1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hcamera_device_manager_fuzzer.h"
17
18 #include "camera_log.h"
19 #include "message_parcel.h"
20 #include <cstddef>
21 #include <cstdint>
22 #include <memory>
23 #include "token_setproc.h"
24 #include "nativetoken_kit.h"
25 #include "accesstoken_kit.h"
26 #include "securec.h"
27 #include "ipc_skeleton.h"
28
29 namespace OHOS {
30 namespace CameraStandard {
31 using namespace OHOS::HDI::Camera::V1_0;
32 static constexpr int32_t MIN_SIZE_NUM = 64;
33 sptr<HCameraDevice> g_HCameraDevice = nullptr;
34 std::string g_cameraID;
35
InitCameraDevice()36 void InitCameraDevice()
37 {
38 if (g_HCameraDevice != nullptr) {
39 return;
40 }
41 sptr<HCameraHostManager> cameraHostManager = new HCameraHostManager(nullptr);
42 std::vector<std::string> cameraIds;
43 cameraHostManager->GetCameras(cameraIds);
44 CHECK_RETURN_ELOG(cameraIds.empty(), "Fuzz:PrepareHCameraDevice: GetCameras returns empty");
45 g_cameraID = cameraIds[0];
46 auto callingTokenId = IPCSkeleton::GetCallingTokenID();
47 std::string permissionName = OHOS_PERMISSION_CAMERA;
48 int32_t ret = CheckPermission(permissionName, callingTokenId);
49 CHECK_RETURN_ELOG(ret != CAMERA_OK, "Fuzz:PrepareHCameraDevice: CheckPermission Failed");
50 g_HCameraDevice = new HCameraDevice(cameraHostManager, g_cameraID, callingTokenId);
51 }
52
HCameraDeviceManagerFuzzTest1(FuzzedDataProvider & fdp)53 void HCameraDeviceManagerFuzzer::HCameraDeviceManagerFuzzTest1(FuzzedDataProvider& fdp)
54 {
55 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
56 return;
57 }
58 auto hCameraDeviceManager = HCameraDeviceManager::GetInstance();
59 if (hCameraDeviceManager == nullptr) {
60 MEDIA_INFO_LOG("hCameraDeviceManager is null");
61 return;
62 };
63 InitCameraDevice();
64 pid_t pid = fdp.ConsumeIntegral<int32_t>();
65 hCameraDeviceManager->GetCameraHolderByPid(pid);
66 hCameraDeviceManager->GetCamerasByPid(pid);
67 hCameraDeviceManager->GetActiveClient();
68 hCameraDeviceManager->GetActiveCameraHolders();
69 int32_t state = fdp.ConsumeIntegral<int32_t>();
70 hCameraDeviceManager->SetStateOfACamera(g_cameraID, state);
71 hCameraDeviceManager->GetCameraStateOfASide();
72 sptr<ICameraBroker> callback = nullptr;
73 hCameraDeviceManager->SetPeerCallback(callback);
74 hCameraDeviceManager->UnsetPeerCallback();
75 std::vector<sptr<HCameraDevice>> cameraNeedEvict = {};
76 int32_t type = 0;
77 hCameraDeviceManager->GetConflictDevices(cameraNeedEvict, g_HCameraDevice, type);
78 hCameraDeviceManager->RemoveDevice(g_cameraID);
79 int32_t processState = fdp.ConsumeIntegral<int32_t>();
80 hCameraDeviceManager->GenerateEachProcessCameraState(processState, fdp.ConsumeIntegral<uint32_t>());
81 hCameraDeviceManager->IsMultiCameraActive(pid);
82 }
83
Test(uint8_t * data,size_t size)84 void Test(uint8_t* data, size_t size)
85 {
86 FuzzedDataProvider fdp(data, size);
87 auto hCameraDeviceManagerFuzzer = std::make_unique<HCameraDeviceManagerFuzzer>();
88 if (hCameraDeviceManagerFuzzer == nullptr) {
89 MEDIA_INFO_LOG("hCameraDeviceManagerFuzzer is null");
90 return;
91 }
92 hCameraDeviceManagerFuzzer->HCameraDeviceManagerFuzzTest1(fdp);
93 }
94
95 } // namespace CameraStandard
96 } // namespace OHOS
97
98 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)99 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
100 {
101 OHOS::CameraStandard::Test(data, size);
102 return 0;
103 }