1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "camera_demuxer_fuzzer.h"
17 #include "message_parcel.h"
18 #include "camera_log.h"
19 #include "securec.h"
20
21 namespace OHOS {
22 namespace CameraStandard {
23 using namespace DeferredProcessing;
24
25 std::shared_ptr<Demuxer> CameraDemuxerFuzzer::fuzz_ {nullptr};
26
27 /*
28 * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T)
29 * tips: only support basic type
30 */
CameraDemuxerFuzzTest(FuzzedDataProvider & fdp)31 void CameraDemuxerFuzzer::CameraDemuxerFuzzTest(FuzzedDataProvider& fdp)
32 {
33 fuzz_ = std::make_shared<Demuxer>();
34 CHECK_RETURN_ELOG(!fuzz_, "Create fuzz_ Error");
35 std::shared_ptr<AVSourceTest> source = std::make_shared<AVSourceTest>();
36 std::map<Media::Plugins::MediaType, std::shared_ptr<Track>> tracks;
37 fuzz_->Create(source, tracks);
38
39 std::vector<uint8_t> memoryFlags = {
40 static_cast<uint8_t>(Media::MemoryFlag::MEMORY_READ_ONLY),
41 static_cast<uint8_t>(Media::MemoryFlag::MEMORY_WRITE_ONLY),
42 static_cast<uint8_t>(Media::MemoryFlag::MEMORY_READ_WRITE)
43 };
44
45 uint8_t randomIndex = fdp.ConsumeIntegral<uint8_t>() % memoryFlags.size();
46 Media::MemoryFlag selectedFlag = static_cast<Media::MemoryFlag>(memoryFlags[randomIndex]);
47 std::shared_ptr<AVAllocator> avAllocator =
48 Media::AVAllocatorFactory::CreateSharedAllocator(selectedFlag);
49 int32_t capacity = fdp.ConsumeIntegral<int32_t>();
50 if (capacity <= 0) {
51 MEDIA_INFO_LOG("Invalid capacity: %d", capacity);
52 return;
53 }
54 std::shared_ptr<AVBuffer> buffer = AVBuffer::CreateAVBuffer(avAllocator, capacity);
55
56 std::vector<Media::Plugins::MediaType> mediaTypes = {
57 Media::Plugins::MediaType::UNKNOWN,
58 Media::Plugins::MediaType::AUDIO,
59 Media::Plugins::MediaType::VIDEO,
60 Media::Plugins::MediaType::SUBTITLE,
61 Media::Plugins::MediaType::ATTACHMENT,
62 Media::Plugins::MediaType::DATA,
63 Media::Plugins::MediaType::TIMEDMETA
64 };
65
66 uint8_t mediaTypeIndex = fdp.ConsumeIntegral<uint8_t>() % mediaTypes.size();
67 Media::Plugins::MediaType selectedMediaType = mediaTypes[mediaTypeIndex];
68 fuzz_->ReadStream(selectedMediaType, buffer);
69 }
70
Test(uint8_t * data,size_t size)71 void Test(uint8_t* data, size_t size)
72 {
73 auto cameraDemuxer = std::make_unique<CameraDemuxerFuzzer>();
74 if (cameraDemuxer == nullptr) {
75 MEDIA_INFO_LOG("cameraDemuxer is null");
76 return;
77 }
78 FuzzedDataProvider fdp(data, size);
79
80 cameraDemuxer->CameraDemuxerFuzzTest(fdp);
81 }
82 } // namespace CameraStandard
83 } // namespace OHOS
84
85 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)86 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
87 {
88 OHOS::CameraStandard::Test(data, size);
89 return 0;
90 }