1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "nativebufferadapter_fuzzer.h"
17 #include <cstring>
18 #include <securec.h>
19 #include <fuzzer/FuzzedDataProvider.h>
20 #include "ohos_native_buffer_adapter_impl.h"
21
22 using namespace OHOS::NWeb;
23 namespace OHOS {
24
TestAllocate(void ** outBuffer)25 void TestAllocate(void** outBuffer)
26 {
27 OH_NativeBuffer_Config config = {
28 .width = 10,
29 .height = 10,
30 .format = OH_NativeBuffer_Format::NATIVEBUFFER_PIXEL_FMT_RGBA_8888,
31 .usage = 1,
32 };
33
34 OH_NativeBuffer* buffer = OH_NativeBuffer_Alloc(&config);
35 if (buffer != nullptr) {
36 *outBuffer = buffer;
37 } else {
38 *outBuffer = nullptr;
39 }
40 }
41
42 constexpr int MAX_SET_NUMBER = 1000;
43
NativeBufferAdapterFuzzTest(const uint8_t * data,size_t size)44 bool NativeBufferAdapterFuzzTest(const uint8_t* data, size_t size)
45 {
46 if ((data == nullptr) || (size == 0)) {
47 return false;
48 }
49 FuzzedDataProvider dataProvider(data, size);
50 uint32_t width = dataProvider.ConsumeIntegralInRange<uint32_t>(1, MAX_SET_NUMBER);
51 uint32_t height = dataProvider.ConsumeIntegralInRange<uint32_t>(1, MAX_SET_NUMBER);
52 uint64_t usage = dataProvider.ConsumeIntegralInRange<uint64_t>(1, MAX_SET_NUMBER);
53 int32_t fence = dataProvider.ConsumeIntegralInRange<int32_t>(1, MAX_SET_NUMBER);
54 int socketFd = dataProvider.ConsumeIntegralInRange<int>(1, MAX_SET_NUMBER);
55 OhosNativeBufferAdapter &adapter = OhosNativeBufferAdapterImpl::GetInstance();
56 void* buffer = nullptr;
57 adapter.AcquireBuffer(buffer);
58 adapter.Release(buffer);
59 adapter.GetSeqNum(buffer);
60 void* outBuffer = nullptr;
61 adapter.Allocate(nullptr, &outBuffer);
62 adapter.Describe(nullptr, buffer);
63 adapter.RecvHandleFromUnixSocket(socketFd, &outBuffer);
64 adapter.SendHandleToUnixSocket(outBuffer, socketFd);
65 void* eglBuffer = nullptr;
66 adapter.GetEGLBuffer(buffer, &eglBuffer);
67 adapter.FreeEGLBuffer(eglBuffer);
68 void* nativeWindowBuffer = nullptr;
69 void* nativeBuffer = nullptr;
70 adapter.NativeBufferFromNativeWindowBuffer(nativeWindowBuffer, &nativeBuffer);
71 void* address = nullptr;
72 adapter.Lock(buffer, usage, fence, &address);
73 adapter.FreeNativeBuffer(buffer);
74
75 TestAllocate(&nativeBuffer);
76 adapter.AcquireBuffer(nativeBuffer);
77 adapter.Release(nativeBuffer);
78 adapter.GetSeqNum(nativeBuffer);
79 adapter.GetEGLBuffer(nativeBuffer, &eglBuffer);
80 adapter.FreeEGLBuffer(eglBuffer);
81 OH_NativeBuffer_Config config = {
82 .width = width,
83 .height = height,
84 .format = OH_NativeBuffer_Format::NATIVEBUFFER_PIXEL_FMT_RGBA_8888,
85 .usage = OH_NativeBuffer_Usage::NATIVEBUFFER_USAGE_HW_RENDER,
86 };
87 buffer = OH_NativeBuffer_Alloc(&config);
88 adapter.Lock(buffer, usage, fence, &address);
89 adapter.Unlock(buffer, &fence);
90 adapter.FreeNativeBuffer(buffer);
91 return true;
92 }
93 } // namespace OHOS
94
95
96 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)97 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
98 {
99 /* Run your code on data */
100 OHOS::NativeBufferAdapterFuzzTest(data, size);
101 return 0;
102 }