1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "video_post_processor_fuzzer.h"
17 #include <fcntl.h>
18 #include "dp_log.h"
19 #include "ipc_file_descriptor.h"
20 #include "securec.h"
21 #include <fuzzer/FuzzedDataProvider.h>
22 #include "v1_3/types.h"
23
24 using namespace std;
25
26 namespace OHOS {
27 namespace CameraStandard {
28 using namespace DeferredProcessing;
29 using DeferredVideoJobPtr = std::shared_ptr<DeferredVideoJob>;
30 std::shared_ptr<VideoPostProcessor> VideoPostProcessorFuzzer::processor_{nullptr};
31 static constexpr int32_t MIN_SIZE_NUM = 460;
32 constexpr int VIDEO_REQUEST_FD_ID = 1;
33 const char* TEST_FILE_PATH_1 = "/data/test/VideoPostProcessorFuzzTest_test_file1.mp4";
34 const char* TEST_FILE_PATH_2 = "/data/test/VideoPostProcessorFuzzTest_test_file2.mp4";
35
VideoPostProcessorFuzzTest1(FuzzedDataProvider & fdp)36 void VideoPostProcessorFuzzer::VideoPostProcessorFuzzTest1(FuzzedDataProvider& fdp)
37 {
38 constexpr int32_t executionModeCount1 = static_cast<int32_t>(ExecutionMode::DUMMY) + 1;
39 ExecutionMode selectedExecutionMode =
40 static_cast<ExecutionMode>(fdp.ConsumeIntegral<uint8_t>() % executionModeCount1);
41 processor_->SetExecutionMode(selectedExecutionMode);
42 processor_->SetDefaultExecutionMode();
43 uint8_t randomNum = fdp.ConsumeIntegral<uint8_t>();
44 std::vector<std::string> testStrings = {fdp.ConsumeRandomLengthString(100), fdp.ConsumeRandomLengthString(100)};
45 std::string videoId(testStrings[randomNum % testStrings.size()]);
46 auto srcFd = fdp.ConsumeIntegral<uint8_t>();
47 auto dstFd = fdp.ConsumeIntegral<uint8_t>();
48 processor_->copyFileByFd(srcFd, dstFd);
49 auto isAutoSuspend = fdp.ConsumeBool();
50 std::string videoId1(testStrings[randomNum % testStrings.size()]);
51 int sfd = open(TEST_FILE_PATH_1, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
52 int dfd = open(TEST_FILE_PATH_2, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
53 fdsan_exchange_owner_tag(sfd, 0, LOG_DOMAIN);
54 fdsan_exchange_owner_tag(dfd, 0, LOG_DOMAIN);
55 sptr<IPCFileDescriptor> srcFd1 = sptr<IPCFileDescriptor>::MakeSptr(sfd);
56 sptr<IPCFileDescriptor> dstFd1 = sptr<IPCFileDescriptor>::MakeSptr(dfd);
57 DeferredVideoJobPtr jobPtr = std::make_shared<DeferredVideoJob>(videoId1, srcFd1, dstFd1);
58 std::shared_ptr<DeferredVideoWork> work =
59 make_shared<DeferredVideoWork>(jobPtr, selectedExecutionMode, isAutoSuspend);
60 processor_->StartTimer(videoId, work);
61 processor_->StopTimer(work);
62 processor_->ProcessRequest(work);
63 processor_->RemoveRequest(videoId);
64 constexpr int32_t executionModeCount2 = static_cast<int32_t>(SchedulerType::NORMAL_TIME_STATE) + 2;
65 SchedulerType selectedSchedulerType = static_cast<SchedulerType>(fdp.ConsumeIntegral<uint8_t>() %
66 executionModeCount2);
67 constexpr int32_t executionModeCount3 = static_cast<int32_t>(DpsError::DPS_ERROR_VIDEO_PROC_INTERRUPTED) + 2;
68 DpsError selectedDpsError = static_cast<DpsError>(fdp.ConsumeIntegral<uint8_t>() % executionModeCount3);
69 constexpr int32_t executionModeCount4 = static_cast<int32_t>(MediaResult::PAUSE) + 2;
70 MediaResult selectedMediaResult = static_cast<MediaResult>(fdp.ConsumeIntegral<uint8_t>() % executionModeCount4);
71 constexpr int32_t executionModeCount5 = static_cast<int32_t>(HdiStatus::HDI_NOT_READY_TEMPORARILY) + 1;
72 HdiStatus selectedHdiStatus = static_cast<HdiStatus>(fdp.ConsumeIntegral<uint8_t>() % executionModeCount5);
73 processor_->PauseRequest(videoId, selectedSchedulerType);
74 sptr<IPCFileDescriptor> inputFd = sptr<IPCFileDescriptor>::MakeSptr(VIDEO_REQUEST_FD_ID);
75 processor_->StartMpeg(videoId, inputFd);
76 processor_->StopMpeg(selectedMediaResult, work);
77 processor_->OnSessionDied();
78 processor_->OnProcessDone(videoId, nullptr);
79 processor_->OnError(videoId, selectedDpsError);
80 processor_->OnStateChanged(selectedHdiStatus);
81 processor_->OnTimerOut(videoId);
82
83 remove(TEST_FILE_PATH_1);
84 remove(TEST_FILE_PATH_2);
85 }
86
VideoPostProcessorFuzzTest2(FuzzedDataProvider & fdp)87 void VideoPostProcessorFuzzer::VideoPostProcessorFuzzTest2(FuzzedDataProvider& fdp)
88 {
89 std::vector<std::string> pendingVideos;
90 processor_->GetPendingVideos(pendingVideos);
91 uint8_t randomNum = fdp.ConsumeIntegral<uint8_t>();
92 std::vector<std::string> testStrings = {fdp.ConsumeRandomLengthString(100), fdp.ConsumeRandomLengthString(100)};
93 std::string videoId(testStrings[randomNum % testStrings.size()]);
94 auto inputFd = fdp.ConsumeIntegral<int>();
95 processor_->PrepareStreams(videoId, inputFd);
96 StreamDescription stream;
97 stream.type = HDI::Camera::V1_3::MEDIA_STREAM_TYPE_VIDEO;
98 sptr<BufferProducerSequenceable> producer;
99 processor_->SetStreamInfo(stream, producer);
100 processor_->GetRunningWork(videoId);
101 }
102
Test(uint8_t * data,size_t size)103 void Test(uint8_t* data, size_t size)
104 {
105 FuzzedDataProvider fdp(data, size);
106 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
107 return;
108 }
109 auto videoPostProcessor = std::make_unique<VideoPostProcessorFuzzer>();
110 if (videoPostProcessor == nullptr) {
111 DP_INFO_LOG("videoPostProcessor is null");
112 return;
113 }
114 int32_t userId = fdp.ConsumeIntegral<int32_t>();
115 VideoPostProcessorFuzzer::processor_ = std::make_shared<VideoPostProcessor>(userId);
116 if (VideoPostProcessorFuzzer::processor_ == nullptr) {
117 return;
118 }
119 videoPostProcessor->VideoPostProcessorFuzzTest1(fdp);
120 videoPostProcessor->VideoPostProcessorFuzzTest2(fdp);
121 }
122 } // namespace CameraStandard
123 } // namespace OHOS
124
125 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)126 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
127 {
128 OHOS::CameraStandard::Test(data, size);
129 return 0;
130 }