1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "boomerangdecodeimage_fuzzer.h"
17
18 #include "singleton.h"
19
20 #define private public
21 #include "boomerang_callback_stub.h"
22 #include "devicestatus_service.h"
23 #include "fi_log.h"
24 #include "message_parcel.h"
25
26 #undef LOG_TAG
27 #define LOG_TAG "BoomerangDecodeFuzzTest"
28
29 namespace OHOS {
30 namespace Msdp {
31 namespace DeviceStatus {
32
33 class BoomerangClientTestCallback : public BoomerangCallbackStub {
34 public:
35 private:
36 BoomerangData data_;
37 };
38 namespace OHOS {
39 constexpr int32_t MAX_PIXEL_MAP_WIDTH { 600 };
40 constexpr int32_t MAX_PIXEL_MAP_HEIGHT { 600 };
41 constexpr int32_t PIXEL_MAP_WIDTH { 40 };
42 constexpr int32_t PIXEL_MAP_HEIGHT { 40 };
43 constexpr uint32_t DEFAULT_ICON_COLOR { 0xFF };
44
CreatePixelMap(int32_t width,int32_t height)45 std::shared_ptr<Media::PixelMap> CreatePixelMap(int32_t width, int32_t height)
46 {
47 CALL_DEBUG_ENTER;
48 if (width <= 0 || width > MAX_PIXEL_MAP_WIDTH || height <= 0 || height > MAX_PIXEL_MAP_HEIGHT) {
49 FI_HILOGE("Invalid size, width:%{public}d, height:%{public}d", width, height);
50 return nullptr;
51 }
52 Media::InitializationOptions opts;
53 opts.size.width = width;
54 opts.size.height = height;
55 opts.pixelFormat = Media::PixelFormat::BGRA_8888;
56 opts.alphaType = Media::AlphaType::IMAGE_ALPHA_TYPE_OPAQUE;
57 opts.scaleMode = Media::ScaleMode::FIT_TARGET_SIZE;
58
59 int32_t colorLen = width * height;
60 std::unique_ptr<uint32_t[]> colors = std::make_unique<uint32_t[]>(colorLen);
61 int32_t colorByteCount = colorLen * sizeof(uint32_t);
62 auto ret = memset_s(colors.get(), colorByteCount, DEFAULT_ICON_COLOR, colorByteCount);
63 if (ret != EOK) {
64 FI_HILOGE("memset_s failed");
65 return nullptr;
66 }
67 std::shared_ptr<Media::PixelMap> pixelMap = Media::PixelMap::Create(colors.get(), colorLen, opts);
68 if (pixelMap == nullptr) {
69 FI_HILOGE("Create pixelMap failed");
70 return nullptr;
71 }
72 return pixelMap;
73 }
74
BoomerangDecodeFuzzTest(const uint8_t * data,size_t size)75 bool BoomerangDecodeFuzzTest(const uint8_t* data, size_t size)
76 {
77 const std::u16string FORMMGR_DEVICE_TOKEN { u"ohos.msdp.Idevicestatus" };
78 MessageParcel datas;
79 if (!datas.WriteInterfaceToken(FORMMGR_DEVICE_TOKEN)) {
80 FI_HILOGE("Write failed");
81 return false;
82 }
83 auto pixelMap = CreatePixelMap(PIXEL_MAP_WIDTH, PIXEL_MAP_HEIGHT);
84 if (!pixelMap->Marshalling(datas)) {
85 FI_HILOGE("Failed to marshalling pixelMap");
86 return false;
87 }
88 sptr<IRemoteBoomerangCallback> callback = new (std::nothrow) BoomerangClientTestCallback();
89 if (!datas.WriteBuffer(data, size) || !datas.RewindRead(0)
90 || !datas.WriteParcelable(pixelMap.get()) || !datas.WriteRemoteObject(callback->AsObject())) {
91 FI_HILOGE("Write failed");
92 return false;
93 }
94 MessageParcel reply;
95 MessageOption option;
96 DelayedSingleton<DeviceStatusService>::GetInstance()->OnRemoteRequest(
97 static_cast<uint32_t>(Msdp::IIntentionIpcCode::COMMAND_BOOMERANG_ENCODE_IMAGE), datas, reply, option);
98 return true;
99 }
100
BoomerangDecodeFuzzTest1(const uint8_t * data,size_t size)101 bool BoomerangDecodeFuzzTest1(const uint8_t* data, size_t size)
102 {
103 const std::u16string FORMMGR_DEVICE_TOKEN { u"ohos.msdp.Idevicestatus" };
104 MessageParcel datas;
105 if (!datas.WriteInterfaceToken(FORMMGR_DEVICE_TOKEN)) {
106 FI_HILOGE("Write failed");
107 return false;
108 }
109 auto pixelMap = CreatePixelMap(PIXEL_MAP_WIDTH, PIXEL_MAP_HEIGHT);
110 if (!pixelMap->Marshalling(datas)) {
111 FI_HILOGE("Failed to marshalling pixelMap");
112 return false;
113 }
114 if (!datas.WriteBuffer(data, size) || !datas.RewindRead(0) || !datas.WriteParcelable(pixelMap.get())) {
115 FI_HILOGE("Write failed");
116 return false;
117 }
118 MessageParcel reply;
119 MessageOption option;
120 DelayedSingleton<DeviceStatusService>::GetInstance()->OnRemoteRequest(
121 static_cast<uint32_t>(Msdp::IIntentionIpcCode::COMMAND_BOOMERANG_ENCODE_IMAGE), datas, reply, option);
122 return true;
123 }
124 } // namespace OHOS
125
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)126 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
127 {
128 /* Run your code on data */
129 if (data == nullptr) {
130 return 0;
131 }
132
133 OHOS::BoomerangDecodeFuzzTest(data, size);
134 OHOS::BoomerangDecodeFuzzTest1(data, size);
135 return 0;
136 }
137 } // namespace DeviceStatus
138 } // namespace Msdp
139 } // namespace OHOS
140