1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <fuzzer/FuzzedDataProvider.h>
18 #include <sys/time.h>
19 #include <iostream>
20 #include "Common.h"
21 #include "Enumerator.h"
22 #include "HalCamera.h"
23 #include "MockHWCamera.h"
24
25 namespace android {
26 namespace automotive {
27 namespace evs {
28 namespace V1_1 {
29 namespace implementation {
30
31 namespace {
32
33 enum EvsFuzzFuncs {
34 EVS_FUZZ_MAKE_VIRTUAL_CAMERA = 0, // verify makeVirtualCamera
35 EVS_FUZZ_OWN_VIRTUAL_CAMERA, // verify ownVirtualCamera
36 EVS_FUZZ_DISOWN_VIRTUAL_CAMERA, // verify disownVirtualCamera
37 EVS_FUZZ_GET_CLIENT_COUNT, // verify getClientCount
38 EVS_FUZZ_GET_ID, // verify getId
39 EVS_FUZZ_GET_STREAM_CONFIG, // verify getStreamConfig
40 EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT, // verify changeFramesInFlight
41 EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT_1, // verify overloaded changeFramesInFlight
42 EVS_FUZZ_REQUEST_NEW_FRAME, // verify requestNewFrame
43 EVS_FUZZ_CLIENT_STREAM_STARTING, // verify clientStreamStarting
44 EVS_FUZZ_CLIENT_STREAM_ENDING, // verify clientStreamEnding
45 EVS_FUZZ_GET_STATS, // verify getStats
46 EVS_FUZZ_GET_STREAM_CONFIGURATION, // verify getStreamConfiguration
47 EVS_FUZZ_DELIVER_FRAME_1_1, // verify deliverFrame_1_1
48 EVS_FUZZ_BASE_ENUM // verify common functions
49 };
50
getCurrentTimeStamp()51 int64_t getCurrentTimeStamp() {
52 struct timeval tp;
53 gettimeofday(&tp, NULL);
54 int64_t ms = tp.tv_sec * 1000 + tp.tv_usec / 1000;
55 return ms;
56 }
57
58 const int kMaxFuzzerConsumedBytes = 12;
59
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)60 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
61 FuzzedDataProvider fdp(data, size);
62 sp<IEvsCamera_1_1> mockHWCamera = new MockHWCamera();
63 sp<HalCamera> halCamera = new HalCamera(mockHWCamera);
64 std::vector<sp<VirtualCamera>> virtualCameras;
65 std::vector<BufferDesc_1_0> vBufferDesc_1_0;
66 std::vector<BufferDesc_1_1> vBufferDesc_1_1;
67
68 while (fdp.remaining_bytes() > kMaxFuzzerConsumedBytes) {
69 switch (fdp.ConsumeIntegralInRange<uint32_t>(0, EVS_FUZZ_API_SUM - 1)) {
70 case EVS_FUZZ_MAKE_VIRTUAL_CAMERA: {
71 sp<VirtualCamera> virtualCamera = halCamera->makeVirtualCamera();
72 virtualCameras.emplace_back(virtualCamera);
73 break;
74 }
75 case EVS_FUZZ_OWN_VIRTUAL_CAMERA: {
76 if (!virtualCameras.empty()) {
77 uint32_t whichCam =
78 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
79 halCamera->ownVirtualCamera(virtualCameras[whichCam]);
80 }
81 break;
82 }
83 case EVS_FUZZ_DISOWN_VIRTUAL_CAMERA: {
84 if (!virtualCameras.empty()) {
85 uint32_t whichCam =
86 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
87 halCamera->disownVirtualCamera(virtualCameras[whichCam]);
88 }
89 break;
90 }
91 case EVS_FUZZ_GET_HW_CAMERA: {
92 halCamera->getHwCamera();
93 break;
94 }
95 case EVS_FUZZ_GET_CLIENT_COUNT: {
96 halCamera->getClientCount();
97 break;
98 }
99 case EVS_FUZZ_GET_ID: {
100 halCamera->getId();
101 break;
102 }
103 case EVS_FUZZ_GET_STREAM_CONFIG: {
104 halCamera->getStreamConfig();
105 break;
106 }
107 case EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT: {
108 uint32_t delta = fdp.ConsumeIntegral<int32_t>();
109 halCamera->changeFramesInFlight(delta);
110 break;
111 }
112 case EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT_1: {
113 hidl_vec<BufferDesc_1_1> buffers;
114 int32_t delta = 0;
115 halCamera->changeFramesInFlight(buffers, &delta);
116 break;
117 }
118 case EVS_FUZZ_REQUEST_NEW_FRAME: {
119 if (!virtualCameras.empty()) {
120 uint32_t whichCam =
121 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
122 halCamera->requestNewFrame(virtualCameras[whichCam], getCurrentTimeStamp());
123 }
124 break;
125 }
126 case EVS_FUZZ_CLIENT_STREAM_STARTING: {
127 halCamera->clientStreamStarting();
128 break;
129 }
130 case EVS_FUZZ_CLIENT_STREAM_ENDING: {
131 if (!virtualCameras.empty()) {
132 uint32_t whichCam =
133 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
134 halCamera->clientStreamEnding(virtualCameras[whichCam].get());
135 }
136 break;
137 }
138 case EVS_FUZZ_DONE_WITH_FRAME_1_0: {
139 if (!vBufferDesc_1_0.empty()) {
140 uint32_t whichBuffer =
141 fdp.ConsumeIntegralInRange<uint32_t>(0, vBufferDesc_1_0.size() - 1);
142 halCamera->doneWithFrame(vBufferDesc_1_0[whichBuffer]);
143 }
144 break;
145 }
146 case EVS_FUZZ_DONE_WITH_FRAME_1_1: {
147 if (!vBufferDesc_1_1.empty()) {
148 uint32_t whichBuffer =
149 fdp.ConsumeIntegralInRange<uint32_t>(0, vBufferDesc_1_1.size() - 1);
150 halCamera->doneWithFrame(vBufferDesc_1_1[whichBuffer]);
151 }
152 break;
153 }
154 case EVS_FUZZ_SET_PRIMARY: {
155 if (!virtualCameras.empty()) {
156 uint32_t whichCam =
157 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
158 halCamera->setMaster(virtualCameras[whichCam]);
159 }
160 break;
161 }
162 case EVS_FUZZ_FORCE_PRIMARY: {
163 if (!virtualCameras.empty()) {
164 uint32_t whichCam =
165 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
166 halCamera->forceMaster(virtualCameras[whichCam]);
167 }
168 break;
169 }
170 case EVS_FUZZ_UNSET_PRIMARY: {
171 if (!virtualCameras.empty()) {
172 uint32_t whichCam =
173 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
174 halCamera->unsetMaster(virtualCameras[whichCam]);
175 }
176 break;
177 }
178 case EVS_FUZZ_SET_PARAMETER: {
179 if (!virtualCameras.empty()) {
180 uint32_t whichCam =
181 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
182 uint32_t whichParam = fdp.ConsumeIntegralInRange<
183 uint32_t>(0, static_cast<uint32_t>(CameraParam::ABSOLUTE_ZOOM));
184 int32_t value = fdp.ConsumeIntegral<int32_t>();
185 halCamera->setParameter(virtualCameras[whichCam],
186 static_cast<CameraParam>(whichParam), value);
187 }
188 break;
189 }
190 case EVS_FUZZ_GET_PARAMETER: {
191 uint32_t whichParam =
192 fdp.ConsumeIntegralInRange<uint32_t>(0,
193 static_cast<uint32_t>(
194 CameraParam::ABSOLUTE_ZOOM));
195 int32_t value = fdp.ConsumeIntegral<int32_t>();
196 halCamera->getParameter(static_cast<CameraParam>(whichParam), value);
197 break;
198 }
199 case EVS_FUZZ_GET_STATS: {
200 halCamera->getStats();
201 break;
202 }
203 case EVS_FUZZ_GET_STREAM_CONFIGURATION: {
204 halCamera->getStreamConfiguration();
205 break;
206 }
207 case EVS_FUZZ_DELIVER_FRAME: {
208 BufferDesc_1_0 buffer;
209 buffer.bufferId = fdp.ConsumeIntegral<int32_t>();
210 halCamera->deliverFrame(buffer);
211 vBufferDesc_1_0.emplace_back(buffer);
212 break;
213 }
214 case EVS_FUZZ_DELIVER_FRAME_1_1: {
215 std::vector<BufferDesc_1_1> vec;
216 BufferDesc_1_1 buffer;
217 buffer.bufferId = fdp.ConsumeIntegral<int32_t>();
218 vec.push_back(buffer);
219 hardware::hidl_vec<BufferDesc_1_1> hidl_vec(vec);
220 halCamera->deliverFrame_1_1(hidl_vec);
221 vBufferDesc_1_1.emplace_back(buffer);
222 break;
223 }
224 case EVS_FUZZ_NOTIFY: {
225 EvsEventDesc event;
226 uint32_t type =
227 fdp.ConsumeIntegralInRange<uint32_t>(0,
228 static_cast<uint32_t>(
229 EvsEventType::STREAM_ERROR));
230 event.aType = static_cast<EvsEventType>(type);
231 // TODO(b/160824438) let's comment this for now because of the failure.
232 // If virtualCamera does not call startVideoStream, and notify(1) is called
233 // it will fail.
234 // halCamera->notify(event);
235 break;
236 }
237 default:
238 LOG(ERROR) << "Unexpected option, aborting...";
239 break;
240 }
241 }
242 return 0;
243 }
244
245 } // namespace
246 } // namespace implementation
247 } // namespace V1_1
248 } // namespace evs
249 } // namespace automotive
250 } // namespace android
251