1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "moving_photo_proxy_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include "camera_ability_const.h"
21 #include "camera_log.h"
22 #include "camera_util.h"
23 #include "ipc_skeleton.h"
24 #include "photo_asset_proxy.h"
25
26 namespace OHOS {
27 namespace CameraStandard {
28 static constexpr int32_t MIN_SIZE_NUM = 64;
29 static constexpr int32_t NUM_1 = 1;
30 static constexpr int32_t NUM_2 = 2;
31
32 sptr<AvcodecTaskManagerIntf> MovingPhotoProxyFuzzer::taskManagerfuzz_{nullptr};
33 sptr<AudioCapturerSessionIntf> MovingPhotoProxyFuzzer::capturerSessionfuzz_{nullptr};
34 sptr<MovingPhotoVideoCacheIntf> MovingPhotoProxyFuzzer::videoCachefuzz_{nullptr};
35
36 std::vector<GraphicTransformType> graphicType = {
37 GRAPHIC_ROTATE_NONE,
38 GRAPHIC_ROTATE_90,
39 GRAPHIC_ROTATE_180,
40 GRAPHIC_ROTATE_270,
41 GRAPHIC_FLIP_H,
42 GRAPHIC_FLIP_V,
43 GRAPHIC_FLIP_H_ROT90,
44 GRAPHIC_FLIP_V_ROT90,
45 GRAPHIC_FLIP_H_ROT180,
46 GRAPHIC_FLIP_V_ROT180,
47 GRAPHIC_FLIP_H_ROT270,
48 GRAPHIC_FLIP_V_ROT270,
49 GRAPHIC_ROTATE_BUTT,
50 };
51
52 std::vector<ColorSpace> colorSpaceType = {
53 COLOR_SPACE_UNKNOWN, // 0
54 DISPLAY_P3, // 3
55 SRGB, // 4
56 BT709, // 6
57 BT2020_HLG, // 9
58 BT2020_PQ, // 10
59 P3_HLG, // 11
60 P3_PQ, // 12
61 DISPLAY_P3_LIMIT, // 14
62 SRGB_LIMIT, // 15
63 BT709_LIMIT, // 16
64 BT2020_HLG_LIMIT, // 19
65 BT2020_PQ_LIMIT, // 20
66 P3_HLG_LIMIT, // 21
67 P3_PQ_LIMIT, // 22
68 };
69
MyFunction()70 void MyFunction()
71 {
72 MEDIA_DEBUG_LOG("MyFunction started!");
73 }
74
MovingPhotoProxyFuzzTest(FuzzedDataProvider & fdp)75 void MovingPhotoProxyFuzzer::MovingPhotoProxyFuzzTest(FuzzedDataProvider& fdp)
76 {
77 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
78 return;
79 }
80 CHECK_EXECUTE(taskManagerfuzz_ == nullptr,
81 taskManagerfuzz_ = AvcodecTaskManagerProxy::CreateAvcodecTaskManagerProxy());
82 CHECK_RETURN_ELOG(!taskManagerfuzz_, "CreateAvcodecTaskManagerProxy Error");
83 CHECK_EXECUTE(capturerSessionfuzz_ == nullptr,
84 capturerSessionfuzz_ = AudioCapturerSessionProxy::CreateAudioCapturerSessionProxy());
85 CHECK_RETURN_ELOG(!capturerSessionfuzz_, "CreateAudioCapturerSessionProxy Error");
86 CHECK_EXECUTE(videoCachefuzz_ == nullptr,
87 videoCachefuzz_ = MovingPhotoVideoCacheProxy::CreateMovingPhotoVideoCacheProxy());
88 CHECK_RETURN_ELOG(!videoCachefuzz_, "CreateMovingPhotoVideoCacheProxy Error");
89
90 capturerSessionfuzz_->CreateAudioSession();
91 capturerSessionfuzz_->StartAudioCapture();
92 capturerSessionfuzz_->StopAudioCapture();
93
94 int32_t videoCodecTypeCount1 =
95 static_cast<int32_t>(OHOS::CameraStandard::VideoCodecType::VIDEO_ENCODE_TYPE_AVC) + NUM_1;
96 VideoCodecType videoCodecType =
97 static_cast<VideoCodecType>(fdp.ConsumeIntegral<uint8_t>() % videoCodecTypeCount1);
98 int32_t colorSpace = static_cast<int32_t>(colorSpaceType[fdp.ConsumeIntegral<int32_t>() % colorSpaceType.size()]);
99 taskManagerfuzz_->CreateAvcodecTaskManager(capturerSessionfuzz_, videoCodecType, colorSpace);
100 taskManagerfuzz_->SubmitTask(MyFunction);
101 uint32_t preBufferCount = fdp.ConsumeIntegral<uint32_t>();
102 uint32_t postBufferCount = fdp.ConsumeIntegral<uint32_t>();
103 taskManagerfuzz_->SetVideoBufferDuration(preBufferCount, postBufferCount);
104 int32_t timestamp = fdp.ConsumeIntegral<int32_t>();
105 int32_t captureId = fdp.ConsumeIntegral<int32_t>();
106 std::shared_ptr<PhotoAssetIntf> photoAssetProxy = PhotoAssetProxy::GetPhotoAssetProxy(
107 NUM_2, IPCSkeleton::GetCallingUid(), IPCSkeleton::GetCallingTokenID());;
108 taskManagerfuzz_->SetVideoFd(timestamp, photoAssetProxy, captureId);
109
110 GraphicTransformType type_ = graphicType[fdp.ConsumeIntegral<uint16_t>() % graphicType.size()];
111 sptr<SurfaceBuffer> videoBuffer = SurfaceBuffer::Create();
112 sptr<FrameRecord> frameRecord =
113 new(std::nothrow) FrameRecord(videoBuffer, timestamp, type_);
114 std::vector<sptr<FrameRecord>> frameRecords;
115 frameRecords.push_back(frameRecord);
116 int32_t taskName = fdp.ConsumeIntegral<uint64_t>();
117 int32_t rotation = fdp.ConsumeIntegral<int32_t>();
118 taskManagerfuzz_->DoMuxerVideo(frameRecords, taskName, rotation, captureId);
119 taskManagerfuzz_->isEmptyVideoFdMap();
120 int64_t startTimeStamp = fdp.ConsumeIntegral<int64_t>();
121 taskManagerfuzz_->TaskManagerInsertStartTime(captureId, startTimeStamp);
122 int64_t endTimeStamp = fdp.ConsumeIntegral<int64_t>();
123 taskManagerfuzz_->TaskManagerInsertEndTime(captureId, endTimeStamp);
124
125 videoCachefuzz_->CreateMovingPhotoVideoCache(taskManagerfuzz_);
126 videoCachefuzz_->OnDrainFrameRecord(frameRecord);
127 videoCachefuzz_->GetFrameCachedResult(frameRecords, taskName, rotation, captureId);
128 std::this_thread::sleep_for(std::chrono::seconds(1));
129 }
130
Test(uint8_t * data,size_t size)131 void Test(uint8_t* data, size_t size)
132 {
133 FuzzedDataProvider fdp(data, size);
134 auto MovingPhotoProxy = std::make_unique<MovingPhotoProxyFuzzer>();
135 if (MovingPhotoProxy == nullptr) {
136 MEDIA_INFO_LOG("MovingPhotoProxy is null");
137 return;
138 }
139 MovingPhotoProxy->MovingPhotoProxyFuzzTest(fdp);
140 }
141
142 } // namespace CameraStandard
143 } // namespace OHOS
144
145 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)146 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
147 {
148 OHOS::CameraStandard::Test(data, size);
149 return 0;
150 }