1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "avmetadatahelper_fuzzer.h"
17
18 #include <fcntl.h>
19 #include <iostream>
20 #include <sys/stat.h>
21 #include <filesystem>
22 #include "fuzzer/FuzzedDataProvider.h"
23
24 #include "stub_common.h"
25 #include "media_server.h"
26 #include "media_parcel.h"
27 #include "i_standard_avmetadatahelper_service.h"
28
29 namespace {
30 constexpr char VIDEO_PATH[] = "/data/local/tmp/test.mp4";
31 const int32_t SYSTEM_ABILITY_ID = 3002;
32 const bool RUN_ON_CREATE = false;
33 } // namespace
34
35 namespace OHOS {
36 namespace Media {
CreateFuzzavmetadatahelper()37 sptr<IRemoteStub<IStandardAVMetadataHelperService>> CreateFuzzavmetadatahelper()
38 {
39 std::shared_ptr<MediaServer> mediaServer = std::make_shared<MediaServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
40 sptr<IRemoteObject> listener = new (std::nothrow) MediaListenerStubFuzzer();
41 sptr<IRemoteObject> avmetadata =
42 mediaServer->GetSubSystemAbility(IStandardMediaService::MediaSystemAbility::MEDIA_AVMETADATAHELPER, listener);
43 return iface_cast<IRemoteStub<IStandardAVMetadataHelperService>>(avmetadata);
44 }
45
FuzzavmetadatahelperSetSource(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)46 void FuzzavmetadatahelperSetSource(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
47 {
48 if (avmetadatahelper == nullptr) {
49 return;
50 }
51
52 int32_t fileDes = open(VIDEO_PATH, O_RDONLY);
53 MessageParcel msg;
54 MessageParcel reply;
55 MessageOption option;
56
57 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
58 msg.WriteFileDescriptor(fileDes);
59 msg.WriteInt64(0);
60 msg.WriteInt64(0);
61 msg.WriteInt32(0);
62 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::SET_FD_SOURCE, msg, reply, option);
63
64 close(fileDes);
65 }
66
FuzzavmetadatahelperResolveMetadata(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper,int32_t randomKey)67 void FuzzavmetadatahelperResolveMetadata(
68 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper, int32_t randomKey)
69 {
70 if (avmetadatahelper == nullptr) {
71 return;
72 }
73
74 MessageParcel msg;
75 MessageParcel reply;
76 MessageOption option;
77
78 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
79 msg.WriteInt64(randomKey);
80 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::RESOLVE_METADATA, msg, reply, option);
81 }
82
FuzzavmetadatahelperResolveMetadataMap(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)83 void FuzzavmetadatahelperResolveMetadataMap(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
84 {
85 if (avmetadatahelper == nullptr) {
86 return;
87 }
88
89 MessageParcel msg;
90 MessageParcel reply;
91 MessageOption option;
92
93 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
94 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::RESOLVE_METADATA_MAP, msg, reply, option);
95 }
96
FuzzavmetadatahelperFetchAlbumCover(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)97 void FuzzavmetadatahelperFetchAlbumCover(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
98 {
99 if (avmetadatahelper == nullptr) {
100 return;
101 }
102
103 MessageParcel msg;
104 MessageParcel reply;
105 MessageOption option;
106
107 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
108 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::FETCH_ALBUM_COVER, msg, reply, option);
109 }
110
FuzzavmetadatahelperFetchFrame(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper,int32_t randomTimeUs,int32_t randomInt32)111 void FuzzavmetadatahelperFetchFrame(
112 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper, int32_t randomTimeUs, int32_t randomInt32)
113 {
114 if (avmetadatahelper == nullptr) {
115 return;
116 }
117
118 MessageParcel msg;
119 MessageParcel reply;
120 MessageOption option;
121
122 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
123
124 msg.WriteInt64(randomTimeUs);
125 msg.WriteInt32(randomInt32);
126 msg.WriteInt32(randomInt32);
127 msg.WriteInt32(randomInt32);
128 msg.WriteInt32(randomInt32);
129 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::FETCH_FRAME_AT_TIME, msg, reply, option);
130 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::FETCH_FRAME_YUV, msg, reply, option);
131 }
132
FuzzavmetadatahelperGetAVMeta(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)133 void FuzzavmetadatahelperGetAVMeta(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
134 {
135 if (avmetadatahelper == nullptr) {
136 return;
137 }
138
139 MessageParcel msg;
140 MessageParcel reply;
141 MessageOption option;
142
143 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
144
145 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::GET_AVMETADATA, msg, reply, option);
146 }
147
FuzzavmetadatahelperGetTimeByFrameIndex(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper,int32_t data)148 void FuzzavmetadatahelperGetTimeByFrameIndex(
149 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper, int32_t data)
150 {
151 if (avmetadatahelper == nullptr) {
152 return;
153 }
154
155 MessageParcel msg;
156 MessageParcel reply;
157 MessageOption option;
158
159 uint32_t randomU32 = static_cast<uint32_t>(data);
160
161 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
162 msg.WriteUint32(randomU32);
163
164 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::GET_TIME_BY_FRAME_INDEX, msg, reply, option);
165 }
166
FuzzavmetadatahelperGetFrameIndexByTime(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper,int32_t data)167 void FuzzavmetadatahelperGetFrameIndexByTime(
168 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper, int32_t data)
169 {
170 if (avmetadatahelper == nullptr) {
171 return;
172 }
173
174 MessageParcel msg;
175 MessageParcel reply;
176 MessageOption option;
177
178 uint32_t randomU64 = static_cast<uint64_t>(data);
179
180 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
181 msg.WriteUint64(randomU64);
182
183 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::GET_FRAME_INDEX_BY_TIME, msg, reply, option);
184 }
185
FuzzavmetadatahelperRelease(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)186 void FuzzavmetadatahelperRelease(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
187 {
188 if (avmetadatahelper == nullptr) {
189 return;
190 }
191
192 MessageParcel msg;
193 MessageParcel reply;
194 MessageOption option;
195
196 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
197
198 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::RELEASE, msg, reply, option);
199 }
200
FuzzavmetadatahelperDestroy(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)201 void FuzzavmetadatahelperDestroy(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
202 {
203 if (avmetadatahelper == nullptr) {
204 return;
205 }
206
207 MessageParcel msg;
208 MessageParcel reply;
209 MessageOption option;
210
211 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
212
213 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::DESTROY, msg, reply, option);
214 }
215 } // namespace Media
216 } // namespace OHOS
217
218 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)219 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
220 {
221 /* Run your code on data */
222 int fd = open(VIDEO_PATH, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
223 if (fd < 0) {
224 close(fd);
225 return 0;
226 }
227 int len = write(fd, data, size);
228 if (len <= 0) {
229 close(fd);
230 return 0;
231 }
232 close(fd);
233
234 auto avmetadatahelper = OHOS::Media::CreateFuzzavmetadatahelper();
235
236 FuzzedDataProvider fdp(data, size);
237
238 OHOS::Media::FuzzavmetadatahelperSetSource(avmetadatahelper);
239 OHOS::Media::FuzzavmetadatahelperResolveMetadata(avmetadatahelper, fdp.ConsumeIntegral<int32_t>());
240 OHOS::Media::FuzzavmetadatahelperResolveMetadataMap(avmetadatahelper);
241 OHOS::Media::FuzzavmetadatahelperFetchAlbumCover(avmetadatahelper);
242 OHOS::Media::FuzzavmetadatahelperFetchFrame(
243 avmetadatahelper, fdp.ConsumeIntegral<int32_t>(), fdp.ConsumeIntegral<int32_t>());
244 OHOS::Media::FuzzavmetadatahelperGetAVMeta(avmetadatahelper);
245 OHOS::Media::FuzzavmetadatahelperGetTimeByFrameIndex(avmetadatahelper, fdp.ConsumeIntegral<int32_t>());
246 OHOS::Media::FuzzavmetadatahelperGetFrameIndexByTime(avmetadatahelper, fdp.ConsumeIntegral<int32_t>());
247 OHOS::Media::FuzzavmetadatahelperRelease(avmetadatahelper);
248 OHOS::Media::FuzzavmetadatahelperDestroy(avmetadatahelper);
249
250 unlink(VIDEO_PATH);
251 avmetadatahelper = nullptr;
252
253 return 0;
254 }
255