1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <fuzzer/FuzzedDataProvider.h>
17
18 #include "access_token.h"
19 #include "accesstoken_kit.h"
20 #include "foundation/multimedia/camera_framework/common/utils/camera_log.h"
21 #include "hap_token_info.h"
22 #include "iconsumer_surface.h"
23 #include "ipc_skeleton.h"
24 #include "metadata_utils.h"
25 #include "nativetoken_kit.h"
26 #include "stream_capture_fuzzer.h"
27 #include "test_token.h"
28 #include "token_setproc.h"
29
30 using namespace std;
31
32 namespace OHOS {
33 namespace CameraStandard {
34 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IStreamCapture";
35 const size_t LIMITCOUNT = 4;
36 const int32_t PHOTO_WIDTH = 1280;
37 const int32_t PHOTO_HEIGHT = 960;
38 const int32_t PHOTO_FORMAT = 2000;
39 static constexpr int32_t MIN_SIZE_NUM = 120;
40
StreamCaptureFuzzTest(uint8_t * rawData,size_t size)41 void StreamCaptureFuzzTest(uint8_t *rawData, size_t size)
42 {
43 FuzzedDataProvider fdp(rawData, size);
44 if (fdp.remaining_bytes() < MIN_SIZE_NUM) {
45 return;
46 }
47 CHECK_RETURN_ELOG(!TestToken().GetAllCameraPermission(), "GetPermission error");
48
49 int32_t itemCount = 10;
50 int32_t dataSize = 100;
51 std::vector<uint8_t> streams = fdp.ConsumeBytes<uint8_t>(dataSize);
52 std::shared_ptr<OHOS::Camera::CameraMetadata> ability;
53 ability = std::make_shared<OHOS::Camera::CameraMetadata>(itemCount, dataSize);
54 ability->addEntry(OHOS_ABILITY_STREAM_AVAILABLE_EXTEND_CONFIGURATIONS, streams.data(), streams.size() / LIMITCOUNT);
55 int32_t compensationRange[2] = {fdp.ConsumeIntegral<int32_t>(), fdp.ConsumeIntegral<int32_t>()};
56 ability->addEntry(OHOS_CONTROL_AE_COMPENSATION_RANGE, compensationRange,
57 sizeof(compensationRange) / sizeof(compensationRange[0]));
58 float focalLength = fdp.ConsumeFloatingPoint<float>();
59 ability->addEntry(OHOS_ABILITY_FOCAL_LENGTH, &focalLength, 1);
60
61 int32_t sensorOrientation = fdp.ConsumeIntegral<int32_t>();
62 ability->addEntry(OHOS_SENSOR_ORIENTATION, &sensorOrientation, 1);
63
64 int32_t cameraPosition = fdp.ConsumeIntegral<int32_t>();
65 ability->addEntry(OHOS_ABILITY_CAMERA_POSITION, &cameraPosition, 1);
66
67 const camera_rational_t aeCompensationStep[] = {{rawData[0], rawData[1]}};
68 ability->addEntry(OHOS_CONTROL_AE_COMPENSATION_STEP, &aeCompensationStep,
69 sizeof(aeCompensationStep) / sizeof(aeCompensationStep[0]));
70
71 MessageParcel data;
72 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
73 CHECK_RETURN_ELOG(!(OHOS::Camera::MetadataUtils::EncodeCameraMetadata(ability, data)),
74 "StreamCaptureFuzzer: EncodeCameraMetadata Error");
75 data.RewindRead(0);
76
77 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
78 CHECK_RETURN_ELOG(!photoSurface, "StreamCaptureFuzzer: Create photoSurface Error");
79 sptr<IBufferProducer> producer = photoSurface->GetProducer();
80 sptr<HStreamCapture> streamcapture = new HStreamCapture(producer, PHOTO_FORMAT, PHOTO_WIDTH, PHOTO_HEIGHT);
81 CHECK_RETURN(streamcapture == nullptr);
82 streamcapture->Release();
83 }
84 } // namespace CameraStandard
85 } // namespace OHOS
86
87 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)88 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
89 {
90 /* Run your code on data */
91 OHOS::CameraStandard::StreamCaptureFuzzTest(data, size);
92 return 0;
93 }
94
95