1 /*
2 * Copyright (c) 2022-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "dcamerahost_fuzzer.h"
17 #include "dcamera_test_utils.h"
18
19 #include <cstddef>
20 #include <cstdint>
21 #include <fuzzer/FuzzedDataProvider.h>
22
23 #include "dcamera_host.h"
24
25 namespace OHOS {
26 namespace DistributedHardware {
DCameraGetCameraAbilityFromDevFuzzTest(const uint8_t * data,size_t size)27 void DCameraGetCameraAbilityFromDevFuzzTest(const uint8_t* data, size_t size)
28 {
29 if ((data == nullptr) || (size == 0)) {
30 return;
31 }
32 std::string cameraId = "1__2";
33 DHBase dhBase;
34 dhBase.deviceId_ = "1";
35 dhBase.dhId_ = "2";
36 std::string sinkAbilityInfo(reinterpret_cast<const char*>(data), size);
37 std::string sourceAbilityInfo(reinterpret_cast<const char*>(data), size);
38 OHOS::sptr<DCameraDevice> dcameraDevice(new (std::nothrow) DCameraDevice(dhBase, sinkAbilityInfo,
39 sourceAbilityInfo));
40 if (dcameraDevice == nullptr) {
41 return;
42 }
43 DCameraHost::GetInstance()->dCameraDeviceMap_.emplace(cameraId, dcameraDevice);
44 std::shared_ptr<CameraAbility> cameraAbility = make_shared<CameraAbility>(1, 1);
45 DCameraHost::GetInstance()->GetCameraAbilityFromDev(cameraId, cameraAbility);
46 }
47
DCameraAddDeviceParamCheckFuzzTest(const uint8_t * data,size_t size)48 void DCameraAddDeviceParamCheckFuzzTest(const uint8_t* data, size_t size)
49 {
50 if ((data == nullptr) || (size == 0)) {
51 return;
52 }
53 std::string deviceId = "1";
54 std::string dhId = "2";
55 std::string sinkAbilityInfo(reinterpret_cast<const char*>(data), size);
56 std::string srcAbilityInfo(reinterpret_cast<const char*>(data), size);
57 DHBase dhBase;
58 dhBase.deviceId_ = deviceId;
59 dhBase.dhId_ = dhId;
60 sptr<IDCameraProviderCallback> callback;
61 DCameraHost::GetInstance()->AddDeviceParamCheck(dhBase, sinkAbilityInfo, srcAbilityInfo, callback);
62 }
63
DCameraGetCamDevNumFuzzTest(const uint8_t * data,size_t size)64 void DCameraGetCamDevNumFuzzTest(const uint8_t* data, size_t size)
65 {
66 if ((data == nullptr) || (size == 0)) {
67 return;
68 }
69 std::string foo(reinterpret_cast<const char*>(data), size);
70 foo = "source";
71 DCameraHost::GetInstance()->GetCamDevNum();
72 }
73
DCameraIsCameraIdInvalidFuzzTest(const uint8_t * data,size_t size)74 void DCameraIsCameraIdInvalidFuzzTest(const uint8_t* data, size_t size)
75 {
76 if ((data == nullptr) || (size == 0)) {
77 return;
78 }
79 std::string cameraId = "1__2";
80 DHBase dhBase;
81 dhBase.deviceId_ = "1";
82 dhBase.dhId_ = "2";
83 std::string sinkAbilityInfo(reinterpret_cast<const char*>(data), size);
84 std::string sourceAbilityInfo(reinterpret_cast<const char*>(data), size);
85 OHOS::sptr<DCameraDevice> dcameraDevice(new (std::nothrow) DCameraDevice(dhBase, sinkAbilityInfo,
86 sourceAbilityInfo));
87 if (dcameraDevice == nullptr) {
88 return;
89 }
90 DCameraHost::GetInstance()->dCameraDeviceMap_.emplace(cameraId, dcameraDevice);
91 DCameraHost::GetInstance()->IsCameraIdInvalid(cameraId);
92 }
93
DCameraGetCameraIdByDHBaseFuzzTest(const uint8_t * data,size_t size)94 void DCameraGetCameraIdByDHBaseFuzzTest(const uint8_t* data, size_t size)
95 {
96 if ((data == nullptr) || (size == 0)) {
97 return;
98 }
99 std::string deviceId(reinterpret_cast<const char*>(data), size);
100 std::string dhId(reinterpret_cast<const char*>(data), size);
101 DHBase dhBase;
102 dhBase.deviceId_ = deviceId;
103 dhBase.dhId_ = dhId;
104 DCameraHost::GetInstance()->GetCameraIdByDHBase(dhBase);
105 }
106
DCameraGetResourceCostFuzzTest(const uint8_t * data,size_t size)107 void DCameraGetResourceCostFuzzTest(const uint8_t* data, size_t size)
108 {
109 if ((data == nullptr) || (size == 0)) {
110 return;
111 }
112
113 FuzzedDataProvider fdp(data, size);
114 std::string cameraId = fdp.ConsumeRandomLengthString(size);
115 OHOS::HDI::Camera::V1_3::CameraDeviceResourceCost resourceCost;
116
117 DCameraHost::GetInstance()->GetResourceCost(cameraId, resourceCost);
118 }
119
DCameraNotifyDeviceStateChangeInfoFuzzTest(const uint8_t * data,size_t size)120 void DCameraNotifyDeviceStateChangeInfoFuzzTest(const uint8_t* data, size_t size)
121 {
122 int32_t doubleNum = 2;
123 if ((data == nullptr) || (size < sizeof(int32_t) * doubleNum)) {
124 return;
125 }
126 FuzzedDataProvider fdp(data, size);
127 int32_t notifyType = fdp.ConsumeIntegral<int32_t>();
128 int32_t deviceState = fdp.ConsumeIntegral<int32_t>();
129 DCameraHost::GetInstance()->NotifyDeviceStateChangeInfo(notifyType, deviceState);
130 }
131
DCameraPreCameraSwitchFuzzTest(const uint8_t * data,size_t size)132 void DCameraPreCameraSwitchFuzzTest(const uint8_t* data, size_t size)
133 {
134 if ((data == nullptr) || (size == 0)) {
135 return;
136 }
137
138 FuzzedDataProvider fdp(data, size);
139 std::string cameraId = fdp.ConsumeRandomLengthString(size);
140 DCameraHost::GetInstance()->PreCameraSwitch(cameraId);
141 }
142
DCameraPrelaunchWithOpModeFuzzTest(const uint8_t * data,size_t size)143 void DCameraPrelaunchWithOpModeFuzzTest(const uint8_t* data, size_t size)
144 {
145 if ((data == nullptr) || (size < sizeof(int32_t))) {
146 return;
147 }
148
149 FuzzedDataProvider fdp(data, size);
150 int32_t operationMode = fdp.ConsumeIntegral<int32_t>();
151 PrelaunchConfig config;
152 DCameraHost::GetInstance()->PrelaunchWithOpMode(config, operationMode);
153 }
154
DCameraAddClearRegisterRecipientFuzzTest(const uint8_t * data,size_t size)155 void DCameraAddClearRegisterRecipientFuzzTest(const uint8_t* data, size_t size)
156 {
157 if ((data == nullptr) || (size == 0)) {
158 return;
159 }
160
161 sptr<IRemoteObject> remote = sptr<MockIRemoteObject>(new MockIRemoteObject());
162 std::string deviceId(reinterpret_cast<const char*>(data), size);
163 std::string dhId(reinterpret_cast<const char*>(data), size);
164 DHBase dhBase;
165 dhBase.deviceId_ = deviceId;
166 dhBase.dhId_ = dhId;
167 DCameraHost::GetInstance()->AddClearRegisterRecipient(remote, dhBase);
168 }
169
DCameraRemoveClearRegisterRecipientFuzzTest(const uint8_t * data,size_t size)170 void DCameraRemoveClearRegisterRecipientFuzzTest(const uint8_t* data, size_t size)
171 {
172 if ((data == nullptr) || (size == 0)) {
173 return;
174 }
175
176 sptr<IRemoteObject> remote = sptr<MockIRemoteObject>(new MockIRemoteObject());
177 std::string deviceId(reinterpret_cast<const char*>(data), size);
178 std::string dhId(reinterpret_cast<const char*>(data), size);
179 DHBase dhBase;
180 dhBase.deviceId_ = deviceId;
181 dhBase.dhId_ = dhId;
182 DCameraHost::GetInstance()->RemoveClearRegisterRecipient(remote, dhBase);
183 }
184 }
185 }
186
187 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)188 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
189 {
190 /* Run your code on data */
191 OHOS::DistributedHardware::DCameraGetCameraAbilityFromDevFuzzTest(data, size);
192 OHOS::DistributedHardware::DCameraAddDeviceParamCheckFuzzTest(data, size);
193 OHOS::DistributedHardware::DCameraGetCamDevNumFuzzTest(data, size);
194 OHOS::DistributedHardware::DCameraIsCameraIdInvalidFuzzTest(data, size);
195 OHOS::DistributedHardware::DCameraGetCameraIdByDHBaseFuzzTest(data, size);
196 OHOS::DistributedHardware::DCameraGetResourceCostFuzzTest(data, size);
197 OHOS::DistributedHardware::DCameraNotifyDeviceStateChangeInfoFuzzTest(data, size);
198 OHOS::DistributedHardware::DCameraPreCameraSwitchFuzzTest(data, size);
199 OHOS::DistributedHardware::DCameraPrelaunchWithOpModeFuzzTest(data, size);
200 OHOS::DistributedHardware::DCameraAddClearRegisterRecipientFuzzTest(data, size);
201 OHOS::DistributedHardware::DCameraRemoveClearRegisterRecipientFuzzTest(data, size);
202 return 0;
203 }
204