1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstddef>
17 #include <cstdint>
18 #include <fcntl.h>
19 #include <unistd.h>
20 #include <sys/stat.h>
21 #include "securec.h"
22 #include <fuzzer/FuzzedDataProvider.h>
23 #include <iostream>
24 #include "demuxer_sample.h"
25
26 #define FUZZ_PROJECT_NAME "demuxer_fuzzer"
27 using namespace std;
28 using namespace OHOS::Media;
29 namespace OHOS {
30 const char *FLV_PATH = "/data/test/fuzz_create.flv";
31 const int64_t EXPECT_SIZE = 36;
32 const size_t URI_SIZE = 25;
33 const size_t URI_BUFFER_SIZE = 21;
34 const int64_t URI_COUNT = 20;
35 const char FLAG = '\0';
36 const size_t LANGUAGE_SIZE = 31;
37 const size_t LANGUAGE_BUFFER_SIZE = 3;
38 const size_t LANGUAGE_COUNT = 2;
CheckDataValidity(const uint8_t * data,size_t size)39 bool CheckDataValidity(const uint8_t *data, size_t size)
40 {
41 if (size <= EXPECT_SIZE) {
42 return false;
43 }
44 int32_t fd = open(FLV_PATH, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
45 if (fd < 0) {
46 return false;
47 }
48 int len = write(fd, data, size);
49 if (len <= 0) {
50 close(fd);
51 return false;
52 }
53 close(fd);
54 return true;
55 }
DemuxerFuzzTest(const uint8_t * data,size_t size)56 bool DemuxerFuzzTest(const uint8_t *data, size_t size)
57 {
58 if (!CheckDataValidity(data, size)) {
59 return false;
60 }
61 FuzzedDataProvider fdp(data, size);
62 struct Params params;
63 params.time = fdp.ConsumeIntegral<int64_t>();
64 char *uri = new char[URI_BUFFER_SIZE];
65 if (memcpy_s(uri, URI_BUFFER_SIZE, data + size - URI_SIZE, URI_COUNT) != 0) {
66 delete[] uri;
67 return false;
68 }
69 uri[URI_COUNT] = FLAG;
70 params.setTrackType = fdp.ConsumeIntegral<int64_t>();
71 params.setDuration = fdp.ConsumeIntegral<int64_t>();
72 params.setHeight = fdp.ConsumeIntegral<int64_t>();
73 params.setFrameRate = fdp.ConsumeIntegral<int64_t>();
74 char *setLanguage = new char[LANGUAGE_BUFFER_SIZE];
75 if (memcpy_s(setLanguage, LANGUAGE_BUFFER_SIZE, data + size - LANGUAGE_SIZE, LANGUAGE_COUNT) != 0) {
76 delete[] uri;
77 delete[] setLanguage;
78 return false;
79 }
80 setLanguage[LANGUAGE_COUNT] = FLAG;
81 params.setCodecConfigSize = fdp.ConsumeIntegral<uint8_t>();
82 params.sampleRate = fdp.ConsumeIntegral<int32_t>();
83 params.channelCount = fdp.ConsumeIntegral<int32_t>();
84 params.setVideoHeight = fdp.ConsumeIntegral<int32_t>();
85 params.setVideoWidth = fdp.ConsumeIntegral<int32_t>();
86 uint32_t createSize = fdp.ConsumeIntegral<uint32_t>();
87 shared_ptr<DemuxerSample> demuxerSample = make_shared<DemuxerSample>();
88 demuxerSample->filePath = FLV_PATH;
89 demuxerSample->RunNormalDemuxerApi11(createSize, uri, setLanguage, params);
90 delete[] uri;
91 delete[] setLanguage;
92 int ret = remove(FLV_PATH);
93 if (ret != 0) {
94 return false;
95 }
96 return true;
97 }
98 } // namespace OHOS
99
100 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)101 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
102 {
103 /* Run your code on data */
104 OHOS::DemuxerFuzzTest(data, size);
105 return 0;
106 }
107