1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hstream_repeat_callback_stub_fuzzer.h"
17 #include "camera_log.h"
18 #include "hstream_repeat.h"
19 #include "iservice_registry.h"
20 #include "message_parcel.h"
21 #include "nativetoken_kit.h"
22 #include "string_ex.h"
23 #include "token_setproc.h"
24 #include "accesstoken_kit.h"
25 #include "camera_metadata_info.h"
26 #include "metadata_utils.h"
27 #include "iconsumer_surface.h"
28 #include "securec.h"
29
30 namespace OHOS {
31 namespace CameraStandard {
32 const size_t THRESHOLD = 10;
33 static constexpr int32_t NUM_1 = 1;
34 static const std::u16string g_interfaceToken = u"OHOS.CameraStandard.IStreamRepeatCallback";
35 std::shared_ptr<HStreamRepeatCallbackStubFuzz> HStreamRepeatCallbackStubFuzzer::fuzz_{nullptr};
36
HStreamRepeatCallbackStubFuzzTest1()37 void HStreamRepeatCallbackStubFuzzer::HStreamRepeatCallbackStubFuzzTest1()
38 {
39 MessageParcel data;
40 MessageParcel reply;
41 MessageOption option;
42 data.WriteInterfaceToken(g_interfaceToken);
43 fuzz_->OnRemoteRequest(
44 static_cast<uint32_t>(IStreamRepeatCallbackIpcCode::COMMAND_ON_FRAME_STARTED), data, reply, option);
45 }
46
HStreamRepeatCallbackStubFuzzTest2(FuzzedDataProvider & fdp)47 void HStreamRepeatCallbackStubFuzzer::HStreamRepeatCallbackStubFuzzTest2(FuzzedDataProvider &fdp)
48 {
49 MessageParcel data;
50 MessageParcel reply;
51 MessageOption option;
52 auto frameCount = fdp.ConsumeIntegral<int32_t>();
53 data.WriteInterfaceToken(g_interfaceToken);
54 data.WriteInt32(frameCount);
55 fuzz_->OnRemoteRequest(
56 static_cast<uint32_t>(IStreamRepeatCallbackIpcCode::COMMAND_ON_FRAME_ENDED), data, reply, option);
57 }
58
HStreamRepeatCallbackStubFuzzTest3(FuzzedDataProvider & fdp)59 void HStreamRepeatCallbackStubFuzzer::HStreamRepeatCallbackStubFuzzTest3(FuzzedDataProvider &fdp)
60 {
61 MessageParcel data;
62 MessageParcel reply;
63 MessageOption option;
64 auto errorCode = fdp.ConsumeIntegral<int32_t>();
65 data.WriteInterfaceToken(g_interfaceToken);
66 data.WriteInt32(errorCode);
67 fuzz_->OnRemoteRequest(
68 static_cast<uint32_t>(IStreamRepeatCallbackIpcCode::COMMAND_ON_FRAME_ERROR), data, reply, option);
69 }
70
HStreamRepeatCallbackStubFuzzTest4(FuzzedDataProvider & fdp)71 void HStreamRepeatCallbackStubFuzzer::HStreamRepeatCallbackStubFuzzTest4(FuzzedDataProvider &fdp)
72 {
73 MessageParcel data;
74 MessageParcel reply;
75 MessageOption option;
76 data.WriteInterfaceToken(g_interfaceToken);
77 constexpr int32_t executionModeCount = static_cast<int32_t>(SketchStatus::STARTING) + NUM_1;
78 SketchStatus status = static_cast<SketchStatus>(fdp.ConsumeIntegral<uint8_t>() % executionModeCount);
79 data.WriteInt32(static_cast<int32_t>(status));
80 fuzz_->OnRemoteRequest(
81 static_cast<uint32_t>(IStreamRepeatCallbackIpcCode::COMMAND_ON_SKETCH_STATUS_CHANGED), data, reply, option);
82 }
83
FuzzTest(const uint8_t * rawData,size_t size)84 void FuzzTest(const uint8_t *rawData, size_t size)
85 {
86 FuzzedDataProvider fdp(rawData, size);
87 auto hStreamRepeatCallbackStub = std::make_unique<HStreamRepeatCallbackStubFuzzer>();
88 if (hStreamRepeatCallbackStub == nullptr) {
89 MEDIA_INFO_LOG("hStreamRepeatCallbackStub is null");
90 return;
91 }
92 HStreamRepeatCallbackStubFuzzer::fuzz_ = std::make_shared<HStreamRepeatCallbackStubFuzz>();
93 hStreamRepeatCallbackStub->HStreamRepeatCallbackStubFuzzTest1();
94 hStreamRepeatCallbackStub->HStreamRepeatCallbackStubFuzzTest2(fdp);
95 hStreamRepeatCallbackStub->HStreamRepeatCallbackStubFuzzTest3(fdp);
96 hStreamRepeatCallbackStub->HStreamRepeatCallbackStubFuzzTest4(fdp);
97 }
98 } // namespace CameraStandard
99 } // namespace OHOS
100
101 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)102 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
103 {
104 if (size < OHOS::CameraStandard::THRESHOLD) {
105 return 0;
106 }
107
108 OHOS::CameraStandard::FuzzTest(data, size);
109 return 0;
110 }