1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "ability/camera_ability_const.h"
17 #include "capture_session_proxy_fuzzer.h"
18 #include "capture_session_proxy.h"
19 #include "camera_log.h"
20 #include "iconsumer_surface.h"
21 #include "securec.h"
22 #include "system_ability_definition.h"
23 #include "icapture_session.h"
24 #include "capture_session.h"
25 #include "securec.h"
26 #include "iservice_registry.h"
27 #include "token_setproc.h"
28 #include <cstddef>
29 #include <cstdint>
30 #include <memory>
31 #include <mutex>
32 namespace OHOS {
33 namespace CameraStandard {
34 const size_t THRESHOLD = 10;
35 const int32_t MAX_BUFFER_SIZE = 16;
36 static constexpr int32_t NUM_1 = 1;
37 std::shared_ptr<CaptureSessionProxy> CaptureSessionProxyFuzz::fuzz_{nullptr};
38
CaptureSessionProxyFuzzTest1(FuzzedDataProvider & fdp)39 void CaptureSessionProxyFuzz::CaptureSessionProxyFuzzTest1(FuzzedDataProvider &fdp)
40 {
41 auto mgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
42 CHECK_RETURN_ELOG(!mgr, "samgr nullptr");
43 auto object = mgr->GetSystemAbility(CAMERA_SERVICE_ID);
44 CHECK_RETURN_ELOG(!object, "object nullptr");
45 fuzz_ = std::make_shared<CaptureSessionProxy>(object);
46 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
47 uint8_t vectorSize = fdp.ConsumeIntegralInRange<uint8_t>(0, MAX_BUFFER_SIZE);
48 std::vector<float> virtualApertureMetadata;
49 for (int i = 0; i < vectorSize; ++i) {
50 virtualApertureMetadata.push_back(fdp.ConsumeFloatingPoint<float>());
51 }
52 fuzz_->GetVirtualApertureMetadate(virtualApertureMetadata);
53 float value;
54 fuzz_->GetVirtualApertureValue(value);
55 float values = fdp.ConsumeFloatingPoint<float>();
56 bool needPersist = fdp.ConsumeIntegral<int32_t>() ? 1 : 0;
57 fuzz_->SetVirtualApertureValue(values, needPersist);
58 }
59
CaptureSessionProxyFuzzTest2(FuzzedDataProvider & fdp)60 void CaptureSessionProxyFuzz::CaptureSessionProxyFuzzTest2(FuzzedDataProvider &fdp)
61 {
62 auto mgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
63 CHECK_RETURN_ELOG(!mgr, "samgr nullptr");
64 auto object = mgr->GetSystemAbility(CAMERA_SERVICE_ID);
65 CHECK_RETURN_ELOG(!object, "object nullptr");
66 fuzz_ = std::make_shared<CaptureSessionProxy>(object);
67 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
68 fuzz_->Stop();
69 constexpr int32_t executionModeCount = static_cast<int32_t>(ColorSpace::P3_PQ_LIMIT) + NUM_1;
70 ColorSpace colorSpace = static_cast<ColorSpace>(fdp.ConsumeIntegral<uint8_t>() % executionModeCount);
71 int32_t curColorSpace = static_cast<int32_t>(colorSpace);
72 fuzz_->GetActiveColorSpace(curColorSpace);
73 int32_t colorSpaceSetting = static_cast<int32_t>(colorSpace);
74 bool ret = fdp.ConsumeIntegral<int32_t>() ? 1 : 0;
75 fuzz_->SetColorSpace(colorSpaceSetting, ret);
76 }
77
CaptureSessionProxyFuzzTest3(FuzzedDataProvider & fdp)78 void CaptureSessionProxyFuzz::CaptureSessionProxyFuzzTest3(FuzzedDataProvider &fdp)
79 {
80 auto mgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
81 CHECK_RETURN_ELOG(!mgr, "samgr nullptr");
82 auto object = mgr->GetSystemAbility(CAMERA_SERVICE_ID);
83 CHECK_RETURN_ELOG(!object, "object nullptr");
84 fuzz_ = std::make_shared<CaptureSessionProxy>(object);
85 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
86
87 int32_t smoothZoomType = fdp.ConsumeIntegral<int32_t>();
88 int32_t operationMode = fdp.ConsumeIntegral<int32_t>();
89 float targetZoomRatio = fdp.ConsumeFloatingPoint<float>();
90 float duration = fdp.ConsumeFloatingPoint<float>();
91 fuzz_->SetSmoothZoom(smoothZoomType, operationMode, targetZoomRatio, duration);
92 bool isHasFitedRotation = fdp.ConsumeIntegral<int32_t>() ? 1 : 0;
93 fuzz_->SetHasFitedRotation(isHasFitedRotation);
94 }
95
CaptureSessionProxyFuzzTest4(FuzzedDataProvider & fdp)96 void CaptureSessionProxyFuzz::CaptureSessionProxyFuzzTest4(FuzzedDataProvider &fdp)
97 {
98 auto mgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
99 CHECK_RETURN_ELOG(!mgr, "samgr nullptr");
100 auto object = mgr->GetSystemAbility(CAMERA_SERVICE_ID);
101 CHECK_RETURN_ELOG(!object, "object nullptr");
102 fuzz_ = std::make_shared<CaptureSessionProxy>(object);
103 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
104 bool ret = fdp.ConsumeIntegral<int32_t>() ? 1 : 0;
105 fuzz_->EnableMovingPhoto(ret);
106 bool isMirror = fdp.ConsumeIntegral<int32_t>() ? 1 : 0;
107 bool isConfig = fdp.ConsumeIntegral<int32_t>() ? 1 : 0;
108 fuzz_->EnableMovingPhotoMirror(isMirror, isConfig);
109 }
110
CaptureSessionProxyFuzzTest5(FuzzedDataProvider & fdp)111 void CaptureSessionProxyFuzz::CaptureSessionProxyFuzzTest5(FuzzedDataProvider &fdp)
112 {
113 auto mgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
114 CHECK_RETURN_ELOG(!mgr, "samgr nullptr");
115 auto object = mgr->GetSystemAbility(CAMERA_SERVICE_ID);
116 CHECK_RETURN_ELOG(!object, "object nullptr");
117 fuzz_ = std::make_shared<CaptureSessionProxy>(object);
118 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
119 std::vector<std::string> testStrings = {"test1", "test2"};
120 int8_t randomNum = fdp.ConsumeIntegral<uint8_t>();
121 std::string deviceClass(testStrings[randomNum % testStrings.size()]);
122 fuzz_->SetPreviewRotation(deviceClass);
123 }
124
CaptureSessionProxyFuzzTest6()125 void CaptureSessionProxyFuzz::CaptureSessionProxyFuzzTest6()
126 {
127 auto mgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
128 CHECK_RETURN_ELOG(!mgr, "samgr nullptr");
129 auto object = mgr->GetSystemAbility(CAMERA_SERVICE_ID);
130 CHECK_RETURN_ELOG(!object, "object nullptr");
131 fuzz_ = std::make_shared<CaptureSessionProxy>(object);
132 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
133 sptr<ICaptureSessionCallback> captureSessionCallback = new (std::nothrow)CaptureSessionCallback();
134 fuzz_->SetCallback(captureSessionCallback);
135 sptr<IPressureStatusCallback> pressureStatusCallback = new (std::nothrow)PressureStatusCallback();
136 fuzz_->SetPressureCallback(pressureStatusCallback);
137 fuzz_->UnSetCallback();
138 fuzz_->UnSetPressureCallback();
139 sptr<IControlCenterEffectStatusCallback> callbackFunc = new (std::nothrow)ControlCenterEffectStatusCallback();
140 fuzz_->SetControlCenterEffectStatusCallback(callbackFunc);
141 fuzz_->UnSetControlCenterEffectStatusCallback();
142 }
143
CaptureSessionProxyFuzzTest7(FuzzedDataProvider & fdp)144 void CaptureSessionProxyFuzz::CaptureSessionProxyFuzzTest7(FuzzedDataProvider &fdp)
145 {
146 auto mgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
147 CHECK_RETURN_ELOG(!mgr, "samgr nullptr");
148 auto object = mgr->GetSystemAbility(CAMERA_SERVICE_ID);
149 CHECK_RETURN_ELOG(!object, "object nullptr");
150 fuzz_ = std::make_shared<CaptureSessionProxy>(object);
151 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
152 std::vector<int32_t> beautyApertureMetadata;
153 uint8_t vectorSize = fdp.ConsumeIntegralInRange<uint8_t>(0, MAX_BUFFER_SIZE);
154 for (int i = 0; i < vectorSize; ++i) {
155 beautyApertureMetadata.push_back(fdp.ConsumeIntegral<int32_t>());
156 }
157 fuzz_->GetBeautyMetadata(beautyApertureMetadata);
158 int32_t type = fdp.ConsumeIntegral<int32_t>();
159 std::vector<int32_t> range;
160 for (int i = 0; i < vectorSize; ++i) {
161 range.push_back(fdp.ConsumeIntegral<int32_t>());
162 }
163 fuzz_->GetBeautyRange(range, type);
164 int32_t beautyValue = fdp.ConsumeIntegral<int32_t>();
165 fuzz_->GetBeautyValue(type, beautyValue);
166 }
167
FuzzTest(const uint8_t * rawData,size_t size)168 void FuzzTest(const uint8_t *rawData, size_t size)
169 {
170 FuzzedDataProvider fdp(rawData, size);
171 auto captureSessionProxy = std::make_unique<CaptureSessionProxyFuzz>();
172 if (captureSessionProxy == nullptr) {
173 MEDIA_INFO_LOG("captureSessionProxy is null");
174 return;
175 }
176 captureSessionProxy->CaptureSessionProxyFuzzTest1(fdp);
177 captureSessionProxy->CaptureSessionProxyFuzzTest2(fdp);
178 captureSessionProxy->CaptureSessionProxyFuzzTest3(fdp);
179 captureSessionProxy->CaptureSessionProxyFuzzTest4(fdp);
180 captureSessionProxy->CaptureSessionProxyFuzzTest5(fdp);
181 captureSessionProxy->CaptureSessionProxyFuzzTest6();
182 captureSessionProxy->CaptureSessionProxyFuzzTest7(fdp);
183 }
184 } // namespace CameraStandard
185 } // namespace OHOS
186
187 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)188 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
189 {
190 if (size < OHOS::CameraStandard::THRESHOLD) {
191 return 0;
192 }
193
194 OHOS::CameraStandard::FuzzTest(data, size);
195 return 0;
196 }