1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hstream_operator_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include "camera_log.h"
21 #include "message_parcel.h"
22 #include "token_setproc.h"
23 #include "nativetoken_kit.h"
24 #include "accesstoken_kit.h"
25 #include "system_ability_definition.h"
26 #include "iservice_registry.h"
27 #include "ipc_skeleton.h"
28 #include "buffer_extra_data_impl.h"
29 #include "camera_photo_proxy.h"
30
31 namespace OHOS {
32 namespace CameraStandard {
33 static constexpr int32_t MIN_SIZE_NUM = 64;
34 static constexpr int32_t NUM_1 = 1;
35
36 sptr<HStreamOperator> HStreamOperatorFuzzer::fuzz_{nullptr};
37
HStreamOperatorFuzzTest(FuzzedDataProvider & fdp)38 void HStreamOperatorFuzzer::HStreamOperatorFuzzTest(FuzzedDataProvider& fdp)
39 {
40 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
41 return;
42 }
43 fuzz_ = HStreamOperator::NewInstance(0, 0);
44 CHECK_RETURN_ELOG(!fuzz_, "NewInstance Error");
45 int32_t streamId = fdp.ConsumeIntegral<int32_t>();
46 fuzz_->GetStreamByStreamID(streamId);
47 int32_t rotation = fdp.ConsumeIntegral<int32_t>();
48 int32_t format = fdp.ConsumeIntegral<int32_t>();
49 int32_t captureId = fdp.ConsumeIntegral<int32_t>();
50 int64_t timestamp = fdp.ConsumeIntegral<int64_t>();
51 fuzz_->StartMovingPhotoEncode(rotation, timestamp, format, captureId);
52 fuzz_->StartRecord(timestamp, rotation, captureId);
53 fuzz_->GetHdiStreamByStreamID(streamId);
54 fuzz_->EnableMovingPhotoMirror(fdp.ConsumeBool(), fdp.ConsumeBool());
55 ColorSpace getColorSpace;
56 fuzz_->GetActiveColorSpace(getColorSpace);
57 constexpr int32_t executionModeCount = static_cast<int32_t>(ColorSpace::P3_PQ_LIMIT) + NUM_1;
58 ColorSpace colorSpace = static_cast<ColorSpace>(fdp.ConsumeIntegral<uint8_t>() % executionModeCount);
59 fuzz_->SetColorSpace(colorSpace, fdp.ConsumeBool());
60 fuzz_->GetStreamOperator();
61 std::vector<int32_t> results = {fdp.ConsumeIntegral<uint32_t>()};
62 fuzz_->ReleaseStreams();
63 std::vector<HDI::Camera::V1_1::StreamInfo_V1_1> streamInfos;
64 fuzz_->CreateStreams(streamInfos);
65 std::shared_ptr<OHOS::Camera::CameraMetadata> settings;
66 const int32_t NUM_10 = 10;
67 const int32_t NUM_100 = 100;
68 settings = std::make_shared<OHOS::Camera::CameraMetadata>(NUM_10, NUM_100);
69 int32_t operationMode = fdp.ConsumeIntegral<int32_t>();
70 fuzz_->CommitStreams(settings, operationMode);
71 fuzz_->UpdateStreams(streamInfos);
72 fuzz_->CreateAndCommitStreams(streamInfos, settings, operationMode);
73 const std::vector<int32_t> streamIds;
74 fuzz_->OnCaptureStarted(captureId, streamIds);
75 const std::vector<OHOS::HDI::Camera::V1_2::CaptureStartedInfo> infos;
76 fuzz_->OnCaptureStarted_V1_2(captureId, infos);
77 const std::vector<CaptureEndedInfo> infos_OnCaptureEnded;
78 fuzz_->OnCaptureEnded(captureId, infos_OnCaptureEnded);
79 const std::vector<OHOS::HDI::Camera::V1_3::CaptureEndedInfoExt> infos_OnCaptureEndedExt;
80 fuzz_->OnCaptureEndedExt(captureId, infos_OnCaptureEndedExt);
81 const std::vector<CaptureErrorInfo> infos_OnCaptureError;
82 fuzz_->OnCaptureError(captureId, infos_OnCaptureError);
83 fuzz_->OnFrameShutter(captureId, results, timestamp);
84 fuzz_->OnFrameShutterEnd(captureId, results, timestamp);
85 fuzz_->OnCaptureReady(captureId, results, timestamp);
86 }
87
Test(uint8_t * data,size_t size)88 void Test(uint8_t* data, size_t size)
89 {
90 FuzzedDataProvider fdp(data, size);
91 auto HStreamOperator = std::make_unique<HStreamOperatorFuzzer>();
92 if (HStreamOperator == nullptr) {
93 MEDIA_INFO_LOG("HStreamOperator is null");
94 return;
95 }
96 HStreamOperator->HStreamOperatorFuzzTest(fdp);
97 }
98
99 } // namespace CameraStandard
100 } // namespace OHOS
101
102 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)103 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
104 {
105 OHOS::CameraStandard::Test(data, size);
106 return 0;
107 }