1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hcapture_session_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <memory>
21 #include "camera_log.h"
22 #include "message_parcel.h"
23 #include "token_setproc.h"
24 #include "nativetoken_kit.h"
25 #include "accesstoken_kit.h"
26 #include "system_ability_definition.h"
27 #include "iservice_registry.h"
28 #include "ipc_skeleton.h"
29 #include "buffer_extra_data_impl.h"
30 #include "moving_photo_proxy.h"
31 #include "camera_photo_proxy.h"
32
33 namespace OHOS {
34 namespace CameraStandard {
35 static constexpr int32_t WIDE_CAMERA_ZOOM_RANGE = 0;
36 static constexpr int32_t MAIN_CAMERA_ZOOM_RANGE = 1;
37 static constexpr int32_t TWO_X_EXIT_TELE_ZOOM_RANGE = 2;
38 static constexpr int32_t TELE_CAMERA_ZOOM_RANGE = 3;
39 static constexpr int32_t MIN_SIZE_NUM = 256;
40 static constexpr int32_t NUM_1 = 1;
41 const int NUM_10 = 10;
42 const int NUM_100 = 100;
43
HCaptureSessionFuzzTest1(FuzzedDataProvider & fdp)44 void HCaptureSessionFuzzer::HCaptureSessionFuzzTest1(FuzzedDataProvider& fdp)
45 {
46 uint32_t callerToken = IPCSkeleton::GetCallingTokenID();
47 int32_t opMode = fdp.ConsumeIntegral<int32_t>();
48 sptr<HCaptureSession> session;
49 sptr<HStreamOperator> hStreamOperator;
50 session = new HCaptureSession(callerToken, opMode);
51 HCaptureSession::NewInstance(callerToken, opMode, session);
52 hStreamOperator = HStreamOperator::NewInstance(callerToken, opMode);
53 session->SetStreamOperator(hStreamOperator);
54 CHECK_RETURN_ELOG(!session, "Create session Error");
55 session->BeginConfig();
56 session->CommitConfig();
57 int32_t featureMode = fdp.ConsumeIntegral<int32_t>();
58 session->SetFeatureMode(featureMode);
59 int outFd =fdp.ConsumeIntegral<int32_t>();
60 CameraInfoDumper infoDumper(outFd);
61 session->DumpSessionInfo(infoDumper);
62 session->DumpSessions(infoDumper);
63 session->DumpCameraSessionSummary(infoDumper);
64 session->OperatePermissionCheck(fdp.ConsumeIntegral<uint32_t>());
65 session->EnableMovingPhotoMirror(fdp.ConsumeBool(), fdp.ConsumeBool());
66 int32_t getColorSpace;
67 session->GetActiveColorSpace(getColorSpace);
68 constexpr int32_t executionModeCount = static_cast<int32_t>(ColorSpace::P3_PQ_LIMIT) + NUM_1;
69 ColorSpace colorSpace = static_cast<ColorSpace>(fdp.ConsumeIntegral<uint8_t>() % executionModeCount);
70 session->SetColorSpace(static_cast<int32_t>(colorSpace), fdp.ConsumeBool());
71 session->GetopMode();
72 std::vector<StreamInfo_V1_1> streamInfos;
73 session->GetCurrentStreamInfos(streamInfos);
74 session->DynamicConfigStream();
75 session->AddInput(nullptr);
76 std::string deviceClass;
77 session->SetPreviewRotation(deviceClass);
78 }
79
HCaptureSessionFuzzTest2(FuzzedDataProvider & fdp)80 void HCaptureSessionFuzzer::HCaptureSessionFuzzTest2(FuzzedDataProvider& fdp)
81 {
82 uint32_t callerToken = IPCSkeleton::GetCallingTokenID();
83 int32_t opMode = fdp.ConsumeIntegral<int32_t>();
84 sptr<HCaptureSession> session;
85 HCaptureSession::NewInstance(callerToken, opMode, session);
86 CHECK_RETURN_ELOG(!session, "Create session Error");
87 session->GetPid();
88 StreamType streamType = StreamType::CAPTURE;
89 session->AddOutput(streamType, nullptr);
90 session->RemoveOutput(streamType, nullptr);
91 session->RemoveInput(nullptr);
92 std::vector<StreamInfo_V1_1> streamInfos;
93 session->RemoveOutputStream(nullptr);
94 session->ValidateSession();
95 CaptureSessionState sessionState = CaptureSessionState::SESSION_STARTED;
96 session->GetSessionState(sessionState);
97 float currentFps = fdp.ConsumeFloatingPoint<float>();
98 float currentZoomRatio = fdp.ConsumeFloatingPoint<float>();
99 std::vector<float> crossZoomAndTime;
100 int32_t operationMode = fdp.ConsumeIntegral<int32_t>();
101 session->QueryFpsAndZoomRatio(currentFps, currentZoomRatio, crossZoomAndTime, operationMode);
102 session->GetSensorOritation();
103 float zoomRatio = fdp.ConsumeFloatingPoint<float>();
104 std::vector<float> crossZoom;
105 session->GetRangeId(zoomRatio, crossZoom);
106 float zoomPointA = fdp.ConsumeFloatingPoint<float>();
107 float zoomPointB = fdp.ConsumeFloatingPoint<float>();
108 session->isEqual(zoomPointA, zoomPointB);
109 std::vector<std::vector<float>> crossTime_1;
110 session->GetCrossZoomAndTime(crossZoomAndTime, crossZoom, crossTime_1);
111 }
112
HCaptureSessionFuzzTest3(FuzzedDataProvider & fdp)113 void HCaptureSessionFuzzer::HCaptureSessionFuzzTest3(FuzzedDataProvider& fdp)
114 {
115 uint32_t callerToken = IPCSkeleton::GetCallingTokenID();
116 int32_t opMode = fdp.ConsumeIntegral<int32_t>();
117 sptr<HCaptureSession> session;
118 HCaptureSession::NewInstance(callerToken, opMode, session);
119 CHECK_RETURN_ELOG(!session, "Create session Error");
120 int32_t targetRangeId = TELE_CAMERA_ZOOM_RANGE;
121 int32_t currentRangeId = WIDE_CAMERA_ZOOM_RANGE;
122 int32_t waitCount = 4;
123 int32_t zoomInOutCount = 2;
124 std::vector<std::vector<float>> crossTime_2(waitCount, std::vector<float>(zoomInOutCount, 0.0f));
125 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
126 targetRangeId = WIDE_CAMERA_ZOOM_RANGE;
127 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
128 currentRangeId = MAIN_CAMERA_ZOOM_RANGE;
129 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
130 targetRangeId = TELE_CAMERA_ZOOM_RANGE;
131 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
132 currentRangeId = TWO_X_EXIT_TELE_ZOOM_RANGE;
133 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
134 targetRangeId = WIDE_CAMERA_ZOOM_RANGE;
135 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
136 targetRangeId = MAIN_CAMERA_ZOOM_RANGE;
137 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
138 currentRangeId = TELE_CAMERA_ZOOM_RANGE;
139 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
140 targetRangeId = WIDE_CAMERA_ZOOM_RANGE;
141 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
142 targetRangeId = TWO_X_EXIT_TELE_ZOOM_RANGE;
143 session->GetCrossWaitTime(crossTime_2, targetRangeId, currentRangeId);
144 int32_t smoothZoomType = fdp.ConsumeIntegral<int32_t>();
145 float targetZoomRatio = fdp.ConsumeFloatingPoint<float>();
146 float duration = fdp.ConsumeFloatingPoint<float>();
147 int32_t operationMode = fdp.ConsumeIntegral<int32_t>();
148 session->SetSmoothZoom(smoothZoomType, operationMode, targetZoomRatio, duration);
149 session->Start();
150 std::shared_ptr<OHOS::Camera::CameraMetadata> captureSettings;
151 captureSettings = std::make_shared<OHOS::Camera::CameraMetadata>(NUM_10, NUM_100);
152 session->UpdateMuteSetting(true, captureSettings);
153 session->Stop();
154 }
155
HCaptureSessionFuzzTest4(FuzzedDataProvider & fdp)156 void HCaptureSessionFuzzer::HCaptureSessionFuzzTest4(FuzzedDataProvider& fdp)
157 {
158 uint32_t callerToken = IPCSkeleton::GetCallingTokenID();
159 int32_t opMode = fdp.ConsumeIntegral<int32_t>();
160 sptr<HCaptureSession> session;
161 HCaptureSession::NewInstance(callerToken, opMode, session);
162 CHECK_RETURN_ELOG(!session, "Create session Error");
163 pid_t pid = 0;
164 session->DestroyStubObjectForPid(pid);
165 sptr<ICaptureSessionCallback> callback;
166 session->SetCallback(callback);
167 session->GetSessionState();
168 int32_t status = fdp.ConsumeIntegral<int32_t>();
169 session->GetOutputStatus(status);
170 int32_t imageSeqId = fdp.ConsumeIntegral<int32_t>();
171 int32_t seqId = fdp.ConsumeIntegral<int32_t>();
172 session->CreateBurstDisplayName(MAIN_CAMERA_ZOOM_RANGE, seqId);
173 session->CreateBurstDisplayName(imageSeqId, seqId);
174 }
175
Test(uint8_t * data,size_t size)176 void Test(uint8_t* data, size_t size)
177 {
178 FuzzedDataProvider fdp(data, size);
179 auto hcaptureSession = std::make_unique<HCaptureSessionFuzzer>();
180 if (hcaptureSession == nullptr) {
181 MEDIA_INFO_LOG("hcaptureSession is null");
182 return;
183 }
184 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
185 return;
186 }
187 hcaptureSession->HCaptureSessionFuzzTest1(fdp);
188 hcaptureSession->HCaptureSessionFuzzTest2(fdp);
189 hcaptureSession->HCaptureSessionFuzzTest3(fdp);
190 hcaptureSession->HCaptureSessionFuzzTest4(fdp);
191 }
192
193 } // namespace CameraStandard
194 } // namespace OHOS
195
196 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)197 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
198 {
199 OHOS::CameraStandard::Test(data, size);
200 return 0;
201 }