1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstdint>
17 #include <fuzzer/FuzzedDataProvider.h>
18 #include <memory>
19
20 #include "accesstoken_kit.h"
21 #include "camera_device.h"
22 #include "camera_log.h"
23 #include "camera_output_capability.h"
24 #include "capture_scene_const.h"
25 #include "input/camera_manager.h"
26 #include "message_parcel.h"
27 #include "nativetoken_kit.h"
28 #include "preview_output_fuzzer.h"
29 #include "securec.h"
30 #include "test_token.h"
31 #include "token_setproc.h"
32
33 namespace OHOS {
34 namespace CameraStandard {
35 namespace PreviewOutputFuzzer {
36 static constexpr int32_t MAX_CODE_LEN = 512;
37 static constexpr int32_t MIN_SIZE_NUM = 550;
38 const int32_t NUM_TWO = 2;
39 const size_t THRESHOLD = 10;
40 static const int32_t MINFORMAT = 30;
41 static const int32_t MEDIAFORMAT = 60;
42 static const int32_t MAXFORMAT = 120;
43
TestOutput(sptr<PreviewOutput> output,FuzzedDataProvider & fdp)44 void TestOutput(sptr<PreviewOutput> output, FuzzedDataProvider& fdp)
45 {
46 MEDIA_INFO_LOG("PreviewOutputFuzzer: ENTER");
47 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
48 return;
49 }
50 sptr<IConsumerSurface> previewSurface = IConsumerSurface::Create();
51 CHECK_RETURN_ELOG(!previewSurface, "previewOutputFuzzer: Create previewSurface Error");
52 sptr<IBufferProducer> producer = previewSurface->GetProducer();
53 CHECK_RETURN_ELOG(!producer, "previewOutputFuzzer: GetProducer Error");
54 sptr<Surface> sf = Surface::CreateSurfaceAsProducer(producer);
55 output->AddDeferredSurface(sf);
56 output->Start();
57 output->IsSketchSupported();
58 output->GetSketchRatio();
59 bool isEnable = fdp.ConsumeBool();
60 output->EnableSketch(isEnable);
61 output->CreateStream();
62 output->GetFrameRateRange();
63 int32_t minFrameRate = fdp.ConsumeIntegralInRange<int32_t>(MINFORMAT, MEDIAFORMAT);
64 int32_t maxFrameRate = fdp.ConsumeIntegralInRange<int32_t>(MEDIAFORMAT, MAXFORMAT);
65 output->SetFrameRateRange(minFrameRate, maxFrameRate);
66 output->SetOutputFormat(minFrameRate);
67 output->SetFrameRate(minFrameRate, maxFrameRate);
68 output->GetSupportedFrameRates();
69 output->StartSketch();
70 output->StopSketch();
71 output->GetDeviceMetadata();
72 output->FindSketchSize();
73 output->GetObserverControlTags();
74
75 output->canSetFrameRateRange(minFrameRate, maxFrameRate);
76 output->GetPreviewRotation(minFrameRate);
77 output->JudegRotationFunc(minFrameRate);
78 output->SetPreviewRotation(minFrameRate, isEnable);
79 output->Stop();
80 }
81
Test(uint8_t * data,size_t size)82 void Test(uint8_t *data, size_t size)
83 {
84 FuzzedDataProvider fdp(data, size);
85 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
86 return;
87 }
88 CHECK_RETURN_ELOG(!TestToken().GetAllCameraPermission(), "GetPermission error");
89 auto manager = CameraManager::GetInstance();
90 CHECK_RETURN_ELOG(!manager, "previewOutputFuzzer: Get CameraManager instance Error");
91 auto cameras = manager->GetSupportedCameras();
92 CHECK_RETURN_ELOG(cameras.size() < NUM_TWO, "previewOutputFuzzer: GetSupportedCameras Error");
93 MessageParcel dataMessageParcel;
94 size_t bufferSize = fdp.ConsumeIntegralInRange(0, MAX_CODE_LEN);
95 std::vector<uint8_t> buffer = fdp.ConsumeBytes<uint8_t>(bufferSize);
96 dataMessageParcel.WriteRawData(buffer.data(), buffer.size());
97 auto camera = cameras[dataMessageParcel.ReadUint32() % cameras.size()];
98 CHECK_RETURN_ELOG(!camera, "previewOutputFuzzer: camera is null");
99 int32_t mode = dataMessageParcel.ReadInt32() % (SceneMode::NORMAL + NUM_TWO);
100 auto capability = manager->GetSupportedOutputCapability(camera, mode);
101 CHECK_RETURN_ELOG(!capability, "previewOutputFuzzer: GetSupportedOutputCapability Error");
102 auto profiles = capability->GetPreviewProfiles();
103 CHECK_RETURN_ELOG(profiles.empty(), "previewOutputFuzzer: GetPreviewProfiles empty");
104 Profile profile = profiles[dataMessageParcel.ReadUint32() % profiles.size()];
105 sptr<IConsumerSurface> previewSurface = IConsumerSurface::Create();
106 CHECK_RETURN_ELOG(!previewSurface, "previewOutputFuzzer: create previewSurface Error");
107 sptr<IBufferProducer> producer = previewSurface->GetProducer();
108 CHECK_RETURN_ELOG(!producer, "previewOutputFuzzer: GetProducer Error");
109 sptr<Surface> pSurface = Surface::CreateSurfaceAsProducer(producer);
110 CHECK_RETURN_ELOG(!pSurface, "previewOutputFuzzer: GetProducer Error");
111 auto output = manager->CreatePreviewOutput(profile, pSurface);
112 CHECK_RETURN_ELOG(!output, "previewOutputFuzzer: CreatePhotoOutput Error");
113 TestOutput(output, fdp);
114 }
115
116 } // namespace StreamRepeatStubFuzzer
117 } // namespace CameraStandard
118 } // namespace OHOS
119
120 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)121 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
122 {
123 if (size < OHOS::CameraStandard::PreviewOutputFuzzer::THRESHOLD) {
124 return 0;
125 }
126 /* Run your code on data */
127 OHOS::CameraStandard::PreviewOutputFuzzer::Test(data, size);
128 return 0;
129 }