1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hcamera_device_fuzzer.h"
17 #include "camera_log.h"
18 #include "message_parcel.h"
19 #include <cstddef>
20 #include <cstdint>
21 #include <memory>
22 #include "token_setproc.h"
23 #include "nativetoken_kit.h"
24 #include "accesstoken_kit.h"
25 #include "securec.h"
26 #include "metadata_utils.h"
27
28 namespace OHOS {
29 namespace CameraStandard {
30 using namespace OHOS::HDI::Camera::V1_0;
31 static constexpr int32_t MIN_SIZE_NUM = 256;
32 static constexpr int32_t NUM_1 = 1;
33 const int NUM_10 = 10;
34 const int NUM_100 = 100;
35 const size_t MAX_LENGTH_STRING = 64;
36
37 sptr<HCameraDevice> HCameraDeviceFuzzer::fuzz_{nullptr};
38
39
HCameraDeviceFuzzTest1(FuzzedDataProvider & fdp)40 void HCameraDeviceFuzzer::HCameraDeviceFuzzTest1(FuzzedDataProvider& fdp)
41 {
42 fuzz_->GetDeviceMuteMode();
43 std::shared_ptr<OHOS::Camera::CameraMetadata> settings;
44 settings = std::make_shared<OHOS::Camera::CameraMetadata>(NUM_10, NUM_100);
45 fuzz_->CreateMuteSetting(settings);
46 fuzz_->DispatchDefaultSettingToHdi();
47 fuzz_->CloneCachedSettings();
48 uint64_t secureSeqId;
49 fuzz_->callerToken_ = 1;
50 fuzz_->GetSecureCameraSeq(&secureSeqId);
51 std::vector<int32_t> results = {fdp.ConsumeIntegral<uint32_t>()};
52 fuzz_->GetEnabledResults(results);
53 fuzz_->CheckZoomChange(settings);
54 fuzz_->ResetZoomTimer();
55 fuzz_->UnPrepareZoom();
56 fuzz_->UpdateSetting(settings);
57 uint8_t value = fdp.ConsumeIntegral<uint8_t>();
58 fuzz_->SetUsedAsPosition(value);
59 fuzz_->GetUsedAsPosition();
60 fuzz_->UpdateSettingOnce(settings);
61 uint32_t tag = fdp.ConsumeIntegral<uint32_t>();
62 fuzz_->DebugLogForSmoothZoom(settings, tag);
63 fuzz_->DebugLogForAfRegions(settings, tag);
64 fuzz_->DebugLogForAeRegions(settings, tag);
65 fuzz_->RegisterFoldStatusListener();
66 fuzz_->UnregisterFoldStatusListener();
67 fuzz_->EnableResult(results);
68 fuzz_->DisableResult(results);
69 fuzz_->UpdateDeviceOpenLifeCycleSettings(settings);
70 fuzz_->OpenDevice(true);
71 fuzz_->CheckOnResultData(settings);
72 fuzz_->ResetDeviceOpenLifeCycleSettings();
73 }
74
HCameraDeviceFuzzTest2(FuzzedDataProvider & fdp)75 void HCameraDeviceFuzzer::HCameraDeviceFuzzTest2(FuzzedDataProvider& fdp)
76 {
77 fuzz_->Close();
78 fuzz_->CheckPermissionBeforeOpenDevice();
79 fuzz_->HandlePrivacyBeforeOpenDevice();
80 fuzz_->Release();
81 fuzz_->OpenDevice(true);
82 std::shared_ptr<OHOS::Camera::CameraMetadata> settings;
83 settings = std::make_shared<OHOS::Camera::CameraMetadata>(NUM_10, NUM_100);
84 fuzz_->ReportMetadataDebugLog(settings);
85 int32_t operationMode = fdp.ConsumeIntegral<int32_t>();
86 std::set<std::string> conflicting = {fdp.ConsumeRandomLengthString(MAX_LENGTH_STRING),
87 fdp.ConsumeRandomLengthString(MAX_LENGTH_STRING)};
88 fuzz_->GetCameraResourceCost(operationMode, conflicting);
89 }
90
HCameraDeviceFuzzTest3(FuzzedDataProvider & fdp)91 void HCameraDeviceFuzzer::HCameraDeviceFuzzTest3(FuzzedDataProvider& fdp)
92 {
93 fuzz_->GetCameraId();
94 fuzz_->GetCameraType();
95 fuzz_->IsOpenedCameraDevice();
96 bool isMoving = fdp.ConsumeIntegral<int32_t>() % 2;
97 fuzz_->EnableMovingPhoto(isMoving);
98 fuzz_->SetDeviceMuteMode(isMoving);
99 fuzz_->ResetDeviceSettings();
100 fuzz_->DispatchDefaultSettingToHdi();
101 fuzz_->ResetCachedSettings();
102 fuzz_->GetDeviceAbility();
103 fuzz_->Open();
104 uint64_t secureSeqId = fdp.ConsumeIntegral<int64_t>();
105 fuzz_->OpenSecureCamera(secureSeqId);
106 fuzz_->GetSecureCameraSeq(&secureSeqId);
107 fuzz_->OpenDevice(isMoving);
108 fuzz_->HandleFoldableDevice();
109 fuzz_->CheckPermissionBeforeOpenDevice();
110 fuzz_->HandlePrivacyBeforeOpenDevice();
111 fuzz_->HandlePrivacyWhenOpenDeviceFail();
112 fuzz_->HandlePrivacyAfterCloseDevice();
113 fuzz_->OpenDevice(true);
114 fuzz_->CloseDevice();
115 int32_t mode = fdp.ConsumeIntegral<int32_t>();
116 fuzz_->CheckMovingPhotoSupported(mode);
117 fuzz_->ResetZoomTimer();
118 int32_t DEFAULT_ITEMS = 3;
119 int32_t DEFAULT_DATA_LENGTH = 200;
120 std::shared_ptr<OHOS::Camera::CameraMetadata> metaIn =
121 std::make_shared<OHOS::Camera::CameraMetadata>(DEFAULT_ITEMS, DEFAULT_DATA_LENGTH);
122 std::shared_ptr<OHOS::Camera::CameraMetadata> metaOut =
123 std::make_shared<OHOS::Camera::CameraMetadata>(DEFAULT_ITEMS, DEFAULT_DATA_LENGTH);
124 fuzz_->GetStatus(metaIn, metaOut);
125 int32_t errorMsg = fdp.ConsumeIntegral<int32_t>();
126 constexpr int32_t executionModeCount = static_cast<int32_t>(CAMERA_UNKNOWN_ERROR) + NUM_1;
127 OHOS::HDI::Camera::V1_0::ErrorType selectedErrorType =
128 static_cast<OHOS::HDI::Camera::V1_0::ErrorType>(fdp.ConsumeIntegral<uint8_t>() % executionModeCount);
129 fuzz_->OnError(selectedErrorType, errorMsg);
130 std::vector<uint8_t> result = {0, 1};
131 uint64_t timestamp = fdp.ConsumeIntegral<uint64_t>();
132 int32_t streamId = fdp.ConsumeIntegral<int32_t>();
133 fuzz_->OnResult(timestamp, result);
134 fuzz_->OnResult(streamId, result);
135 }
136
HCameraDeviceFuzzTest4(FuzzedDataProvider & fdp)137 void HCameraDeviceFuzzer::HCameraDeviceFuzzTest4(FuzzedDataProvider& fdp)
138 {
139 std::shared_ptr<OHOS::Camera::CameraMetadata> cameraResult;
140 cameraResult = std::make_shared<OHOS::Camera::CameraMetadata>(NUM_10, NUM_100);
141 std::function<void(int64_t, int64_t)> callback = [](int64_t start, int64_t end) {
142 MEDIA_INFO_LOG("Start: %lld, End: %lld\n", start, end);
143 };
144 fuzz_->SetMovingPhotoStartTimeCallback(callback);
145 fuzz_->SetMovingPhotoEndTimeCallback(callback);
146 fuzz_->GetMovingPhotoStartAndEndTime(cameraResult);
147 fuzz_->GetCallerToken();
148 fuzz_->RemoveResourceWhenHostDied();
149 int32_t state = fdp.ConsumeIntegral<int32_t>();
150 fuzz_->NotifyCameraStatus(state);
151 }
152
Test(uint8_t * data,size_t size)153 void Test(uint8_t* data, size_t size)
154 {
155 FuzzedDataProvider fdp(data, size);
156 auto dcameraDevice = std::make_unique<HCameraDeviceFuzzer>();
157 if (dcameraDevice == nullptr) {
158 MEDIA_INFO_LOG("dcameraDevice is null");
159 return;
160 }
161 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
162 return;
163 }
164 sptr<HCameraHostManager> cameraHostManager = new HCameraHostManager(nullptr);
165 std::string cameraId;
166 uint32_t callingTokenId = fdp.ConsumeIntegral<uint32_t>();
167 HCameraDeviceFuzzer::fuzz_ = new (std::nothrow)
168 HCameraDevice(cameraHostManager, cameraId, callingTokenId);
169 CHECK_RETURN_ELOG(!HCameraDeviceFuzzer::fuzz_, "CreateFuzz Error");
170 dcameraDevice->HCameraDeviceFuzzTest1(fdp);
171 dcameraDevice->HCameraDeviceFuzzTest2(fdp);
172 dcameraDevice->HCameraDeviceFuzzTest3(fdp);
173 dcameraDevice->HCameraDeviceFuzzTest4(fdp);
174 }
175
176 } // namespace CameraStandard
177 } // namespace OHOS
178
179 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)180 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
181 {
182 OHOS::CameraStandard::Test(data, size);
183 return 0;
184 }