1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <fuzzer/FuzzedDataProvider.h>
18 #include <iostream>
19 #include "Common.h"
20 #include "Enumerator.h"
21 #include "MockHWCamera.h"
22 #include "VirtualCamera.h"
23
24 namespace android {
25 namespace automotive {
26 namespace evs {
27 namespace V1_1 {
28 namespace implementation {
29
30 namespace {
31
32 using CameraDesc_1_0 = ::android::hardware::automotive::evs::V1_0::CameraDesc;
33
34 enum EvsFuzzFuncs {
35 EVS_FUZZ_GET_ALLOWED_BUFFERS, // verify getAllowedBuffers
36 EVS_FUZZ_IS_STREAMING, // verify isStreaming
37 EVS_FUZZ_GET_VERSION, // verify getVersion
38 EVS_FUZZ_SET_DESCRIPTOR, // verify setDescriptor
39 EVS_FUZZ_GET_CAMERA_INFO, // verify getCameraInfo
40 EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT, // verify setMaxFramesInFlight
41 EVS_FUZZ_START_VIDEO_STREAM, // verify startVideoStream
42 EVS_FUZZ_STOP_VIDEO_STREAM, // verify stopVideoStream
43 EVS_FUZZ_GET_EXTENDED_INFO, // verify getExtendedInfo
44 EVS_FUZZ_SET_EXTENDED_INFO, // verify setExtendedInfo
45 EVS_FUZZ_GET_CAMERA_INFO_1_1, // verify getCameraInfo_1_1
46 EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO, // verify getPhysicalCameraInfo
47 EVS_FUZZ_PAUSE_VIDEO_STREAM, // verify pauseVideoStream
48 EVS_FUZZ_RESUME_VIDEO_STREAM, // verify resumeVideoStream
49 EVS_FUZZ_GET_PARAMETER_LIST, // verify getParameterList
50 EVS_FUZZ_GET_INT_PARAMETER_RANGE, // verify getIntParameterRange
51 EVS_FUZZ_SET_EXTENDED_INFO_1_1, // verify setExtendedInfo_1_1
52 EVS_FUZZ_GET_EXTENDED_INFO_1_1, // verify getExtendedInfo_1_1
53 EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS, // verify importExternalBuffers
54 EVS_FUZZ_BASE_ENUM // verify common functions
55 };
56
57 const int kMaxFuzzerConsumedBytes = 12;
58
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)59 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
60 FuzzedDataProvider fdp(data, size);
61 sp<IEvsCamera_1_1> mockHWCamera = new MockHWCamera();
62 sp<HalCamera> halCamera = new HalCamera(mockHWCamera);
63 sp<VirtualCamera> virtualCamera = halCamera->makeVirtualCamera();
64
65 std::vector<BufferDesc_1_0> vBufferDesc_1_0;
66 std::vector<BufferDesc_1_1> vBufferDesc_1_1;
67
68 bool videoStarted = false;
69
70 while (fdp.remaining_bytes() > kMaxFuzzerConsumedBytes) {
71 switch (fdp.ConsumeIntegralInRange<uint32_t>(0, EVS_FUZZ_API_SUM)) {
72 case EVS_FUZZ_GET_ALLOWED_BUFFERS: {
73 LOG(DEBUG) << "EVS_FUZZ_GET_ALLOWED_BUFFERS";
74 virtualCamera->getAllowedBuffers();
75 break;
76 }
77 case EVS_FUZZ_IS_STREAMING: {
78 LOG(DEBUG) << "EVS_FUZZ_IS_STREAMING";
79 virtualCamera->isStreaming();
80 break;
81 }
82 case EVS_FUZZ_GET_VERSION: {
83 LOG(DEBUG) << "EVS_FUZZ_GET_VERSION";
84 virtualCamera->getVersion();
85 break;
86 }
87 case EVS_FUZZ_GET_HW_CAMERA: {
88 LOG(DEBUG) << "EVS_FUZZ_GET_HW_CAMERA";
89 virtualCamera->getHalCameras();
90 break;
91 }
92 case EVS_FUZZ_SET_DESCRIPTOR: {
93 LOG(DEBUG) << "EVS_FUZZ_SET_DESCRIPTOR";
94 CameraDesc* desc = new CameraDesc();
95 virtualCamera->setDescriptor(desc);
96 break;
97 }
98 case EVS_FUZZ_NOTIFY: {
99 LOG(DEBUG) << "EVS_FUZZ_NOTIFY";
100 if (videoStarted) {
101 EvsEventDesc event;
102 uint32_t type = fdp.ConsumeIntegralInRange<
103 uint32_t>(0, static_cast<uint32_t>(EvsEventType::STREAM_ERROR));
104 event.aType = static_cast<EvsEventType>(type);
105 virtualCamera->notify(event);
106 }
107 break;
108 }
109 case EVS_FUZZ_DELIVER_FRAME: {
110 LOG(DEBUG) << "EVS_FUZZ_DELIVER_FRAME";
111 BufferDesc buffer;
112 buffer.bufferId = fdp.ConsumeIntegral<int32_t>();
113 virtualCamera->deliverFrame(buffer);
114 vBufferDesc_1_1.emplace_back(buffer);
115 break;
116 }
117 case EVS_FUZZ_GET_CAMERA_INFO: {
118 LOG(DEBUG) << "EVS_FUZZ_GET_CAMERA_INFO";
119 virtualCamera->getCameraInfo([](CameraDesc_1_0 desc) {});
120 break;
121 }
122 case EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT: {
123 LOG(DEBUG) << "EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT";
124 uint32_t delta = fdp.ConsumeIntegral<uint32_t>();
125 virtualCamera->setMaxFramesInFlight(delta);
126 break;
127 }
128 case EVS_FUZZ_START_VIDEO_STREAM: {
129 LOG(DEBUG) << "EVS_FUZZ_START_VIDEO_STREAM";
130 if (!videoStarted) {
131 sp<IEvsCamera_1_1> mockHWCamera1 = new MockHWCamera();
132 sp<HalCamera> halCamera1 = new HalCamera(mockHWCamera1);
133 virtualCamera->startVideoStream(halCamera1);
134 videoStarted = true;
135 }
136 break;
137 }
138 case EVS_FUZZ_DONE_WITH_FRAME_1_0: {
139 LOG(DEBUG) << "EVS_FUZZ_DONE_WITH_FRAME_1_0";
140 if (!vBufferDesc_1_0.empty()) {
141 uint32_t whichBuffer =
142 fdp.ConsumeIntegralInRange<uint32_t>(0, vBufferDesc_1_0.size() - 1);
143 virtualCamera->doneWithFrame(vBufferDesc_1_0[whichBuffer]);
144 }
145 break;
146 }
147 case EVS_FUZZ_STOP_VIDEO_STREAM: {
148 LOG(DEBUG) << "EVS_FUZZ_STOP_VIDEO_STREAM";
149 virtualCamera->stopVideoStream();
150 videoStarted = false;
151 break;
152 }
153 case EVS_FUZZ_GET_EXTENDED_INFO: {
154 LOG(DEBUG) << "EVS_FUZZ_GET_EXTENDED_INFO";
155 uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
156 virtualCamera->getExtendedInfo(opaqueIdentifier);
157 break;
158 }
159 case EVS_FUZZ_SET_EXTENDED_INFO: {
160 LOG(DEBUG) << "EVS_FUZZ_SET_EXTENDED_INFO";
161 uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
162 int32_t opaqueValue = fdp.ConsumeIntegral<int32_t>();
163 virtualCamera->setExtendedInfo(opaqueIdentifier, opaqueValue);
164 break;
165 }
166 case EVS_FUZZ_GET_CAMERA_INFO_1_1: {
167 LOG(DEBUG) << "EVS_FUZZ_GET_CAMERA_INFO_1_1";
168 virtualCamera->getCameraInfo_1_1([](CameraDesc desc) {});
169 break;
170 }
171 case EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO: {
172 LOG(DEBUG) << "EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO";
173 hidl_string deviceId("");
174 virtualCamera->getPhysicalCameraInfo(deviceId, [](const CameraDesc& info) {});
175 break;
176 }
177 case EVS_FUZZ_DONE_WITH_FRAME_1_1: {
178 LOG(DEBUG) << "EVS_FUZZ_DONE_WITH_FRAME_1_1";
179 if (!vBufferDesc_1_1.empty()) {
180 hidl_vec<BufferDesc_1_1> buffers(vBufferDesc_1_1);
181 virtualCamera->doneWithFrame_1_1(buffers);
182 }
183 break;
184 }
185 case EVS_FUZZ_PAUSE_VIDEO_STREAM: {
186 LOG(DEBUG) << "EVS_FUZZ_PAUSE_VIDEO_STREAM";
187 virtualCamera->pauseVideoStream();
188 break;
189 }
190 case EVS_FUZZ_RESUME_VIDEO_STREAM: {
191 LOG(DEBUG) << "EVS_FUZZ_RESUME_VIDEO_STREAM";
192 virtualCamera->resumeVideoStream();
193 break;
194 }
195 case EVS_FUZZ_SET_PRIMARY: {
196 LOG(DEBUG) << "EVS_FUZZ_SET_PRIMARY";
197 virtualCamera->setMaster();
198 break;
199 }
200 case EVS_FUZZ_FORCE_PRIMARY: {
201 LOG(DEBUG) << "EVS_FUZZ_FORCE_PRIMARY";
202 // TODO(161388489) skip this until we finished fuzzing evs display
203 break;
204 }
205 case EVS_FUZZ_UNSET_PRIMARY: {
206 LOG(DEBUG) << "EVS_FUZZ_UNSET_PRIMARY";
207 virtualCamera->unsetMaster();
208 break;
209 }
210 case EVS_FUZZ_GET_PARAMETER_LIST: {
211 LOG(DEBUG) << "EVS_FUZZ_GET_PARAMETER_LIST";
212 virtualCamera->getParameterList([](hidl_vec<CameraParam> cmdList) {});
213 break;
214 }
215 case EVS_FUZZ_GET_INT_PARAMETER_RANGE: {
216 LOG(DEBUG) << "EVS_FUZZ_GET_INT_PARAMETER_RANGE";
217 uint32_t whichParam =
218 fdp.ConsumeIntegralInRange<uint32_t>(0,
219 static_cast<uint32_t>(
220 CameraParam::ABSOLUTE_ZOOM));
221 virtualCamera->getIntParameterRange(static_cast<CameraParam>(whichParam),
222 [](int32_t val0, int32_t val1, int32_t val2) {
223 });
224 break;
225 }
226 case EVS_FUZZ_SET_PARAMETER: {
227 LOG(DEBUG) << "EVS_FUZZ_SET_PARAMETER";
228 uint32_t whichParam =
229 fdp.ConsumeIntegralInRange<uint32_t>(0,
230 static_cast<uint32_t>(
231 CameraParam::ABSOLUTE_ZOOM));
232 int32_t val = fdp.ConsumeIntegral<int32_t>();
233 virtualCamera->setIntParameter(static_cast<CameraParam>(whichParam), val,
234 [](auto status, auto effectiveValues) {});
235 break;
236 }
237 case EVS_FUZZ_GET_PARAMETER: {
238 LOG(DEBUG) << "EVS_FUZZ_GET_PARAMETER";
239 uint32_t whichParam =
240 fdp.ConsumeIntegralInRange<uint32_t>(0,
241 static_cast<uint32_t>(
242 CameraParam::ABSOLUTE_ZOOM));
243 virtualCamera->getIntParameter(static_cast<CameraParam>(whichParam),
244 [](auto status, auto effectiveValues) {});
245 break;
246 }
247 case EVS_FUZZ_SET_EXTENDED_INFO_1_1: {
248 LOG(DEBUG) << "EVS_FUZZ_SET_EXTENDED_INFO_1_1";
249 uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
250 uint8_t opaqueValue = fdp.ConsumeIntegral<uint8_t>();
251 vector<uint8_t> v;
252 v.push_back(opaqueValue);
253 hidl_vec<uint8_t> vec(v);
254 virtualCamera->setExtendedInfo_1_1(opaqueIdentifier, vec);
255 break;
256 }
257 case EVS_FUZZ_GET_EXTENDED_INFO_1_1: {
258 LOG(DEBUG) << "EVS_FUZZ_GET_EXTENDED_INFO_1_1";
259 uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
260 virtualCamera->getExtendedInfo_1_1(opaqueIdentifier,
261 [](const auto& result, const auto& data) {});
262 break;
263 }
264 case EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS: {
265 LOG(DEBUG) << "EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS";
266 if (!vBufferDesc_1_1.empty()) {
267 hidl_vec<BufferDesc_1_1> buffers(vBufferDesc_1_1);
268 virtualCamera->importExternalBuffers(buffers, [](auto _result, auto _delta) {});
269 }
270 break;
271 }
272 default:
273 LOG(ERROR) << "Unexpected option, aborting...";
274 break;
275 }
276 }
277
278 if (videoStarted) {
279 // TODO(b/161762538) if we do not stop video stream manually here,
280 // there will be crash at VirtualCamera.cpp::pHwCamera->unsetMaster(this);
281 virtualCamera->stopVideoStream();
282 }
283 return 0;
284 }
285
286 } // namespace
287 } // namespace implementation
288 } // namespace V1_1
289 } // namespace evs
290 } // namespace automotive
291 } // namespace android
292