1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "avmetadatahelperdatasrc_fuzzer.h"
17
18 #include <fcntl.h>
19 #include <iostream>
20 #include <sys/stat.h>
21 #include <filesystem>
22 #include "fuzzer/FuzzedDataProvider.h"
23
24 #include "stub_common.h"
25 #include "media_server.h"
26 #include "media_parcel.h"
27 #include "i_standard_avmetadatahelper_service.h"
28 #include "media_data_source_stub.h"
29
30 namespace {
31 constexpr char VIDEO_PATH[] = "/data/local/tmp/test.mp4";
32 const int32_t SYSTEM_ABILITY_ID = 3002;
33 const bool RUN_ON_CREATE = false;
34 } // namespace
35
36 namespace OHOS {
37 namespace Media {
38 class IMediaDataSourceImpl : public IMediaDataSource {
39 public:
IMediaDataSourceImpl(int32_t fd,size_t size)40 IMediaDataSourceImpl(int32_t fd, size_t size) : fd_(fd), size_(size) {}
41
ReadAt(int64_t pos,uint32_t length,const std::shared_ptr<AVSharedMemory> & mem)42 int32_t ReadAt(int64_t pos, uint32_t length, const std::shared_ptr<AVSharedMemory> &mem) override
43 {
44 if (mem == nullptr) {
45 return 0;
46 }
47 if (pos + static_cast<int64_t>(length) >= static_cast<int64_t>(size_)) {
48 return -1;
49 }
50 if (pos > 0) {
51 lseek(fd_, pos, SEEK_SET);
52 }
53 return read(fd_, mem->GetBase(), length);
54 }
55
ReadAt(uint32_t length,const std::shared_ptr<AVSharedMemory> & mem)56 int32_t ReadAt(uint32_t length, const std::shared_ptr<AVSharedMemory> &mem) override
57 {
58 if (mem == nullptr) {
59 return 0;
60 }
61 if (static_cast<int64_t>(length) >= static_cast<int64_t>(size_)) {
62 return -1;
63 }
64 return read(fd_, mem->GetBase(), length);
65 }
66
ReadAt(const std::shared_ptr<AVSharedMemory> & mem,uint32_t length,int64_t pos=-1)67 int32_t ReadAt(const std::shared_ptr<AVSharedMemory> &mem, uint32_t length, int64_t pos = -1) override
68 {
69 return ReadAt(pos, length, mem);
70 }
71
GetSize(int64_t & size)72 int32_t GetSize(int64_t &size) override
73 {
74 return static_cast<int32_t>(size_);
75 }
76
77 private:
78 int32_t fd_{ 0 };
79 size_t size_{ 0 };
80 };
81
CreateFuzzavmetadatahelper()82 sptr<IRemoteStub<IStandardAVMetadataHelperService>> CreateFuzzavmetadatahelper()
83 {
84 std::shared_ptr<MediaServer> mediaServer = std::make_shared<MediaServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
85 if (mediaServer == nullptr) {
86 return nullptr;
87 }
88 sptr<IRemoteObject> listener = new (std::nothrow) MediaListenerStubFuzzer();
89 sptr<IRemoteObject> avmetadata =
90 mediaServer->GetSubSystemAbility(IStandardMediaService::MediaSystemAbility::MEDIA_AVMETADATAHELPER, listener);
91 return iface_cast<IRemoteStub<IStandardAVMetadataHelperService>>(avmetadata);
92 }
93
FuzzavmetadatahelperSetSource(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper,MediaDataSourceStub * & dataSrcStub)94 void FuzzavmetadatahelperSetSource(
95 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper, MediaDataSourceStub *&dataSrcStub)
96 {
97 if (avmetadatahelper == nullptr) {
98 return;
99 }
100
101 int32_t fileDes = open(VIDEO_PATH, O_RDONLY);
102 if (fileDes < 0) {
103 return;
104 }
105 struct stat64 st;
106 fstat(fileDes, &st);
107 const std::shared_ptr<IMediaDataSource> src = std::make_shared<IMediaDataSourceImpl>(fileDes, st.st_size);
108 dataSrcStub = new (std::nothrow) MediaDataSourceStub(src);
109 if (dataSrcStub == nullptr) {
110 return;
111 }
112 sptr<IRemoteObject> object = dataSrcStub->AsObject();
113
114 if (object == nullptr) {
115 return;
116 }
117
118 MessageParcel msg;
119 MessageParcel reply;
120 MessageOption option;
121
122 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
123 msg.WriteRemoteObject(object);
124 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::SET_MEDIA_DATA_SRC_OBJ, msg, reply, option);
125 }
126
FuzzavmetadatahelperResolveMetadata(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper,int32_t randomKey)127 void FuzzavmetadatahelperResolveMetadata(
128 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper, int32_t randomKey)
129 {
130 if (avmetadatahelper == nullptr) {
131 return;
132 }
133
134 MessageParcel msg;
135 MessageParcel reply;
136 MessageOption option;
137
138 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
139 msg.WriteInt64(randomKey);
140 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::RESOLVE_METADATA, msg, reply, option);
141 }
142
FuzzavmetadatahelperResolveMetadataMap(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)143 void FuzzavmetadatahelperResolveMetadataMap(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
144 {
145 if (avmetadatahelper == nullptr) {
146 return;
147 }
148
149 MessageParcel msg;
150 MessageParcel reply;
151 MessageOption option;
152
153 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
154 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::RESOLVE_METADATA_MAP, msg, reply, option);
155 }
156
FuzzavmetadatahelperFetchAlbumCover(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)157 void FuzzavmetadatahelperFetchAlbumCover(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
158 {
159 if (avmetadatahelper == nullptr) {
160 return;
161 }
162
163 MessageParcel msg;
164 MessageParcel reply;
165 MessageOption option;
166
167 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
168 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::FETCH_ALBUM_COVER, msg, reply, option);
169 }
170
FuzzavmetadatahelperFetchFrame(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper,int32_t randomTimeUs,int32_t randomInt32)171 void FuzzavmetadatahelperFetchFrame(
172 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper, int32_t randomTimeUs, int32_t randomInt32)
173 {
174 if (avmetadatahelper == nullptr) {
175 return;
176 }
177
178 MessageParcel msg;
179 MessageParcel reply;
180 MessageOption option;
181
182 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
183
184 msg.WriteInt64(randomTimeUs);
185 msg.WriteInt32(randomInt32);
186 msg.WriteInt32(randomInt32);
187 msg.WriteInt32(randomInt32);
188 msg.WriteInt32(randomInt32);
189 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::FETCH_FRAME_AT_TIME, msg, reply, option);
190 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::FETCH_FRAME_YUV, msg, reply, option);
191 }
192
FuzzavmetadatahelperGetAVMeta(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)193 void FuzzavmetadatahelperGetAVMeta(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
194 {
195 if (avmetadatahelper == nullptr) {
196 return;
197 }
198
199 MessageParcel msg;
200 MessageParcel reply;
201 MessageOption option;
202
203 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
204
205 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::GET_AVMETADATA, msg, reply, option);
206 }
207
FuzzavmetadatahelperGetTimeByFrameIndex(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper,int32_t data)208 void FuzzavmetadatahelperGetTimeByFrameIndex(
209 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper, int32_t data)
210 {
211 if (avmetadatahelper == nullptr) {
212 return;
213 }
214
215 MessageParcel msg;
216 MessageParcel reply;
217 MessageOption option;
218
219 uint32_t randomU32 = static_cast<uint32_t>(data);
220
221 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
222 msg.WriteUint32(randomU32);
223
224 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::GET_TIME_BY_FRAME_INDEX, msg, reply, option);
225 }
226
FuzzavmetadatahelperGetFrameIndexByTime(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper,int32_t data)227 void FuzzavmetadatahelperGetFrameIndexByTime(
228 sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper, int32_t data)
229 {
230 if (avmetadatahelper == nullptr) {
231 return;
232 }
233
234 MessageParcel msg;
235 MessageParcel reply;
236 MessageOption option;
237
238 uint32_t randomU64 = static_cast<uint64_t>(data);
239
240 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
241 msg.WriteUint64(randomU64);
242
243 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::GET_FRAME_INDEX_BY_TIME, msg, reply, option);
244 }
245
FuzzavmetadatahelperRelease(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)246 void FuzzavmetadatahelperRelease(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
247 {
248 if (avmetadatahelper == nullptr) {
249 return;
250 }
251
252 MessageParcel msg;
253 MessageParcel reply;
254 MessageOption option;
255
256 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
257
258 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::RELEASE, msg, reply, option);
259 }
260
FuzzavmetadatahelperDestroy(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)261 void FuzzavmetadatahelperDestroy(sptr<IRemoteStub<IStandardAVMetadataHelperService>> avmetadatahelper)
262 {
263 if (avmetadatahelper == nullptr) {
264 return;
265 }
266
267 MessageParcel msg;
268 MessageParcel reply;
269 MessageOption option;
270
271 msg.WriteInterfaceToken(avmetadatahelper->GetDescriptor());
272
273 avmetadatahelper->OnRemoteRequest(IStandardAVMetadataHelperService::DESTROY, msg, reply, option);
274 }
275 } // namespace Media
276 } // namespace OHOS
277
278 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)279 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
280 {
281 /* Run your code on data */
282 int fd = open(VIDEO_PATH, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
283 if (fd < 0) {
284 return 0;
285 }
286 int len = write(fd, data, size);
287 if (len <= 0) {
288 close(fd);
289 return 0;
290 }
291 close(fd);
292
293 auto avmetadatahelper = OHOS::Media::CreateFuzzavmetadatahelper();
294
295 FuzzedDataProvider fdp(data, size);
296
297 OHOS::Media::MediaDataSourceStub *dataSrcStub = nullptr;
298 OHOS::Media::FuzzavmetadatahelperSetSource(avmetadatahelper, dataSrcStub);
299 OHOS::Media::FuzzavmetadatahelperResolveMetadata(avmetadatahelper, fdp.ConsumeIntegral<int32_t>());
300 OHOS::Media::FuzzavmetadatahelperResolveMetadataMap(avmetadatahelper);
301 OHOS::Media::FuzzavmetadatahelperFetchAlbumCover(avmetadatahelper);
302 OHOS::Media::FuzzavmetadatahelperFetchFrame(
303 avmetadatahelper, fdp.ConsumeIntegral<int32_t>(), fdp.ConsumeIntegral<int32_t>());
304 OHOS::Media::FuzzavmetadatahelperGetAVMeta(avmetadatahelper);
305 OHOS::Media::FuzzavmetadatahelperGetTimeByFrameIndex(avmetadatahelper, fdp.ConsumeIntegral<int32_t>());
306 OHOS::Media::FuzzavmetadatahelperGetFrameIndexByTime(avmetadatahelper, fdp.ConsumeIntegral<int32_t>());
307 OHOS::Media::FuzzavmetadatahelperRelease(avmetadatahelper);
308 OHOS::Media::FuzzavmetadatahelperDestroy(avmetadatahelper);
309
310 unlink(VIDEO_PATH);
311 avmetadatahelper = nullptr;
312
313 return 0;
314 }
315