera(secureSeqId);
78 }
79
FuzzTest(const uint8_t * rawData,size_t size)80 void FuzzTest(const uint8_t *rawData, size_t size)
81 {
82 FuzzedDataProvider fdp(rawData, size);
83 auto cameraDeviceServiceProxy = std::make_unique<CameraDeviceServiceProxyFuzz>();
84 if (cameraDeviceServiceProxy == nullptr) {
85 MEDIA_INFO_LOG("cameraDeviceServiceProxy is null");
86 return;
87 }
88 cameraDeviceServiceProxy->CameraDeviceServiceProxyTest(fdp);
89 }
90 } // namespace CameraStandard
91 } // namespace OHOS
92
93 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)94 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
95 {
96 if (size < OHOS::CameraStandard::THRESHOLD) {
97 return 0;
98 }
99
100 OHOS::CameraStandard::FuzzTest(data, size);
101 return 0;
102 }