1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "stream_capture_proxy_fuzzer.h"
17
18 #include "access_token.h"
19 #include "accesstoken_kit.h"
20 #include "camera_log.h"
21 #include "hap_token_info.h"
22 #include "icapture_session.h"
23 #include "iconsumer_surface.h"
24 #include "iservice_registry.h"
25 #include "istream_common.h"
26 #include "ipc_skeleton.h"
27 #include "metadata_utils.h"
28 #include "nativetoken_kit.h"
29 #include "system_ability_definition.h"
30 #include "token_setproc.h"
31 #include <fuzzer/FuzzedDataProvider.h>
32 #include "system_ability_definition.h"
33 #include "iservice_registry.h"
34
35 using namespace std;
36
37 namespace OHOS {
38 namespace CameraStandard {
39 static constexpr int32_t MIN_SIZE_NUM = 64;
40 static constexpr int32_t ITEM_COUNT = 10;
41 static constexpr int32_t DATA_SIZE = 100;
42 std::shared_ptr<StreamCaptureProxy> StreamCaptureProxyFuzzer::fuzz_{nullptr};
43
StreamCaptureProxyFuzzTest1(FuzzedDataProvider & fdp)44 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest1(FuzzedDataProvider& fdp)
45 {
46 sptr<IRemoteObject> remote = nullptr;
47 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
48 std::shared_ptr<OHOS::Camera::CameraMetadata> ability;
49 ability = std::make_shared<OHOS::Camera::CameraMetadata>(
50 fdp.ConsumeIntegralInRange(0, ITEM_COUNT), fdp.ConsumeIntegralInRange(0, DATA_SIZE));
51 fuzz_->Capture(ability);
52
53 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
54 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
55 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
56 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
57 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
58 fuzz_->Capture(ability);
59 }
60
StreamCaptureProxyFuzzTest2(FuzzedDataProvider & fdp)61 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest2(FuzzedDataProvider& fdp)
62 {
63 sptr<IRemoteObject> remote = nullptr;
64 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
65 fuzz_->CancelCapture();
66
67 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
68 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
69 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
70 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
71 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
72 fuzz_->CancelCapture();
73 }
74
StreamCaptureProxyFuzzTest3(FuzzedDataProvider & fdp)75 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest3(FuzzedDataProvider& fdp)
76 {
77 sptr<IRemoteObject> remote = nullptr;
78 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
79 sptr<IStreamCaptureCallback> callback;
80 fuzz_->SetCallback(callback);
81
82 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
83 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
84 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
85 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
86 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
87 fuzz_->SetCallback(callback);
88 }
89
StreamCaptureProxyFuzzTest4(FuzzedDataProvider & fdp)90 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest4(FuzzedDataProvider& fdp)
91 {
92 sptr<IRemoteObject> remote = nullptr;
93 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
94 fuzz_->Release();
95
96 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
97 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
98 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
99 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
100 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
101 fuzz_->Release();
102 }
103
StreamCaptureProxyFuzzTest5(FuzzedDataProvider & fdp)104 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest5(FuzzedDataProvider& fdp)
105 {
106 sptr<IRemoteObject> remote = nullptr;
107 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
108 bool isEnabled = fdp.ConsumeBool();
109 fuzz_->SetThumbnail(isEnabled);
110
111 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
112 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
113 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
114 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
115 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
116 fuzz_->SetThumbnail(isEnabled);
117 }
118
StreamCaptureProxyFuzzTest6(FuzzedDataProvider & fdp)119 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest6(FuzzedDataProvider& fdp)
120 {
121 sptr<IRemoteObject> remote = nullptr;
122 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
123 fuzz_->ConfirmCapture();
124
125 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
126 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
127 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
128 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
129 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
130 fuzz_->ConfirmCapture();
131 }
132
StreamCaptureProxyFuzzTest7(FuzzedDataProvider & fdp)133 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest7(FuzzedDataProvider& fdp)
134 {
135 sptr<IRemoteObject> remote = nullptr;
136 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
137 int32_t type = fdp.ConsumeIntegral<int32_t>();
138 fuzz_->DeferImageDeliveryFor(type);
139
140 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
141 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
142 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
143 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
144 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
145 fuzz_->DeferImageDeliveryFor(type);
146 }
147
StreamCaptureProxyFuzzTest8(FuzzedDataProvider & fdp)148 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest8(FuzzedDataProvider& fdp)
149 {
150 sptr<IRemoteObject> remote = nullptr;
151 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
152 fuzz_->IsDeferredPhotoEnabled();
153
154 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
155 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
156 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
157 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
158 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
159 fuzz_->IsDeferredPhotoEnabled();
160 }
161
StreamCaptureProxyFuzzTest9(FuzzedDataProvider & fdp)162 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest9(FuzzedDataProvider& fdp)
163 {
164 sptr<IRemoteObject> remote = nullptr;
165 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
166 fuzz_->IsDeferredVideoEnabled();
167
168 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
169 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
170 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
171 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
172 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
173 fuzz_->IsDeferredVideoEnabled();
174 }
175
StreamCaptureProxyFuzzTest10(FuzzedDataProvider & fdp)176 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest10(FuzzedDataProvider& fdp)
177 {
178 sptr<IRemoteObject> remote = nullptr;
179 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
180 std::vector<std::string> bufferNames = {"rawImage",
181 "gainmapImage", "deepImage", "exifImage", "debugImage"};
182 size_t ind = fdp.ConsumeIntegral<size_t>() % bufferNames.size();
183 std::string name = bufferNames[ind];
184 sptr<IBufferProducer> producer = nullptr;
185 fuzz_->SetBufferProducerInfo(name, producer);
186
187 sptr<Surface> photoSurface;
188 photoSurface = Surface::CreateSurfaceAsConsumer("streamcaptureproxy");
189 producer = photoSurface->GetProducer();
190 fuzz_->SetBufferProducerInfo(name, producer);
191
192 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
193 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
194 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
195 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
196 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
197 fuzz_->SetBufferProducerInfo(name, producer);
198 }
199
StreamCaptureProxyFuzzTest11(FuzzedDataProvider & fdp)200 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest11(FuzzedDataProvider& fdp)
201 {
202 sptr<IRemoteObject> remote = nullptr;
203 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
204 int32_t type = fdp.ConsumeIntegral<int32_t>();
205 fuzz_->SetMovingPhotoVideoCodecType(type);
206
207 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
208 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
209 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
210 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
211 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
212 fuzz_->SetMovingPhotoVideoCodecType(type);
213 }
214
StreamCaptureProxyFuzzTest12(FuzzedDataProvider & fdp)215 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest12(FuzzedDataProvider& fdp)
216 {
217 sptr<IRemoteObject> remote = nullptr;
218 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
219 bool isEnabled = fdp.ConsumeBool();
220 fuzz_->EnableRawDelivery(isEnabled);
221
222 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
223 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
224 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
225 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
226 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
227 fuzz_->EnableRawDelivery(isEnabled);
228 }
229
StreamCaptureProxyFuzzTest13(FuzzedDataProvider & fdp)230 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest13(FuzzedDataProvider& fdp)
231 {
232 sptr<IRemoteObject> remote = nullptr;
233 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
234 bool isEnabled = fdp.ConsumeBool();
235 fuzz_->SetCameraPhotoRotation(isEnabled);
236
237 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
238 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
239 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
240 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
241 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
242 fuzz_->SetCameraPhotoRotation(isEnabled);
243 }
244
StreamCaptureProxyFuzzTest14(FuzzedDataProvider & fdp)245 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest14(FuzzedDataProvider& fdp)
246 {
247 sptr<IRemoteObject> remote = nullptr;
248 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
249 bool isEnabled = fdp.ConsumeBool();
250 fuzz_->EnableMovingPhoto(isEnabled);
251
252 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
253 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
254 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
255 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
256 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
257 fuzz_->EnableMovingPhoto(isEnabled);
258 }
259
StreamCaptureProxyFuzzTest15(FuzzedDataProvider & fdp)260 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest15(FuzzedDataProvider& fdp)
261 {
262 sptr<IRemoteObject> remote = nullptr;
263 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
264 fuzz_->UnSetCallback();
265
266 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
267 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
268 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
269 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
270 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
271 fuzz_->UnSetCallback();
272 }
273
StreamCaptureProxyFuzzTest16(FuzzedDataProvider & fdp)274 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest16(FuzzedDataProvider& fdp)
275 {
276 sptr<IRemoteObject> remote = nullptr;
277 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
278 bool isEnabled = fdp.ConsumeBool();
279 fuzz_->EnableOfflinePhoto(isEnabled);
280
281 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
282 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
283 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
284 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
285 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
286 fuzz_->EnableOfflinePhoto(isEnabled);
287 }
288
StreamCaptureProxyFuzzTest17(FuzzedDataProvider & fdp)289 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest17(FuzzedDataProvider& fdp)
290 {
291 sptr<IRemoteObject> remote = nullptr;
292 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
293 sptr<IStreamCapturePhotoCallback> callback;
294 fuzz_->SetPhotoAvailableCallback(callback);
295
296 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
297 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
298 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
299 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
300 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
301 fuzz_->SetPhotoAvailableCallback(callback);
302 }
303
StreamCaptureProxyFuzzTest18(FuzzedDataProvider & fdp)304 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest18(FuzzedDataProvider& fdp)
305 {
306 sptr<IRemoteObject> remote = nullptr;
307 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
308 sptr<IStreamCaptureThumbnailCallback> callback;
309 fuzz_->SetThumbnailCallback(callback);
310
311 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
312 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
313 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
314 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
315 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
316 fuzz_->SetThumbnailCallback(callback);
317 }
318
StreamCaptureProxyFuzzTest19(FuzzedDataProvider & fdp)319 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest19(FuzzedDataProvider& fdp)
320 {
321 sptr<IRemoteObject> remote = nullptr;
322 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
323 sptr<IStreamCapturePhotoAssetCallback> callback;
324 fuzz_->SetPhotoAssetAvailableCallback(callback);
325
326 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
327 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
328 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
329 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
330 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
331 fuzz_->SetPhotoAssetAvailableCallback(callback);
332 }
333
StreamCaptureProxyFuzzTest20()334 void StreamCaptureProxyFuzzer::StreamCaptureProxyFuzzTest20()
335 {
336 sptr<IRemoteObject> remote = nullptr;
337 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
338 fuzz_->UnSetPhotoAvailableCallback();
339 fuzz_->UnSetPhotoAssetAvailableCallback();
340 fuzz_->UnSetThumbnailCallback();
341
342 auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
343 CHECK_RETURN_ELOG(!samgr, "samgr nullptr");
344 remote = samgr->GetSystemAbility(CAMERA_SERVICE_ID);
345 fuzz_ = std::make_shared<StreamCaptureProxy>(remote);
346 CHECK_RETURN_ELOG(!fuzz_, "fuzz_ nullptr");
347 fuzz_->UnSetPhotoAvailableCallback();
348 fuzz_->UnSetPhotoAssetAvailableCallback();
349 fuzz_->UnSetThumbnailCallback();
350 }
351
Test(uint8_t * data,size_t size)352 void Test(uint8_t* data, size_t size)
353 {
354 FuzzedDataProvider fdp(data, size);
355 auto streamCaptureProxy = std::make_unique<StreamCaptureProxyFuzzer>();
356 if (streamCaptureProxy == nullptr) {
357 MEDIA_INFO_LOG("streamCaptureProxy is null");
358 return;
359 }
360 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
361 return;
362 }
363 streamCaptureProxy->StreamCaptureProxyFuzzTest1(fdp);
364 streamCaptureProxy->StreamCaptureProxyFuzzTest2(fdp);
365 streamCaptureProxy->StreamCaptureProxyFuzzTest3(fdp);
366 streamCaptureProxy->StreamCaptureProxyFuzzTest4(fdp);
367 streamCaptureProxy->StreamCaptureProxyFuzzTest5(fdp);
368 streamCaptureProxy->StreamCaptureProxyFuzzTest6(fdp);
369 streamCaptureProxy->StreamCaptureProxyFuzzTest7(fdp);
370 streamCaptureProxy->StreamCaptureProxyFuzzTest8(fdp);
371 streamCaptureProxy->StreamCaptureProxyFuzzTest9(fdp);
372 streamCaptureProxy->StreamCaptureProxyFuzzTest10(fdp);
373 streamCaptureProxy->StreamCaptureProxyFuzzTest11(fdp);
374 streamCaptureProxy->StreamCaptureProxyFuzzTest12(fdp);
375 streamCaptureProxy->StreamCaptureProxyFuzzTest13(fdp);
376 streamCaptureProxy->StreamCaptureProxyFuzzTest14(fdp);
377 streamCaptureProxy->StreamCaptureProxyFuzzTest15(fdp);
378 streamCaptureProxy->StreamCaptureProxyFuzzTest16(fdp);
379 streamCaptureProxy->StreamCaptureProxyFuzzTest17(fdp);
380 streamCaptureProxy->StreamCaptureProxyFuzzTest18(fdp);
381 streamCaptureProxy->StreamCaptureProxyFuzzTest19(fdp);
382 streamCaptureProxy->StreamCaptureProxyFuzzTest20();
383 }
384 } // namespace CameraStandard
385 } // namespace OHOS
386
387 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)388 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
389 {
390 /* Run your code on data */
391 OHOS::CameraStandard::Test(data, size);
392 return 0;
393 }
394