1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "accesstoken_kit.h"
17 #include "camera_log.h"
18 #include "camera_output_capability.h"
19 #include "input/camera_manager.h"
20 #include "ipc_skeleton.h"
21 #include "input/camera_manager_for_sys.h"
22 #include "message_parcel.h"
23 #include "nativetoken_kit.h"
24 #include "os_account_manager.h"
25 #include "securec.h"
26 #include "slow_motion_session_fuzzer.h"
27 #include "test_token.h"
28 #include "time_lapse_photo_session.h"
29 #include "token_setproc.h"
30
31 namespace OHOS {
32 namespace CameraStandard {
33 static constexpr int32_t MIN_SIZE_NUM = 50;
34 const int32_t DEFAULT_ITEMS = 10;
35 const int32_t DEFAULT_DATA_LENGTH = 100;
36 sptr<CameraManager> manager;
37 std::vector<Profile> previewProfile_ = {};
38 std::vector<VideoProfile> videoProfile_;
39
CreatePreviewOutput()40 sptr<CaptureOutput> CreatePreviewOutput()
41 {
42 previewProfile_ = {};
43 std::vector<sptr<CameraDevice>> cameras = manager->GetCameraDeviceListFromServer();
44 CHECK_RETURN_RET(cameras.empty(), nullptr);
45 auto outputCapability = manager->GetSupportedOutputCapability(cameras[0],
46 static_cast<int32_t>(SceneMode::SLOW_MOTION));
47 previewProfile_ = outputCapability->GetPreviewProfiles();
48 sptr<Surface> surface = Surface::CreateSurfaceAsConsumer();
49 if (surface == nullptr) {
50 return nullptr;
51 }
52 return manager->CreatePreviewOutput(previewProfile_[0], surface);
53 }
54
CreateVideoOutput()55 sptr<CaptureOutput> CreateVideoOutput()
56 {
57 videoProfile_ = {};
58 std::vector<sptr<CameraDevice>> cameras = manager->GetCameraDeviceListFromServer();
59 CHECK_RETURN_RET(cameras.empty(), nullptr);
60 auto outputCapability = manager->GetSupportedOutputCapability(cameras[0],
61 static_cast<int32_t>(SceneMode::SLOW_MOTION));
62 videoProfile_ = outputCapability->GetVideoProfiles();
63 sptr<Surface> surface = Surface::CreateSurfaceAsConsumer();
64 if (surface == nullptr) {
65 return nullptr;
66 }
67 return manager->CreateVideoOutput(videoProfile_[0], surface);
68 }
69
SlowMotionSessionFuzzTest(FuzzedDataProvider & fdp)70 void SlowMotionSessionFuzzer::SlowMotionSessionFuzzTest(FuzzedDataProvider& fdp)
71 {
72 manager = CameraManager::GetInstance();
73 sptr<CaptureSessionForSys> captureSessionForSys =
74 CameraManagerForSys::GetInstance()->CreateCaptureSessionForSys(SceneMode::SLOW_MOTION);
75 std::vector<sptr<CameraDevice>> cameras;
76 cameras = manager->GetCameraDeviceListFromServer();
77 CHECK_RETURN_ELOG(cameras.empty(), "SlowMotionSessionFuzzer: GetCameraDeviceListFromServer Error");
78 sptr<CaptureInput> input = manager->CreateCameraInput(cameras[0]);
79 CHECK_RETURN_ELOG(!input, "CreateCameraInput Error");
80 input->Open();
81 sptr<CaptureOutput> videoOutput = CreateVideoOutput();
82 sptr<CaptureOutput> previewOutput = CreatePreviewOutput();
83 captureSessionForSys->BeginConfig();
84 captureSessionForSys->AddInput(input);
85 sptr<CameraDevice> info = captureSessionForSys->innerInputDevice_->GetCameraDeviceInfo();
86 info->modePreviewProfiles_.emplace(static_cast<int32_t>(SceneMode::SLOW_MOTION), previewProfile_);
87 info->modeVideoProfiles_.emplace(static_cast<int32_t>(SceneMode::SLOW_MOTION), videoProfile_);
88 captureSessionForSys->AddOutput(previewOutput);
89 captureSessionForSys->AddOutput(videoOutput);
90 captureSessionForSys->CommitConfig();
91 input->Release();
92 sptr<SlowMotionSession> fuzz_ = static_cast<SlowMotionSession*>(captureSessionForSys.GetRefPtr());
93 if (fuzz_ == nullptr) {
94 return;
95 }
96 fuzz_->IsSlowMotionDetectionSupported();
97 Rect rect = {fdp.ConsumeFloatingPointInRange<double>(0, 100), fdp.ConsumeFloatingPointInRange<double>(0, 100),
98 fdp.ConsumeFloatingPointInRange<double>(0, 100), fdp.ConsumeFloatingPointInRange<double>(0, 100)};
99 fuzz_->NormalizeRect(rect);
100 fuzz_->SetSlowMotionDetectionArea(rect);
101 std::shared_ptr<OHOS::Camera::CameraMetadata> result =
102 std::make_shared<OHOS::Camera::CameraMetadata>(DEFAULT_ITEMS, DEFAULT_DATA_LENGTH);
103 SlowMotionSession::SlowMotionSessionMetadataResultProcessor processor(fuzz_);
104 uint64_t timestamp = fdp.ConsumeIntegralInRange<uint64_t>(0, 10);
105 auto metadata = make_shared<OHOS::Camera::CameraMetadata>(10, 100);
106 processor.ProcessCallbacks(timestamp, metadata);
107 std::shared_ptr<SlowMotionStateCallback> callback = std::make_shared<TestSlowMotionStateCallback>();
108 fuzz_->SetCallback(callback);
109 fuzz_->OnSlowMotionStateChange(metadata);
110 fuzz_->GetApplicationCallback();
111 bool isEnable = fdp.ConsumeBool();
112 fuzz_->LockForControl();
113 fuzz_->EnableMotionDetection(isEnable);
114 }
115
Test(uint8_t * data,size_t size)116 void Test(uint8_t* data, size_t size)
117 {
118 FuzzedDataProvider fdp(data, size);
119 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
120 return;
121 }
122 CHECK_RETURN_ELOG(!TestToken().GetAllCameraPermission(), "GetPermission error");
123 auto slowMotionSession = std::make_unique<SlowMotionSessionFuzzer>();
124 if (slowMotionSession == nullptr) {
125 MEDIA_INFO_LOG("slowMotionSession is null");
126 return;
127 }
128 slowMotionSession->SlowMotionSessionFuzzTest(fdp);
129 }
130 } // namespace CameraStandard
131 } // namespace OHOS
132
133 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)134 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
135 {
136 OHOS::CameraStandard::Test(data, size);
137 return 0;
138 }