1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "metadata_output_fuzzer.h"
17 #include "message_parcel.h"
18 #include "securec.h"
19 #include "camera_log.h"
20 #include "camera_manager.h"
21 #include "camera_device.h"
22 #include "capture_input.h"
23 #include "picture_proxy.h"
24
25 namespace OHOS {
26 namespace CameraStandard {
27 using namespace DeferredProcessing;
28 static constexpr int32_t MIN_SIZE_NUM = 64;
29 static constexpr int32_t streamId = 0;
30 const size_t THRESHOLD = 10;
31 static pid_t pid = 0;
32 std::vector<MetadataObjectType> metadataObjectTypes = {
33 MetadataObjectType::BAR_CODE_DETECTION,
34 MetadataObjectType::BASE_FACE_DETECTION,
35 MetadataObjectType::CAT_BODY,
36 MetadataObjectType::CAT_FACE,
37 MetadataObjectType::FACE,
38 };
39 std::vector<MetadataObjectType> typeAdded = {
40 MetadataObjectType::CAT_BODY,
41 MetadataObjectType::CAT_FACE,
42 MetadataObjectType::FACE,
43 };
44 std::vector<MetadataObjectType> supportedType = {
45 MetadataObjectType::CAT_BODY,
46 MetadataObjectType::CAT_FACE,
47 MetadataObjectType::FACE,
48 MetadataObjectType::HUMAN_BODY,
49 };
50
51 std::shared_ptr<MetadataOutput> MetadataOutputFuzzer::fuzz_{nullptr};
52 sptr<CameraManager> cameraManager_ = nullptr;
53
MetadataOutputFuzzTest(FuzzedDataProvider & fdp)54 void MetadataOutputFuzzer::MetadataOutputFuzzTest(FuzzedDataProvider& fdp)
55 {
56 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
57 return;
58 }
59 cameraManager_ = CameraManager::GetInstance();
60 std::vector<sptr<CameraDevice>> cameras = cameraManager_->GetCameraDeviceListFromServer();
61 CHECK_RETURN_ELOG(cameras.empty(), "MetadataOutputFuzzer: GetCameraDeviceListFromServer Error");
62 sptr<CaptureInput> input = cameraManager_->CreateCameraInput(cameras[0]);
63 CHECK_RETURN_ELOG(!input, "CreateCameraInput Error");
64 sptr<CaptureOutput> metadata = cameraManager_->CreateMetadataOutput();
65 sptr<CaptureSession> session = cameraManager_->CreateCaptureSession();
66 session->BeginConfig();
67 session->AddInput(input);
68 session->AddOutput(metadata);
69 session->CommitConfig();
70 session->Start();
71 session->innerInputDevice_ = nullptr;
72 sptr<MetadataOutput> metadatOutput = (sptr<MetadataOutput>&)metadata;
73 fuzz_->SetSession(session);
74 fuzz_->CreateStream();
75 fuzz_->GetAppObjectCallback();
76 fuzz_->GetAppStateCallback();
77 fuzz_->GetSupportedMetadataObjectTypes();
78 std::shared_ptr<MetadataObjectCallback> metadataObjectCallback = std::make_shared<AppMetadataCallback>();
79 fuzz_->checkValidType(typeAdded, supportedType);
80 std::vector<MetadataObjectType> typesOfMetadata;
81 typesOfMetadata.push_back(MetadataObjectType::FACE);
82 fuzz_->convert(typesOfMetadata);
83 std::shared_ptr<MetadataObjectCallback> appObjectCallback = std::make_shared<AppMetadataCallback>();
84 fuzz_->appObjectCallback_ = appObjectCallback;
85 sptr<IStreamMetadataCallback> cameraMetadataCallback = new HStreamMetadataCallbackImpl(metadatOutput);
86 fuzz_->cameraMetadataCallback_ = cameraMetadataCallback;
87 fuzz_->SetCallback(appObjectCallback);
88 std::shared_ptr<OHOS::Camera::CameraMetadata> result = session->GetMetadata();
89 std::shared_ptr<HStreamMetadataCallbackImpl> hstreamMetadataCallbackImpl =
90 std::make_shared<HStreamMetadataCallbackImpl>(metadatOutput);
91 hstreamMetadataCallbackImpl->OnMetadataResult(streamId, result);
92 fuzz_->Release();
93 fuzz_->appStateCallback_ = nullptr;
94 fuzz_->CameraServerDied(pid);
95 }
96
MetadataOutputFuzzTest1(FuzzedDataProvider & fdp)97 void MetadataOutputFuzzer::MetadataOutputFuzzTest1(FuzzedDataProvider& fdp)
98 {
99 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
100 return;
101 }
102 std::shared_ptr<MetadataObjectFactory> factory = std::make_shared<MetadataObjectFactory>();
103 factory->ResetParameters();
104 MetadataObjectType type = MetadataObjectType::HUMAN_BODY;
105 sptr<MetadataObject> ret = factory->createMetadataObject(type);
106 IDeferredPhotoProcessingSessionCallbackFuzz callback;
107 auto object = callback.AsObject();
108 sptr<IStreamMetadata> streamMetadata = iface_cast<IStreamMetadata>(object);
109 sptr<IConsumerSurface> surface = IConsumerSurface::Create();
110 sptr<MetadataObjectFactory> factoryPtr = MetadataObjectFactory::GetInstance();
111 sptr<MetadataObjectFactory> factoryPtr_2 = MetadataObjectFactory::GetInstance();
112 std::shared_ptr<OHOS::Camera::CameraMetadata> result = nullptr;
113 std::vector<sptr<MetadataObject>> metaObjects = {};
114 bool isNeedMirror = fdp.ConsumeBool();
115 bool isNeedFlip = fdp.ConsumeBool();
116 fuzz_->ProcessMetadata(streamId, result, metaObjects, isNeedMirror, isNeedFlip);
117 camera_metadata_item_t metadataItem;
118 fuzz_->reportFaceResults_ = fdp.ConsumeBool();
119 MetadataCommonUtils::GenerateObjects(metadataItem, type, metaObjects, isNeedMirror, isNeedFlip,
120 RectBoxType::RECT_CAMERA);
121 MetadataCommonUtils::ProcessRectBox(fdp.ConsumeIntegral<int32_t>(), fdp.ConsumeIntegral<int32_t>(),
122 fdp.ConsumeIntegral<int32_t>(), fdp.ConsumeIntegral<int32_t>(), isNeedMirror, isNeedFlip,
123 RectBoxType::RECT_CAMERA);
124 int32_t index = fdp.ConsumeIntegral<int32_t>();
125 MetadataCommonUtils::ProcessExternInfo(factoryPtr, metadataItem, index, type, isNeedMirror, isNeedFlip,
126 RectBoxType::RECT_CAMERA);
127 fuzz_->GetSurface();
128 fuzz_->surface_ = nullptr;
129 fuzz_->ReleaseSurface();
130 fuzz_->SetCapturingMetadataObjectTypes(metadataObjectTypes);
131 fuzz_->AddMetadataObjectTypes(metadataObjectTypes);
132 fuzz_->RemoveMetadataObjectTypes(metadataObjectTypes);
133 }
134
Test(uint8_t * data,size_t size)135 void Test(uint8_t* data, size_t size)
136 {
137 FuzzedDataProvider fdp(data, size);
138 auto metadataOutput = std::make_unique<MetadataOutputFuzzer>();
139 if (metadataOutput == nullptr) {
140 MEDIA_INFO_LOG("metadataOutput is null");
141 return;
142 }
143 IDeferredPhotoProcessingSessionCallbackFuzz callback;
144 auto object = callback.AsObject();
145 sptr<IStreamMetadata> streamMetadata = iface_cast<IStreamMetadata>(object);
146 sptr<IConsumerSurface> surface = IConsumerSurface::Create();
147 MetadataOutputFuzzer::fuzz_ = std::make_shared<MetadataOutput>(surface, streamMetadata);
148 CHECK_RETURN_ELOG(!MetadataOutputFuzzer::fuzz_, "Create fuzz_ Error");
149 metadataOutput->MetadataOutputFuzzTest(fdp);
150 metadataOutput->MetadataOutputFuzzTest1(fdp);
151 }
152
153 } // namespace CameraStandard
154 } // namespace OHOS
155
156 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)157 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
158 {
159 if (size < OHOS::CameraStandard::THRESHOLD) {
160 return 0;
161 }
162
163 OHOS::CameraStandard::Test(data, size);
164 return 0;
165 }