1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hstream_repeat_stub_fuzzer.h"
17 #include "camera_log.h"
18 #include "hstream_repeat.h"
19 #include "iservice_registry.h"
20 #include "message_parcel.h"
21 #include "nativetoken_kit.h"
22 #include "string_ex.h"
23 #include "token_setproc.h"
24 #include "accesstoken_kit.h"
25 #include "camera_metadata_info.h"
26 #include "metadata_utils.h"
27 #include "iconsumer_surface.h"
28 #include "securec.h"
29 #include "stream_repeat_callback_proxy.h"
30 #include "system_ability_definition.h"
31 #include "iservice_registry.h"
32
33 namespace OHOS {
34 namespace CameraStandard {
35 const size_t THRESHOLD = 10;
36 static const std::u16string g_interfaceToken = u"OHOS.CameraStandard.IStreamRepeat";
37 std::shared_ptr<HStreamRepeatStubFuzz> HStreamRepeatStubFuzzer::fuzz_{nullptr};
38
HStreamRepeatStubFuzzTest1()39 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest1()
40 {
41 MessageParcel data;
42 MessageParcel reply;
43 MessageOption option;
44 data.WriteInterfaceToken(g_interfaceToken);
45 fuzz_->OnRemoteRequestInner(
46 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_START), data, reply, option);
47 }
48
HStreamRepeatStubFuzzTest2()49 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest2()
50 {
51 MessageParcel data;
52 MessageParcel reply;
53 MessageOption option;
54 data.WriteInterfaceToken(g_interfaceToken);
55 fuzz_->OnRemoteRequestInner(
56 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_STOP), data, reply, option);
57 }
58
HStreamRepeatStubFuzzTest3()59 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest3()
60 {
61 MessageParcel data;
62 MessageParcel reply;
63 MessageOption option;
64 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
65 auto object = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
66 auto proxy = std::make_shared<StreamRepeatCallbackProxy>(object);
67 data.WriteInterfaceToken(g_interfaceToken);
68 data.WriteRemoteObject(proxy->AsObject());
69 fuzz_->OnRemoteRequestInner(
70 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_SET_CALLBACK), data, reply, option);
71 }
72
HStreamRepeatStubFuzzTest4()73 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest4()
74 {
75 MessageParcel data;
76 MessageParcel reply;
77 MessageOption option;
78 data.WriteInterfaceToken(g_interfaceToken);
79 fuzz_->OnRemoteRequestInner(
80 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_RELEASE), data, reply, option);
81 }
82
HStreamRepeatStubFuzzTest5()83 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest5()
84 {
85 MessageParcel data;
86 MessageParcel reply;
87 MessageOption option;
88 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
89 CHECK_RETURN(photoSurface == nullptr);
90 sptr<IBufferProducer> producer = photoSurface->GetProducer();
91 data.WriteInterfaceToken(g_interfaceToken);
92 data.WriteRemoteObject(producer->AsObject());
93 fuzz_->OnRemoteRequestInner(
94 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_ADD_DEFERRED_SURFACE), data, reply, option);
95 }
96
HStreamRepeatStubFuzzTest6(FuzzedDataProvider & fdp)97 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest6(FuzzedDataProvider &fdp)
98 {
99 MessageParcel data;
100 MessageParcel reply;
101 MessageOption option;
102 auto width = fdp.ConsumeIntegral<int32_t>();
103 auto height = fdp.ConsumeIntegral<int32_t>();
104 auto sketchRatio = fdp.ConsumeFloatingPoint<float>();
105 data.WriteInterfaceToken(g_interfaceToken);
106 data.WriteInt32(width);
107 data.WriteInt32(height);
108 data.WriteFloat(sketchRatio);
109 fuzz_->OnRemoteRequestInner(
110 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_FORK_SKETCH_STREAM_REPEAT), data, reply, option);
111 }
112
HStreamRepeatStubFuzzTest7()113 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest7()
114 {
115 MessageParcel data;
116 MessageParcel reply;
117 MessageOption option;
118 data.WriteInterfaceToken(g_interfaceToken);
119 fuzz_->OnRemoteRequestInner(
120 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_REMOVE_SKETCH_STREAM_REPEAT), data, reply, option);
121 }
122
HStreamRepeatStubFuzzTest8(FuzzedDataProvider & fdp)123 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest8(FuzzedDataProvider &fdp)
124 {
125 MessageParcel data;
126 MessageParcel reply;
127 MessageOption option;
128 auto sketchRatio = fdp.ConsumeFloatingPoint<float>();
129 data.WriteInterfaceToken(g_interfaceToken);
130 data.WriteFloat(sketchRatio);
131 fuzz_->OnRemoteRequestInner(
132 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_UPDATE_SKETCH_RATIO), data, reply, option);
133 }
134
HStreamRepeatStubFuzzTest9(FuzzedDataProvider & fdp)135 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest9(FuzzedDataProvider &fdp)
136 {
137 MessageParcel data;
138 MessageParcel reply;
139 MessageOption option;
140 auto minFrameRate = fdp.ConsumeIntegral<int32_t>();
141 auto maxFrameRate = fdp.ConsumeIntegral<int32_t>();
142 data.WriteInterfaceToken(g_interfaceToken);
143 data.WriteInt32(minFrameRate);
144 data.WriteInt32(maxFrameRate);
145 fuzz_->OnRemoteRequestInner(
146 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_SET_FRAME_RATE), data, reply, option);
147 }
148
HStreamRepeatStubFuzzTest10(FuzzedDataProvider & fdp)149 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest10(FuzzedDataProvider &fdp)
150 {
151 MessageParcel data;
152 MessageParcel reply;
153 MessageOption option;
154 auto isEnable = fdp.ConsumeIntegral<int32_t>();
155 data.WriteInterfaceToken(g_interfaceToken);
156 data.WriteInt32(isEnable ? 1 : 0);
157 fuzz_->OnRemoteRequestInner(
158 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_ENABLE_SECURE), data, reply, option);
159 }
160
HStreamRepeatStubFuzzTest11(FuzzedDataProvider & fdp)161 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest11(FuzzedDataProvider &fdp)
162 {
163 MessageParcel data;
164 MessageParcel reply;
165 MessageOption option;
166 auto isEnable = fdp.ConsumeIntegral<int32_t>();
167 data.WriteInterfaceToken(g_interfaceToken);
168 data.WriteInt32(isEnable ? 1 : 0);
169 fuzz_->OnRemoteRequestInner(
170 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_SET_MIRROR), data, reply, option);
171 }
172
HStreamRepeatStubFuzzTest12(FuzzedDataProvider & fdp)173 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest12(FuzzedDataProvider &fdp)
174 {
175 MessageParcel data;
176 MessageParcel reply;
177 MessageOption option;
178 auto videoMetaType = fdp.ConsumeIntegral<int32_t>();
179 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
180 CHECK_RETURN(photoSurface == nullptr);
181 sptr<IBufferProducer> producer = photoSurface->GetProducer();
182 data.WriteInterfaceToken(g_interfaceToken);
183 data.WriteInt32(videoMetaType);
184 data.WriteRemoteObject(producer->AsObject());
185 fuzz_->OnRemoteRequestInner(
186 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_ATTACH_META_SURFACE), data, reply, option);
187 }
188
HStreamRepeatStubFuzzTest13(FuzzedDataProvider & fdp)189 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest13(FuzzedDataProvider &fdp)
190 {
191 MessageParcel data;
192 MessageParcel reply;
193 MessageOption option;
194 auto isEnable = fdp.ConsumeIntegral<int32_t>();
195 auto rotation = fdp.ConsumeIntegral<int32_t>();
196 data.WriteInterfaceToken(g_interfaceToken);
197 data.WriteInt32(isEnable ? 1 : 0);
198 data.WriteInt32(rotation);
199 fuzz_->OnRemoteRequestInner(
200 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_SET_CAMERA_ROTATION), data, reply, option);
201 }
202
HStreamRepeatStubFuzzTest14(FuzzedDataProvider & fdp)203 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest14(FuzzedDataProvider &fdp)
204 {
205 MessageParcel data;
206 MessageParcel reply;
207 MessageOption option;
208 auto apiCompatibleVersion = fdp.ConsumeIntegral<uint32_t>();
209 data.WriteInterfaceToken(g_interfaceToken);
210 data.WriteInt32(apiCompatibleVersion);
211 fuzz_->OnRemoteRequestInner(
212 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_SET_CAMERA_API), data, reply, option);
213 }
214
HStreamRepeatStubFuzzTest15()215 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest15()
216 {
217 MessageParcel data;
218 MessageParcel reply;
219 MessageOption option;
220 data.WriteInterfaceToken(g_interfaceToken);
221 fuzz_->OnRemoteRequestInner(
222 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_GET_MIRROR), data, reply, option);
223 }
224
HStreamRepeatStubFuzzTest16()225 void HStreamRepeatStubFuzzer::HStreamRepeatStubFuzzTest16()
226 {
227 MessageParcel data;
228 MessageParcel reply;
229 MessageOption option;
230 data.WriteInterfaceToken(g_interfaceToken);
231 fuzz_->OnRemoteRequestInner(
232 static_cast<uint32_t>(IStreamRepeatIpcCode::COMMAND_UN_SET_CALLBACK), data, reply, option);
233 }
234
FuzzTest(const uint8_t * rawData,size_t size)235 void FuzzTest(const uint8_t *rawData, size_t size)
236 {
237 FuzzedDataProvider fdp(rawData, size);
238 auto hStreamRepeatStub = std::make_unique<HStreamRepeatStubFuzzer>();
239 if (hStreamRepeatStub == nullptr) {
240 MEDIA_INFO_LOG("HStreamRepeatStub is null");
241 return;
242 }
243 HStreamRepeatStubFuzzer::fuzz_ = std::make_shared<HStreamRepeatStubFuzz>();
244 hStreamRepeatStub->HStreamRepeatStubFuzzTest1();
245 hStreamRepeatStub->HStreamRepeatStubFuzzTest2();
246 hStreamRepeatStub->HStreamRepeatStubFuzzTest3();
247 hStreamRepeatStub->HStreamRepeatStubFuzzTest4();
248 hStreamRepeatStub->HStreamRepeatStubFuzzTest5();
249 hStreamRepeatStub->HStreamRepeatStubFuzzTest6(fdp);
250 hStreamRepeatStub->HStreamRepeatStubFuzzTest7();
251 hStreamRepeatStub->HStreamRepeatStubFuzzTest8(fdp);
252 hStreamRepeatStub->HStreamRepeatStubFuzzTest9(fdp);
253 hStreamRepeatStub->HStreamRepeatStubFuzzTest10(fdp);
254 hStreamRepeatStub->HStreamRepeatStubFuzzTest11(fdp);
255 hStreamRepeatStub->HStreamRepeatStubFuzzTest12(fdp);
256 hStreamRepeatStub->HStreamRepeatStubFuzzTest13(fdp);
257 hStreamRepeatStub->HStreamRepeatStubFuzzTest14(fdp);
258 hStreamRepeatStub->HStreamRepeatStubFuzzTest15();
259 hStreamRepeatStub->HStreamRepeatStubFuzzTest16();
260 }
261 } // namespace CameraStandard
262 } // namespace OHOS
263
264 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)265 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
266 {
267 if (size < OHOS::CameraStandard::THRESHOLD) {
268 return 0;
269 }
270
271 OHOS::CameraStandard::FuzzTest(data, size);
272 return 0;
273 }