/* * Copyright 2020 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include #include #include "Common.h" #include "Enumerator.h" #include "MockHWCamera.h" #include "VirtualCamera.h" namespace android { namespace automotive { namespace evs { namespace V1_1 { namespace implementation { namespace { using CameraDesc_1_0 = ::android::hardware::automotive::evs::V1_0::CameraDesc; enum EvsFuzzFuncs { EVS_FUZZ_GET_ALLOWED_BUFFERS, // verify getAllowedBuffers EVS_FUZZ_IS_STREAMING, // verify isStreaming EVS_FUZZ_GET_VERSION, // verify getVersion EVS_FUZZ_SET_DESCRIPTOR, // verify setDescriptor EVS_FUZZ_GET_CAMERA_INFO, // verify getCameraInfo EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT, // verify setMaxFramesInFlight EVS_FUZZ_START_VIDEO_STREAM, // verify startVideoStream EVS_FUZZ_STOP_VIDEO_STREAM, // verify stopVideoStream EVS_FUZZ_GET_EXTENDED_INFO, // verify getExtendedInfo EVS_FUZZ_SET_EXTENDED_INFO, // verify setExtendedInfo EVS_FUZZ_GET_CAMERA_INFO_1_1, // verify getCameraInfo_1_1 EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO, // verify getPhysicalCameraInfo EVS_FUZZ_PAUSE_VIDEO_STREAM, // verify pauseVideoStream EVS_FUZZ_RESUME_VIDEO_STREAM, // verify resumeVideoStream EVS_FUZZ_GET_PARAMETER_LIST, // verify getParameterList EVS_FUZZ_GET_INT_PARAMETER_RANGE, // verify getIntParameterRange EVS_FUZZ_SET_EXTENDED_INFO_1_1, // verify setExtendedInfo_1_1 EVS_FUZZ_GET_EXTENDED_INFO_1_1, // verify getExtendedInfo_1_1 EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS, // verify importExternalBuffers EVS_FUZZ_BASE_ENUM // verify common functions }; const int kMaxFuzzerConsumedBytes = 12; extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { FuzzedDataProvider fdp(data, size); sp mockHWCamera = new MockHWCamera(); sp halCamera = new HalCamera(mockHWCamera); sp virtualCamera = halCamera->makeVirtualCamera(); std::vector vBufferDesc_1_0; std::vector vBufferDesc_1_1; bool videoStarted = false; while (fdp.remaining_bytes() > kMaxFuzzerConsumedBytes) { switch (fdp.ConsumeIntegralInRange(0, EVS_FUZZ_API_SUM)) { case EVS_FUZZ_GET_ALLOWED_BUFFERS: { LOG(DEBUG) << "EVS_FUZZ_GET_ALLOWED_BUFFERS"; virtualCamera->getAllowedBuffers(); break; } case EVS_FUZZ_IS_STREAMING: { LOG(DEBUG) << "EVS_FUZZ_IS_STREAMING"; virtualCamera->isStreaming(); break; } case EVS_FUZZ_GET_VERSION: { LOG(DEBUG) << "EVS_FUZZ_GET_VERSION"; virtualCamera->getVersion(); break; } case EVS_FUZZ_GET_HW_CAMERA: { LOG(DEBUG) << "EVS_FUZZ_GET_HW_CAMERA"; virtualCamera->getHalCameras(); break; } case EVS_FUZZ_SET_DESCRIPTOR: { LOG(DEBUG) << "EVS_FUZZ_SET_DESCRIPTOR"; CameraDesc* desc = new CameraDesc(); virtualCamera->setDescriptor(desc); break; } case EVS_FUZZ_NOTIFY: { LOG(DEBUG) << "EVS_FUZZ_NOTIFY"; if (videoStarted) { EvsEventDesc event; uint32_t type = fdp.ConsumeIntegralInRange< uint32_t>(0, static_cast(EvsEventType::STREAM_ERROR)); event.aType = static_cast(type); virtualCamera->notify(event); } break; } case EVS_FUZZ_DELIVER_FRAME: { LOG(DEBUG) << "EVS_FUZZ_DELIVER_FRAME"; BufferDesc buffer; buffer.bufferId = fdp.ConsumeIntegral(); virtualCamera->deliverFrame(buffer); vBufferDesc_1_1.emplace_back(buffer); break; } case EVS_FUZZ_GET_CAMERA_INFO: { LOG(DEBUG) << "EVS_FUZZ_GET_CAMERA_INFO"; virtualCamera->getCameraInfo([](CameraDesc_1_0 desc) {}); break; } case EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT: { LOG(DEBUG) << "EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT"; uint32_t delta = fdp.ConsumeIntegral(); virtualCamera->setMaxFramesInFlight(delta); break; } case EVS_FUZZ_START_VIDEO_STREAM: { LOG(DEBUG) << "EVS_FUZZ_START_VIDEO_STREAM"; if (!videoStarted) { sp mockHWCamera1 = new MockHWCamera(); sp halCamera1 = new HalCamera(mockHWCamera1); virtualCamera->startVideoStream(halCamera1); videoStarted = true; } break; } case EVS_FUZZ_DONE_WITH_FRAME_1_0: { LOG(DEBUG) << "EVS_FUZZ_DONE_WITH_FRAME_1_0"; if (!vBufferDesc_1_0.empty()) { uint32_t whichBuffer = fdp.ConsumeIntegralInRange(0, vBufferDesc_1_0.size() - 1); virtualCamera->doneWithFrame(vBufferDesc_1_0[whichBuffer]); } break; } case EVS_FUZZ_STOP_VIDEO_STREAM: { LOG(DEBUG) << "EVS_FUZZ_STOP_VIDEO_STREAM"; virtualCamera->stopVideoStream(); videoStarted = false; break; } case EVS_FUZZ_GET_EXTENDED_INFO: { LOG(DEBUG) << "EVS_FUZZ_GET_EXTENDED_INFO"; uint32_t opaqueIdentifier = fdp.ConsumeIntegral(); virtualCamera->getExtendedInfo(opaqueIdentifier); break; } case EVS_FUZZ_SET_EXTENDED_INFO: { LOG(DEBUG) << "EVS_FUZZ_SET_EXTENDED_INFO"; uint32_t opaqueIdentifier = fdp.ConsumeIntegral(); int32_t opaqueValue = fdp.ConsumeIntegral(); virtualCamera->setExtendedInfo(opaqueIdentifier, opaqueValue); break; } case EVS_FUZZ_GET_CAMERA_INFO_1_1: { LOG(DEBUG) << "EVS_FUZZ_GET_CAMERA_INFO_1_1"; virtualCamera->getCameraInfo_1_1([](CameraDesc desc) {}); break; } case EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO: { LOG(DEBUG) << "EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO"; hidl_string deviceId(""); virtualCamera->getPhysicalCameraInfo(deviceId, [](const CameraDesc& info) {}); break; } case EVS_FUZZ_DONE_WITH_FRAME_1_1: { LOG(DEBUG) << "EVS_FUZZ_DONE_WITH_FRAME_1_1"; if (!vBufferDesc_1_1.empty()) { hidl_vec buffers(vBufferDesc_1_1); virtualCamera->doneWithFrame_1_1(buffers); } break; } case EVS_FUZZ_PAUSE_VIDEO_STREAM: { LOG(DEBUG) << "EVS_FUZZ_PAUSE_VIDEO_STREAM"; virtualCamera->pauseVideoStream(); break; } case EVS_FUZZ_RESUME_VIDEO_STREAM: { LOG(DEBUG) << "EVS_FUZZ_RESUME_VIDEO_STREAM"; virtualCamera->resumeVideoStream(); break; } case EVS_FUZZ_SET_PRIMARY: { LOG(DEBUG) << "EVS_FUZZ_SET_PRIMARY"; virtualCamera->setMaster(); break; } case EVS_FUZZ_FORCE_PRIMARY: { LOG(DEBUG) << "EVS_FUZZ_FORCE_PRIMARY"; // TODO(161388489) skip this until we finished fuzzing evs display break; } case EVS_FUZZ_UNSET_PRIMARY: { LOG(DEBUG) << "EVS_FUZZ_UNSET_PRIMARY"; virtualCamera->unsetMaster(); break; } case EVS_FUZZ_GET_PARAMETER_LIST: { LOG(DEBUG) << "EVS_FUZZ_GET_PARAMETER_LIST"; virtualCamera->getParameterList([](hidl_vec cmdList) {}); break; } case EVS_FUZZ_GET_INT_PARAMETER_RANGE: { LOG(DEBUG) << "EVS_FUZZ_GET_INT_PARAMETER_RANGE"; uint32_t whichParam = fdp.ConsumeIntegralInRange(0, static_cast( CameraParam::ABSOLUTE_ZOOM)); virtualCamera->getIntParameterRange(static_cast(whichParam), [](int32_t val0, int32_t val1, int32_t val2) { }); break; } case EVS_FUZZ_SET_PARAMETER: { LOG(DEBUG) << "EVS_FUZZ_SET_PARAMETER"; uint32_t whichParam = fdp.ConsumeIntegralInRange(0, static_cast( CameraParam::ABSOLUTE_ZOOM)); int32_t val = fdp.ConsumeIntegral(); virtualCamera->setIntParameter(static_cast(whichParam), val, [](auto status, auto effectiveValues) {}); break; } case EVS_FUZZ_GET_PARAMETER: { LOG(DEBUG) << "EVS_FUZZ_GET_PARAMETER"; uint32_t whichParam = fdp.ConsumeIntegralInRange(0, static_cast( CameraParam::ABSOLUTE_ZOOM)); virtualCamera->getIntParameter(static_cast(whichParam), [](auto status, auto effectiveValues) {}); break; } case EVS_FUZZ_SET_EXTENDED_INFO_1_1: { LOG(DEBUG) << "EVS_FUZZ_SET_EXTENDED_INFO_1_1"; uint32_t opaqueIdentifier = fdp.ConsumeIntegral(); uint8_t opaqueValue = fdp.ConsumeIntegral(); vector v; v.push_back(opaqueValue); hidl_vec vec(v); virtualCamera->setExtendedInfo_1_1(opaqueIdentifier, vec); break; } case EVS_FUZZ_GET_EXTENDED_INFO_1_1: { LOG(DEBUG) << "EVS_FUZZ_GET_EXTENDED_INFO_1_1"; uint32_t opaqueIdentifier = fdp.ConsumeIntegral(); virtualCamera->getExtendedInfo_1_1(opaqueIdentifier, [](const auto& result, const auto& data) {}); break; } case EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS: { LOG(DEBUG) << "EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS"; if (!vBufferDesc_1_1.empty()) { hidl_vec buffers(vBufferDesc_1_1); virtualCamera->importExternalBuffers(buffers, [](auto _result, auto _delta) {}); } break; } default: LOG(ERROR) << "Unexpected option, aborting..."; break; } } if (videoStarted) { // TODO(b/161762538) if we do not stop video stream manually here, // there will be crash at VirtualCamera.cpp::pHwCamera->unsetMaster(this); virtualCamera->stopVideoStream(); } return 0; } } // namespace } // namespace implementation } // namespace V1_1 } // namespace evs } // namespace automotive } // namespace android