1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "lowpowervideosink_fuzzer.h"
17 #include <unistd.h>
18 #include <fcntl.h>
19 #include "fuzzer/FuzzedDataProvider.h"
20 #include <cstddef>
21 #include <cstdint>
22 #include <fcntl.h>
23 #include <fstream>
24 #include <avcodec_mime_type.h>
25
26 using namespace std;
27 using namespace OHOS;
28 using namespace OHOS::Media;
29
30 namespace {
31 const char *DATA_PATH = "/data/test/input.mp4";
32 const int32_t SYSTEM_ABILITY_ID = 3002;
33 const bool RUN_ON_CREATE = false;
34 constexpr int32_t VIDEO_MIME_TYPES_SIZE = 6;
35 constexpr uint32_t SLEEP_TIME = 1;
36
37 constexpr std::array<std::string_view, VIDEO_MIME_TYPES_SIZE> VIDEO_MIME_TYPES = {
38 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_VIDEO_AVC,
39 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_VIDEO_MPEG4,
40 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_VIDEO_HEVC,
41 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_VIDEO_RV30,
42 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_VIDEO_RV40,
43 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_VIDEO_VVC
44 };
45 }
46
47 namespace OHOS {
48 namespace Media {
49
LowPowerVideoSinkFuzz()50 LowPowerVideoSinkFuzz::LowPowerVideoSinkFuzz()
51 {
52 }
53
~LowPowerVideoSinkFuzz()54 LowPowerVideoSinkFuzz::~LowPowerVideoSinkFuzz()
55 {
56 }
57
GetVideoSinkStub()58 sptr<IRemoteStub<IStandardLppVideoStreamerService>> LowPowerVideoSinkFuzz::GetVideoSinkStub()
59 {
60 std::shared_ptr<MediaServer> mediaServer =
61 std::make_shared<MediaServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
62 sptr<IRemoteObject> listener = new(std::nothrow) MediaListenerStubFuzzer();
63 sptr<IRemoteObject> lowPowerVideoSink = mediaServer->GetSubSystemAbility(
64 IStandardMediaService::MediaSystemAbility::MEDIA_LPP_VIDEO_PLAYER, listener);
65 if (lowPowerVideoSink == nullptr) {
66 return nullptr;
67 }
68 sptr<IRemoteStub<IStandardLppVideoStreamerService>> lowPowerVideoSinkStub =
69 iface_cast<IRemoteStub<IStandardLppVideoStreamerService>>(lowPowerVideoSink);
70 return lowPowerVideoSinkStub;
71 }
72
RunFuzz(uint8_t * data,size_t size)73 bool LowPowerVideoSinkFuzz::RunFuzz(uint8_t *data, size_t size)
74 {
75 FuzzedDataProvider fdp(data, size);
76 sptr<IRemoteStub<IStandardLppVideoStreamerService>> lowPowerVideoSinkStub = GetVideoSinkStub();
77 if (lowPowerVideoSinkStub == nullptr) {
78 return false;
79 }
80 std::string mime = VIDEO_MIME_TYPES[abs(fdp.ConsumeIntegral<int32_t>())%VIDEO_MIME_TYPES_SIZE].data();
81 lowPowerVideoSinkStub->Init(mime);
82 Format format;
83 lowPowerVideoSinkStub->SetParameter(format);
84 lowPowerVideoSinkStub->Configure(format);
85 lowPowerVideoSinkStub->Prepare();
86 lowPowerVideoSinkStub->Start();
87 lowPowerVideoSinkStub->Pause();
88 lowPowerVideoSinkStub->Resume();
89 lowPowerVideoSinkStub->Flush();
90 lowPowerVideoSinkStub->StartDecode();
91 lowPowerVideoSinkStub->StartRender();
92 lowPowerVideoSinkStub->SetOutputSurface(nullptr);
93 lowPowerVideoSinkStub->SetSyncAudioStreamer(nullptr);
94 lowPowerVideoSinkStub->SetTargetStartFrame(fdp.ConsumeIntegral<int64_t>(), fdp.ConsumeIntegral<int32_t>());
95 lowPowerVideoSinkStub->SetVolume(fdp.ConsumeFloatingPoint<float>());
96 lowPowerVideoSinkStub->SetPlaybackSpeed(fdp.ConsumeFloatingPoint<float>());
97 lowPowerVideoSinkStub->ReturnFrames(nullptr);
98 lowPowerVideoSinkStub->RegisterCallback();
99 lowPowerVideoSinkStub->SetLppVideoStreamerCallback();
100 lowPowerVideoSinkStub->SetLppAudioStreamerId(fdp.ConsumeRandomLengthString());
101 lowPowerVideoSinkStub->GetStreamerId();
102 lowPowerVideoSinkStub->RenderFirstFrame();
103 lowPowerVideoSinkStub->Stop();
104 sleep(SLEEP_TIME);
105 lowPowerVideoSinkStub->Reset();
106 sleep(SLEEP_TIME);
107 lowPowerVideoSinkStub->Release();
108 sleep(SLEEP_TIME);
109 return true;
110 }
111 }
112 }
113
114 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)115 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
116 {
117 if (size < sizeof(int64_t)) {
118 return false;
119 }
120 int32_t fd = open(DATA_PATH, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
121 if (fd < 0) {
122 return false;
123 }
124 int len = write(fd, data, size);
125 if (len <= 0) {
126 close(fd);
127 return false;
128 }
129 close(fd);
130 LowPowerVideoSinkFuzz videoSink;
131 videoSink.RunFuzz(data, size);
132 unlink(DATA_PATH);
133 return 0;
134 }
135