1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "ohosimagedecoderadapterimpl_fuzzer.h"
17
18 #include <securec.h>
19 #include <sys/mman.h>
20 #include <fuzzer/FuzzedDataProvider.h>
21
22 #include "image_source.h"
23 #include "image_type.h"
24 #include "media_errors.h"
25 #include "ohos_adapter_helper.h"
26
27 using namespace OHOS::NWeb;
28 const std::string DEFAULT_MOUSE_DRAG_IMAGE { "/system/etc/device_status/drag_icon/Copy_Drag.svg" };
29
30 namespace OHOS {
31 constexpr int MAX_SET_NUMBER = 1000;
CreateDecoderAdapter()32 std::shared_ptr<OhosImageDecoderAdapter> CreateDecoderAdapter()
33 {
34 return OhosAdapterHelper::GetInstance().CreateOhosImageDecoderAdapter();
35 }
36
HandleAbnormalCase(const std::shared_ptr<OhosImageDecoderAdapter> & adapter,const uint8_t * data,size_t size)37 void HandleAbnormalCase(const std::shared_ptr<OhosImageDecoderAdapter>& adapter, const uint8_t* data, size_t size)
38 {
39 FuzzedDataProvider dataProvider(data, size);
40 uint32_t len = dataProvider.ConsumeIntegralInRange<uint32_t>(0, MAX_SET_NUMBER);
41 std::unique_ptr<uint8_t[]> rawData;
42
43 adapter->ParseImageInfo(rawData.get(), len);
44 adapter->DecodeToPixelMap(rawData.get(), len);
45 }
46
ProcessImageSource(std::shared_ptr<OhosImageDecoderAdapter> & adapter,const uint8_t * data,size_t size)47 bool ProcessImageSource(std::shared_ptr<OhosImageDecoderAdapter>& adapter, const uint8_t* data, size_t size)
48 {
49 FuzzedDataProvider dataProvider(data, size);
50 uint32_t errorCode = dataProvider.ConsumeIntegralInRange<uint32_t>(0, MAX_SET_NUMBER);
51 OHOS::Media::SourceOptions opts;
52 auto imageSource = OHOS::Media::ImageSource::CreateImageSource(DEFAULT_MOUSE_DRAG_IMAGE, opts, errorCode);
53 if (!imageSource || errorCode != Media::SUCCESS) {
54 return false;
55 }
56
57 OHOS::Media::DecodeOptions decodeOpts;
58 auto pixelMap = imageSource->CreatePixelMap(decodeOpts, errorCode);
59 if (!pixelMap || errorCode != OHOS::Media::SUCCESS) {
60 return false;
61 }
62
63 const uint8_t* imageData = pixelMap->GetPixels();
64 if (!imageData) {
65 return false;
66 }
67
68 size_t len = pixelMap->GetPixelBytes();
69 adapter->ParseImageInfo(imageData, len);
70 adapter->DecodeToPixelMap(imageData, len);
71 return true;
72 }
73
ApplyOhosImageDecoderAdapterFuzzTest(const uint8_t * data,size_t size)74 bool ApplyOhosImageDecoderAdapterFuzzTest(const uint8_t* data, size_t size)
75 {
76 if ((data == nullptr) || (size == 0)) {
77 return true;
78 }
79 size_t callCount = data[0] % 10;
80 for (size_t i = 0; i < callCount; ++i) {
81 auto adapter = CreateDecoderAdapter();
82 if (!adapter) {
83 return false;
84 }
85 HandleAbnormalCase(adapter, data, size);
86 return ProcessImageSource(adapter, data, size);
87 }
88 return true;
89 }
90
91 } // namespace OHOS
92
93 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)94 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
95 {
96 OHOS::ApplyOhosImageDecoderAdapterFuzzTest(data, size);
97 return 0;
98 }
99
