1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstdint>
17 #include <unistd.h>
18 #include <climits>
19 #include <cstdio>
20 #include <cstdlib>
21 #include <fcntl.h>
22 #include <fuzzer/FuzzedDataProvider.h>
23
24 #include "video_processing_client.h"
25 #include "services_fuzzer.h"
26 #include "securec.h"
27
28 using namespace std;
29 using namespace OHOS;
30
31 using namespace OHOS::Media::VideoProcessingEngine;
32 #define ATTRKEY_END 8192
33 namespace {
LoadInfoFuzzerTest(int32_t key)34 uint32_t LoadInfoFuzzerTest(int32_t key)
35 {
36 VPE_LOGI("LoadInfoFuzzerTest begin!");
37 SurfaceBufferInfo bufferInfo;
38 auto &manager = VideoProcessingManager::GetInstance();
39 manager.LoadInfo(key, bufferInfo);
40 VPE_LOGI("LoadInfoFuzzerTest end!");
41 return ERR_NONE;
42 }
43
CreateFuzzerTest(std::string feature,std::string clientName,uint32_t clientID)44 uint32_t CreateFuzzerTest(std::string feature, std::string clientName, uint32_t clientID)
45 {
46 VPE_LOGI("CreateFuzzerTest begin!");
47 auto &manager = VideoProcessingManager::GetInstance();
48 manager.Create(feature, clientName, clientID);
49 VPE_LOGI("CreateFuzzerTest end!");
50 return ERR_NONE;
51 }
52
DestroyFuzzerTest(uint32_t clientID)53 uint32_t DestroyFuzzerTest(uint32_t clientID)
54 {
55 VPE_LOGI("DestroyFuzzerTest begin!");
56 auto &manager = VideoProcessingManager::GetInstance();
57 manager.Destroy(clientID);
58 VPE_LOGI("DestroyFuzzerTest end!");
59 return ERR_NONE;
60 }
61
SetParameterFuzzerTest(uint32_t clientID,int32_t tag,const std::vector<uint8_t> & parameter)62 uint32_t SetParameterFuzzerTest(uint32_t clientID, int32_t tag, const std::vector<uint8_t>& parameter)
63 {
64 VPE_LOGI("SetParameterFuzzerTest begin!");
65 auto &manager = VideoProcessingManager::GetInstance();
66 manager.SetParameter(clientID, tag, parameter);
67 VPE_LOGI("SetParameterFuzzerTest end!");
68 return ERR_NONE;
69 }
70
GetParameterFuzzerTest(uint32_t clientID,int32_t tag)71 uint32_t GetParameterFuzzerTest(uint32_t clientID, int32_t tag)
72 {
73 VPE_LOGI("GetParameterFuzzerTest begin!");
74 std::vector<uint8_t> param;
75 auto &manager = VideoProcessingManager::GetInstance();
76 manager.GetParameter(clientID, tag, param);
77 VPE_LOGI("GetParameterFuzzerTest end!");
78 return ERR_NONE;
79 }
80
UpdateMetadataFuzzerTest(uint32_t clientID,SurfaceBufferInfo & image)81 uint32_t UpdateMetadataFuzzerTest(uint32_t clientID, SurfaceBufferInfo& image)
82 {
83 VPE_LOGI("UpdateMetadataFuzzerTest begin!");
84 auto &manager = VideoProcessingManager::GetInstance();
85 manager.UpdateMetadata(clientID, image);
86 VPE_LOGI("UpdateMetadataFuzzerTest end!");
87 return ERR_NONE;
88 }
89
ProcessFuzzerTest(uint32_t clientID,const SurfaceBufferInfo & input)90 uint32_t ProcessFuzzerTest(uint32_t clientID, const SurfaceBufferInfo& input)
91 {
92 VPE_LOGI("ProcessFuzzerTest begin!");
93 SurfaceBufferInfo output;
94 auto &manager = VideoProcessingManager::GetInstance();
95 manager.Process(clientID, input, output);
96 VPE_LOGI("ProcessFuzzerTest end!");
97 return ERR_NONE;
98 }
99
ComposeImageFuzzerTest(uint32_t clientID,const SurfaceBufferInfo & inputSdrImage,const SurfaceBufferInfo & inputGainmap,bool legacy)100 uint32_t ComposeImageFuzzerTest(uint32_t clientID, const SurfaceBufferInfo& inputSdrImage,
101 const SurfaceBufferInfo& inputGainmap, bool legacy)
102 {
103 VPE_LOGI("ComposeImageFuzzerTest begin!");
104 auto &manager = VideoProcessingManager::GetInstance();
105 SurfaceBufferInfo outputHdrImage;
106 manager.ComposeImage(clientID, inputSdrImage, inputGainmap, outputHdrImage, legacy);
107 VPE_LOGI("ComposeImageFuzzerTest end!");
108 return ERR_NONE;
109 }
110
DecomposeImageTest(uint32_t clientID,const SurfaceBufferInfo & inputImage)111 uint32_t DecomposeImageTest(uint32_t clientID, const SurfaceBufferInfo& inputImage)
112 {
113 VPE_LOGI("DecomposeImageTest begin!");
114 SurfaceBufferInfo outputSdrImage;
115 SurfaceBufferInfo outputGainmap;
116 auto &manager = VideoProcessingManager::GetInstance();
117 manager.DecomposeImage(clientID, inputImage, outputSdrImage, outputGainmap);
118 VPE_LOGI("DecomposeImageTest end!");
119 return ERR_NONE;
120 }
121 }
122
123
124 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)125 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
126 {
127 FuzzedDataProvider data_provider(data, size);
128 SurfaceBufferInfo buffer;
129 buffer.videoInfo.videoIndex = data_provider.ConsumeIntegral<uint64_t>();
130 buffer.videoInfo.frameIndex = data_provider.ConsumeIntegral<uint64_t>();
131 if (data != nullptr) {
132 std::vector<uint8_t> vec;
133 vec.resize(size);
134 if (memcpy_s(vec.data(), vec.size(), data, size) != 0) {
135 VPE_LOGE("memcpy_s err");
136 return 0;
137 }
138 uint32_t key = data_provider.ConsumeIntegralInRange <uint32_t>(0, ATTRKEY_END);
139 buffer.surfacebuffer = SurfaceBuffer::Create();
140 if (buffer.surfacebuffer == nullptr) {
141 VPE_LOGI("buffer.surfacebuffer is nullptr");
142 return 0;
143 }
144 buffer.surfacebuffer->SetMetadata(key, vec);
145 }
146
147 LoadInfoFuzzerTest(data_provider.ConsumeIntegral<uint32_t>());
148
149 CreateFuzzerTest(data_provider.ConsumeRandomLengthString(), data_provider.ConsumeRandomLengthString(),
150 data_provider.ConsumeIntegral<uint32_t>());
151
152 DestroyFuzzerTest(data_provider.ConsumeIntegral<uint32_t>());
153
154 SetParameterFuzzerTest(data_provider.ConsumeIntegral<uint32_t>(), data_provider.ConsumeIntegral<int32_t>(),
155 data_provider.ConsumeRemainingBytes<uint8_t>());
156
157 ProcessFuzzerTest(data_provider.ConsumeIntegral<uint32_t>(), buffer);
158
159 GetParameterFuzzerTest(data_provider.ConsumeIntegral<uint32_t>(), data_provider.ConsumeIntegral<int32_t>());
160
161 UpdateMetadataFuzzerTest(data_provider.ConsumeIntegral<uint32_t>(), buffer);
162
163 ComposeImageFuzzerTest(data_provider.ConsumeIntegral<uint32_t>(), buffer, buffer, data_provider.ConsumeBool());
164
165 DecomposeImageTest(data_provider.ConsumeIntegral<uint32_t>(), buffer);
166 return 0;
167 }