1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hstream_capture_fuzzer.h"
17 #include "foundation/multimedia/camera_framework/common/utils/camera_log.h"
18 #include "message_parcel.h"
19 #include "iservice_registry.h"
20 #include <cstddef>
21 #include <cstdint>
22 #include <memory>
23 #include "token_setproc.h"
24 #include "iconsumer_surface.h"
25 #include "nativetoken_kit.h"
26 #include "accesstoken_kit.h"
27 #include "camera_metadata_info.h"
28 #include "metadata_utils.h"
29 #include "camera_device.h"
30 #include "camera_manager.h"
31 #include "ipc_skeleton.h"
32 #include "securec.h"
33 #include <fuzzer/FuzzedDataProvider.h>
34
35 namespace OHOS {
36 namespace CameraStandard {
37 using namespace OHOS::HDI::Camera::V1_0;
38 static constexpr int32_t MIN_SIZE_NUM = 256;
39 const size_t MAX_LENGTH_STRING = 64;
40 const int32_t PHOTO_WIDTH = 1280;
41 const int32_t PHOTO_HEIGHT = 960;
42 const int32_t PHOTO_FORMAT = 2000;
43 const int32_t ITEMCOUNT = 10;
44 const int32_t DATASIZE = 100;
45 const int32_t NUM_1 = 1;
46 const int32_t NUM_1024 = 1024;
47
48 std::shared_ptr<HStreamCapture> HStreamCaptureFuzzer::fuzz_{nullptr};
49 sptr<IBufferProducer> producer;
50
HStreamCaptureFuzzTest1(FuzzedDataProvider & fdp)51 void HStreamCaptureFuzzer::HStreamCaptureFuzzTest1(FuzzedDataProvider& fdp)
52 {
53 int32_t captureId = fdp.ConsumeIntegral<int32_t>();
54 bool isEnabled = fdp.ConsumeBool();
55 bool enabled = fdp.ConsumeIntegral<bool>();
56 fuzz_->CreateMediaLibraryPhotoAssetProxy(captureId);
57 fuzz_->GetPhotoAssetInstance(captureId);
58 fuzz_->GetAddPhotoProxyEnabled();
59 fuzz_->AcquireBufferToPrepareProxy(captureId);
60 StreamInfo_V1_1 streamInfo;
61 fuzz_->SetStreamInfo(streamInfo);
62 fuzz_->FillingPictureExtendStreamInfos(streamInfo, fdp.ConsumeIntegral<int32_t>());
63 fuzz_->SetThumbnail(isEnabled);
64 fuzz_->EnableRawDelivery(enabled);
65 std::vector<std::string> bufferNames = {"rawImage",
66 "gainmapImage", "deepImage", "exifImage", "debugImage"};
67 for (const auto& bufName : bufferNames) {
68 fuzz_->SetBufferProducerInfo(bufName, producer);
69 }
70 int32_t type = fdp.ConsumeIntegral<int32_t>();
71 fuzz_->DeferImageDeliveryFor(type);
72 fuzz_->PrepareBurst(captureId);
73 fuzz_->ResetBurst();
74 fuzz_->ResetBurstKey(captureId);
75 fuzz_->GetBurstKey(captureId);
76 fuzz_->IsBurstCapture(captureId);
77 fuzz_->IsBurstCover(captureId);
78 fuzz_->GetCurBurstSeq(captureId);
79 fuzz_->IsDeferredPhotoEnabled();
80 fuzz_->IsDeferredVideoEnabled();
81 auto videoCodecType = fdp.ConsumeIntegral<int32_t>();
82 fuzz_->SetMovingPhotoVideoCodecType(videoCodecType);
83 fuzz_->GetMovingPhotoVideoCodecType();
84 fuzz_->SetCameraPhotoRotation(fdp.ConsumeBool());
85 }
86
HStreamCaptureFuzzTest2(FuzzedDataProvider & fdp)87 void HStreamCaptureFuzzer::HStreamCaptureFuzzTest2(FuzzedDataProvider& fdp)
88 {
89 auto captureId = fdp.ConsumeIntegral<int32_t>();
90 auto interfaceCode = fdp.ConsumeIntegral<int32_t>();
91 auto timestamp = fdp.ConsumeIntegral<uint64_t>();
92 auto isDelay = fdp.ConsumeBool();
93 std::string imageId(fdp.ConsumeRandomLengthString(MAX_LENGTH_STRING));
94 fuzz_->SetBurstImages(captureId, imageId);
95 fuzz_->CheckResetBurstKey(captureId);
96 std::shared_ptr<OHOS::Camera::CameraMetadata> captureSettings;
97 captureSettings = std::make_shared<OHOS::Camera::CameraMetadata>(
98 fdp.ConsumeIntegralInRange(0, ITEMCOUNT), fdp.ConsumeIntegralInRange(0, DATASIZE));
99 fuzz_->CheckBurstCapture(captureSettings, fdp.ConsumeIntegral<int32_t>());
100 sptr<HCameraHostManager> cameraHostManager = new HCameraHostManager(nullptr);
101 std::string cameraId;
102 uint32_t callingTokenId = fdp.ConsumeIntegral<uint32_t>();
103 sptr<HCameraDevice> camDevice = new (std::nothrow)
104 HCameraDevice(cameraHostManager, cameraId, callingTokenId);
105 camDevice->OpenDevice(true);
106 fuzz_->OnCaptureReady(captureId, timestamp);
107 fuzz_->Capture(captureSettings);
108 fuzz_->CancelCapture();
109 fuzz_->SetMode(fdp.ConsumeIntegral<int32_t>());
110 fuzz_->GetMode();
111 fuzz_->ConfirmCapture();
112 fuzz_->EndBurstCapture(captureSettings);
113 fuzz_->Release();
114 fuzz_->ReleaseStream(isDelay);
115 fuzz_->OnCaptureStarted(captureId);
116 fuzz_->OnCaptureStarted(captureId, fdp.ConsumeIntegral<int32_t>());
117 fuzz_->OnCaptureEnded(captureId, fdp.ConsumeIntegral<int32_t>());
118 auto errorCode = fdp.ConsumeIntegral<int32_t>();
119 fuzz_->OnCaptureError(captureId, errorCode);
120 fuzz_->OnFrameShutter(captureId, timestamp);
121 fuzz_->OnFrameShutterEnd(captureId, timestamp);
122 CameraInfoDumper infoDumper(0);
123 fuzz_->DumpStreamInfo(infoDumper);
124 fuzz_->OperatePermissionCheck(interfaceCode);
125 CaptureInfo captureInfoPhoto;
126 fuzz_->ProcessCaptureInfoPhoto(captureInfoPhoto, captureSettings, captureId);
127 fuzz_->SetRotation(captureSettings, captureId);
128 }
129
Test(uint8_t * data,size_t size)130 void Test(uint8_t* data, size_t size)
131 {
132 FuzzedDataProvider fdp(data, size);
133 auto hstreamCapture = std::make_unique<HStreamCaptureFuzzer>();
134 if (hstreamCapture == nullptr) {
135 MEDIA_INFO_LOG("hstreamCapture is null");
136 return;
137 }
138 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
139 return;
140 }
141 sptr<Surface> photoSurface;
142 photoSurface = Surface::CreateSurfaceAsConsumer("hstreamcapture");
143 producer = photoSurface->GetProducer();
144 HStreamCaptureFuzzer::fuzz_ = std::make_shared
145 <HStreamCapture>(producer, PHOTO_FORMAT, PHOTO_WIDTH, PHOTO_HEIGHT);
146 CHECK_RETURN_ELOG(!HStreamCaptureFuzzer::fuzz_, "Create fuzz_ Error");
147 sptr<HDI::Camera::V1_0::IStreamOperator> streamOperator;
148 std::shared_ptr<OHOS::Camera::CameraMetadata> cameraAbility =
149 std::make_shared<OHOS::Camera::CameraMetadata>(NUM_1, NUM_1024);
150 HStreamCaptureFuzzer::fuzz_->LinkInput(streamOperator, cameraAbility);
151 HStreamCaptureFuzzer::fuzz_->cameraAbility_ = cameraAbility;
152 hstreamCapture->HStreamCaptureFuzzTest1(fdp);
153 hstreamCapture->HStreamCaptureFuzzTest2(fdp);
154 }
155
156 } // namespace CameraStandard
157 } // namespace OHOS
158
159 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)160 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
161 {
162 OHOS::CameraStandard::Test(data, size);
163 return 0;
164 }