1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "camera_manager_fuzzer.h"
17 #include "camera_manager.h"
18 #include "camera_manager_for_sys.h"
19 #include "camera_log.h"
20 #include "input/camera_device.h"
21 #include "message_parcel.h"
22 #include <cstddef>
23 #include <cstdint>
24 #include <mutex>
25 #include "token_setproc.h"
26 #include "nativetoken_kit.h"
27 #include "accesstoken_kit.h"
28 #include "securec.h"
29 #include "system_ability_definition.h"
30
31 namespace OHOS {
32 namespace CameraStandard {
33 static constexpr int32_t MIN_SIZE_NUM = 24;
34 const size_t THRESHOLD = 10;
35 sptr<CameraManager> manager = nullptr;
36 const int32_t NUM_10 = 10;
37 const int32_t NUM_100 = 100;
38 std::shared_ptr<IDeferredPhotoProcSessionCallbackFuzz> photoSessionCallback_ =
39 std::make_shared<IDeferredPhotoProcSessionCallbackFuzz>();
40 std::shared_ptr<IDeferredVideoProcSessionCallbackFuzz> videoSessionCallback_ =
41 std::make_shared<IDeferredVideoProcSessionCallbackFuzz>();
42 std::shared_ptr<CameraManagerCallbackFuzz> managerCallback_ = std::make_shared<CameraManagerCallbackFuzz>();
43 std::shared_ptr<CameraMuteListenerFuzz> muteListenerCallback_ = std::make_shared<CameraMuteListenerFuzz>();
44 std::shared_ptr<FoldListenerFuzz> foldListenerCallback_ = std::make_shared<FoldListenerFuzz>();
45 std::shared_ptr<TorchListenerFuzz> torchListenerCallback_ = std::make_shared<TorchListenerFuzz>();
46
CameraManagerFuzzTest1(FuzzedDataProvider & fdp)47 void CameraManagerFuzzer::CameraManagerFuzzTest1(FuzzedDataProvider& fdp)
48 {
49 manager = CameraManager::GetInstance();
50 CHECK_RETURN_ELOG(!manager, "GetInstance Error");
51 auto session = manager->CreateCaptureSession();
52 manager->CreateCaptureSession(&session);
53 int userId = fdp.ConsumeIntegral<int>();
54 auto deferedPhotoSession = manager->CreateDeferredPhotoProcessingSession(userId, photoSessionCallback_);
55 manager->CreateDeferredPhotoProcessingSession(userId, photoSessionCallback_, &deferedPhotoSession);
56 auto deferedVideoSession = manager->CreateDeferredVideoProcessingSession(userId, videoSessionCallback_);
57 manager->CreateDeferredVideoProcessingSession(userId, videoSessionCallback_, &deferedVideoSession);
58 sptr<IBufferProducer> bufferProducer;
59 auto photoOutput = manager->CreatePhotoOutput(bufferProducer);
60 manager->CreatePhotoOutputWithoutProfile(bufferProducer, &photoOutput);
61 sptr<Surface> surface;
62 sptr<PreviewOutput> previewOutput;
63 manager->CreatePreviewOutputWithoutProfile(surface, &previewOutput);
64 sptr<IStreamRepeat> streamPtr;
65 Profile profile;
66 manager->CreatePreviewOutputStream(streamPtr, profile, bufferProducer);
67 sptr<IStreamCapture> capture;
68 manager->ValidCreateOutputStream(profile, bufferProducer);
69 manager->CreatePreviewOutput(bufferProducer, fdp.ConsumeIntegral<int32_t>());
70 int32_t width = fdp.ConsumeIntegral<int32_t>();
71 int32_t height = fdp.ConsumeIntegral<int32_t>();
72 manager->CreateCustomPreviewOutput(surface, width, height);
73 sptr<MetadataOutput> metadataOutput;
74 std::vector<MetadataObjectType> metadataObjectTypes;
75 manager->CreateMetadataOutput(metadataOutput, metadataObjectTypes);
76 DepthProfile depthProfile;
77 sptr<CameraManagerForSys> managerForSys = CameraManagerForSys::GetInstance();
78 sptr<DepthDataOutput> depthDataOutput = nullptr;
79 managerForSys->CreateDepthDataOutput(depthProfile, bufferProducer, &depthDataOutput);
80 manager->CreateVideoOutput(surface);
81 manager->CreateVideoOutputStream(streamPtr, profile, bufferProducer);
82 sptr<VideoOutput> videoOutput;
83 manager->CreateVideoOutputWithoutProfile(surface, &videoOutput);
84 manager->DestroyStubObj();
85 manager->CameraServerDied(0);
86 manager->SetCallback(managerCallback_);
87 manager->RegisterCameraMuteListener(muteListenerCallback_);
88 manager->RegisterTorchListener(torchListenerCallback_);
89 manager->RegisterFoldListener(foldListenerCallback_);
90 }
91
CameraManagerFuzzTest2(FuzzedDataProvider & fdp)92 void CameraManagerFuzzer::CameraManagerFuzzTest2(FuzzedDataProvider& fdp)
93 {
94 manager = CameraManager::GetInstance();
95 CHECK_RETURN_ELOG(!manager, "GetInstance Error");
96 std::string cameraId;
97 manager->GetCameraDeviceFromId(cameraId);
98 manager->GetCameras();
99 int32_t testPid = fdp.ConsumeIntegral<int32_t>();
100 int32_t status = fdp.ConsumeIntegral<int32_t>();
101 manager->GetCameraOutputStatus(testPid, status);
102 manager->foldScreenType_ = "test_type";
103 manager->GetSupportedCameras();
104 sptr<CameraInfo> info;
105 manager->CreateCameraInput(info);
106 manager->ReportEvent(cameraId);
107 CameraPosition position = CameraPosition::CAMERA_POSITION_BACK;
108 CameraType cameraType = CameraType::CAMERA_TYPE_DEFAULT;
109 auto input = manager->CreateCameraInput(position, cameraType);
110 manager->CreateCameraInput(position, cameraType, &input);
111 CameraManager::ProfilesWrapper profilesWrapper = {};
112 std::shared_ptr<OHOS::Camera::CameraMetadata> metadata =
113 std::make_shared<OHOS::Camera::CameraMetadata>(NUM_10, NUM_100);
114 camera_metadata_item_t item;
115 manager->ParseBasicCapability(profilesWrapper, metadata, item);
116 int32_t modeName = SceneMode::VIDEO;
117 manager->ParseExtendCapability(profilesWrapper, modeName, item);
118 modeName = SceneMode::NORMAL;
119 manager->ParseExtendCapability(profilesWrapper, modeName, item);
120 sptr<ICameraServiceCallback> cameraServiceCallback;
121 manager->SetCameraServiceCallback(cameraServiceCallback);
122 CameraFormat cameraFormat = CameraFormat::CAMERA_FORMAT_JPEG;
123 manager->GetCameraMetadataFormat(cameraFormat);
124 }
125
CameraManagerFuzzTest3(FuzzedDataProvider & fdp)126 void CameraManagerFuzzer::CameraManagerFuzzTest3(FuzzedDataProvider& fdp)
127 {
128 manager = CameraManager::GetInstance();
129 CHECK_RETURN_ELOG(!manager, "GetInstance Error");
130 ITorchServiceCallbackFuzz torchServiceCallback;
131 TorchStatus torchStatus = TorchStatus::TORCH_STATUS_ON;
132 torchServiceCallback.OnTorchStatusChange(torchStatus);
133 IFoldServiceCallbackFuzz foldServiceCallback;
134 FoldStatus foldStatus = FoldStatus::EXPAND;
135 foldServiceCallback.OnFoldStatusChanged(foldStatus);
136 sptr<ITorchServiceCallback> torchCallback = new ITorchServiceCallbackFuzz();
137 manager->SetTorchServiceCallback(torchCallback);
138 sptr<IFoldServiceCallback> serviceCallback = new IFoldServiceCallbackFuzz();
139 manager->SetFoldServiceCallback(serviceCallback);
140 ICameraMuteServiceCallbackFuzz cameraMuteServiceCallback;
141 cameraMuteServiceCallback.OnCameraMute(fdp.ConsumeBool());
142 manager->IsCameraMuteSupported();
143 manager->IsCameraMuted();
144 manager->PrelaunchCamera(0);
145 manager->ResetRssPriority();
146 manager->IsTorchSupported();
147 TorchMode mode = TorchMode::TORCH_MODE_ON;
148 manager->SetTorchMode(mode);
149 mode = TorchMode::TORCH_MODE_OFF;
150 manager->SetTorchMode(mode);
151 mode = TorchMode::TORCH_MODE_AUTO;
152 manager->SetTorchMode(mode);
153 manager->UpdateTorchMode(mode);
154 manager->GetTorchMode();
155 manager->SetCameraManagerNull();
156 }
157
Test(uint8_t * data,size_t size)158 void Test(uint8_t* data, size_t size)
159 {
160 auto cameraManager = std::make_unique<CameraManagerFuzzer>();
161 if (cameraManager == nullptr) {
162 MEDIA_INFO_LOG("cameraManager is null");
163 return;
164 }
165 FuzzedDataProvider fdp(data, size);
166 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
167 return;
168 }
169 cameraManager->CameraManagerFuzzTest1(fdp);
170 cameraManager->CameraManagerFuzzTest2(fdp);
171 cameraManager->CameraManagerFuzzTest3(fdp);
172 }
173 } // namespace CameraStandard
174 } // namespace OHOS
175
176 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)177 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
178 {
179 if (size < OHOS::CameraStandard::THRESHOLD) {
180 return 0;
181 }
182
183 OHOS::CameraStandard::Test(data, size);
184 return 0;
185 }