1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <fuzzer/FuzzedDataProvider.h>
18 #include <sys/time.h>
19 #include <iostream>
20 #include "Common.h"
21 #include "Enumerator.h"
22 #include "HalCamera.h"
23 #include "MockHWCamera.h"
24
25 namespace android {
26 namespace automotive {
27 namespace evs {
28 namespace V1_1 {
29 namespace implementation {
30
31 namespace {
32
33 enum EvsFuzzFuncs {
34 EVS_FUZZ_MAKE_VIRTUAL_CAMERA = 0, // verify makeVirtualCamera
35 EVS_FUZZ_OWN_VIRTUAL_CAMERA, // verify ownVirtualCamera
36 EVS_FUZZ_DISOWN_VIRTUAL_CAMERA, // verify disownVirtualCamera
37 EVS_FUZZ_GET_CLIENT_COUNT, // verify getClientCount
38 EVS_FUZZ_GET_ID, // verify getId
39 EVS_FUZZ_GET_STREAM_CONFIG, // verify getStreamConfig
40 EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT, // verify changeFramesInFlight
41 EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT_1, // verify overloaded changeFramesInFlight
42 EVS_FUZZ_REQUEST_NEW_FRAME, // verify requestNewFrame
43 EVS_FUZZ_CLIENT_STREAM_STARTING, // verify clientStreamStarting
44 EVS_FUZZ_CLIENT_STREAM_ENDING, // verify clientStreamEnding
45 EVS_FUZZ_GET_STATS, // verify getStats
46 EVS_FUZZ_GET_STREAM_CONFIGURATION, // verify getStreamConfiguration
47 EVS_FUZZ_DELIVER_FRAME_1_1, // verify deliverFrame_1_1
48 EVS_FUZZ_BASE_ENUM // verify common functions
49 };
50
getCurrentTimeStamp()51 int64_t getCurrentTimeStamp() {
52 struct timeval tp;
53 gettimeofday(&tp, NULL);
54 int64_t ms = tp.tv_sec * 1000 + tp.tv_usec / 1000;
55 return ms;
56 }
57
58 const int kMaxFuzzerConsumedBytes = 12;
59
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)60 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
61 FuzzedDataProvider fdp(data, size);
62 sp<IEvsCamera_1_1> mockHWCamera = new MockHWCamera();
63 sp<HalCamera> halCamera = new HalCamera(mockHWCamera);
64 std::vector<sp<VirtualCamera>> virtualCameras;
65 std::vector<BufferDesc_1_0> vBufferDesc_1_0;
66 std::vector<BufferDesc_1_1> vBufferDesc_1_1;
67
68 while (fdp.remaining_bytes() > kMaxFuzzerConsumedBytes) {
69 switch (fdp.ConsumeIntegralInRange<uint32_t>(0, EVS_FUZZ_API_SUM)) {
70 case EVS_FUZZ_MAKE_VIRTUAL_CAMERA: {
71 LOG(DEBUG) << "EVS_FUZZ_MAKE_VIRTUAL_CAMERA";
72 sp<VirtualCamera> virtualCamera = halCamera->makeVirtualCamera();
73 virtualCameras.emplace_back(virtualCamera);
74 break;
75 }
76 case EVS_FUZZ_OWN_VIRTUAL_CAMERA: {
77 LOG(DEBUG) << "EVS_FUZZ_OWN_VIRTUAL_CAMERA";
78 if (!virtualCameras.empty()) {
79 uint32_t whichCam =
80 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
81 halCamera->ownVirtualCamera(virtualCameras[whichCam]);
82 }
83 break;
84 }
85 case EVS_FUZZ_DISOWN_VIRTUAL_CAMERA: {
86 LOG(DEBUG) << "EVS_FUZZ_DISOWN_VIRTUAL_CAMERA";
87 if (!virtualCameras.empty()) {
88 uint32_t whichCam =
89 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
90 halCamera->disownVirtualCamera(virtualCameras[whichCam]);
91 }
92 break;
93 }
94 case EVS_FUZZ_GET_HW_CAMERA: {
95 LOG(DEBUG) << "EVS_FUZZ_GET_HW_CAMERA";
96 halCamera->getHwCamera();
97 break;
98 }
99 case EVS_FUZZ_GET_CLIENT_COUNT: {
100 LOG(DEBUG) << "EVS_FUZZ_GET_CLIENT_COUNT";
101 halCamera->getClientCount();
102 break;
103 }
104 case EVS_FUZZ_GET_ID: {
105 LOG(DEBUG) << "EVS_FUZZ_GET_ID";
106 halCamera->getId();
107 break;
108 }
109 case EVS_FUZZ_GET_STREAM_CONFIG: {
110 LOG(DEBUG) << "EVS_FUZZ_GET_STREAM_CONFIG";
111 halCamera->getStreamConfig();
112 break;
113 }
114 case EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT: {
115 LOG(DEBUG) << "EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT";
116 uint32_t delta = fdp.ConsumeIntegral<int32_t>();
117 halCamera->changeFramesInFlight(delta);
118 break;
119 }
120 case EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT_1: {
121 LOG(DEBUG) << "EVS_FUZZ_CHANGE_FRAMES_IN_FLIGHT_1";
122 hidl_vec<BufferDesc_1_1> buffers;
123 int32_t delta = 0;
124 halCamera->changeFramesInFlight(buffers, &delta);
125 break;
126 }
127 case EVS_FUZZ_REQUEST_NEW_FRAME: {
128 LOG(DEBUG) << "EVS_FUZZ_REQUEST_NEW_FRAME";
129 if (!virtualCameras.empty()) {
130 uint32_t whichCam =
131 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
132 halCamera->requestNewFrame(virtualCameras[whichCam], getCurrentTimeStamp());
133 }
134 break;
135 }
136 case EVS_FUZZ_CLIENT_STREAM_STARTING: {
137 LOG(DEBUG) << "EVS_FUZZ_CLIENT_STREAM_STARTING";
138 halCamera->clientStreamStarting();
139 break;
140 }
141 case EVS_FUZZ_CLIENT_STREAM_ENDING: {
142 LOG(DEBUG) << "EVS_FUZZ_CLIENT_STREAM_ENDING";
143 if (!virtualCameras.empty()) {
144 uint32_t whichCam =
145 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
146 halCamera->clientStreamEnding(virtualCameras[whichCam].get());
147 }
148 break;
149 }
150 case EVS_FUZZ_DONE_WITH_FRAME_1_0: {
151 LOG(DEBUG) << "EVS_FUZZ_DONE_WITH_FRAME_1_0";
152 if (!vBufferDesc_1_0.empty()) {
153 uint32_t whichBuffer =
154 fdp.ConsumeIntegralInRange<uint32_t>(0, vBufferDesc_1_0.size() - 1);
155 halCamera->doneWithFrame(vBufferDesc_1_0[whichBuffer]);
156 }
157 break;
158 }
159 case EVS_FUZZ_DONE_WITH_FRAME_1_1: {
160 LOG(DEBUG) << "EVS_FUZZ_DONE_WITH_FRAME_1_1";
161 if (!vBufferDesc_1_1.empty()) {
162 uint32_t whichBuffer =
163 fdp.ConsumeIntegralInRange<uint32_t>(0, vBufferDesc_1_1.size() - 1);
164 halCamera->doneWithFrame(vBufferDesc_1_1[whichBuffer]);
165 }
166 break;
167 }
168 case EVS_FUZZ_SET_PRIMARY: {
169 LOG(DEBUG) << "EVS_FUZZ_SET_PRIMARY";
170 if (!virtualCameras.empty()) {
171 uint32_t whichCam =
172 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
173 halCamera->setMaster(virtualCameras[whichCam]);
174 }
175 break;
176 }
177 case EVS_FUZZ_FORCE_PRIMARY: {
178 LOG(DEBUG) << "EVS_FUZZ_FORCE_PRIMARY";
179 if (!virtualCameras.empty()) {
180 uint32_t whichCam =
181 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
182 halCamera->forceMaster(virtualCameras[whichCam]);
183 }
184 break;
185 }
186 case EVS_FUZZ_UNSET_PRIMARY: {
187 LOG(DEBUG) << "EVS_FUZZ_UNSET_PRIMARY";
188 if (!virtualCameras.empty()) {
189 uint32_t whichCam =
190 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
191 halCamera->unsetMaster(virtualCameras[whichCam].get());
192 }
193 break;
194 }
195 case EVS_FUZZ_SET_PARAMETER: {
196 LOG(DEBUG) << "EVS_FUZZ_SET_PARAMETER";
197 if (!virtualCameras.empty()) {
198 uint32_t whichCam =
199 fdp.ConsumeIntegralInRange<uint32_t>(0, virtualCameras.size() - 1);
200 uint32_t whichParam = fdp.ConsumeIntegralInRange<
201 uint32_t>(0, static_cast<uint32_t>(CameraParam::ABSOLUTE_ZOOM));
202 int32_t value = fdp.ConsumeIntegral<int32_t>();
203 halCamera->setParameter(virtualCameras[whichCam],
204 static_cast<CameraParam>(whichParam), value);
205 }
206 break;
207 }
208 case EVS_FUZZ_GET_PARAMETER: {
209 LOG(DEBUG) << "EVS_FUZZ_GET_PARAMETER";
210 uint32_t whichParam =
211 fdp.ConsumeIntegralInRange<uint32_t>(0,
212 static_cast<uint32_t>(
213 CameraParam::ABSOLUTE_ZOOM));
214 int32_t value = fdp.ConsumeIntegral<int32_t>();
215 halCamera->getParameter(static_cast<CameraParam>(whichParam), value);
216 break;
217 }
218 case EVS_FUZZ_GET_STATS: {
219 LOG(DEBUG) << "EVS_FUZZ_GET_STATS";
220 halCamera->getStats();
221 break;
222 }
223 case EVS_FUZZ_GET_STREAM_CONFIGURATION: {
224 LOG(DEBUG) << "EVS_FUZZ_GET_STREAM_CONFIGURATION";
225 halCamera->getStreamConfiguration();
226 break;
227 }
228 case EVS_FUZZ_DELIVER_FRAME: {
229 LOG(DEBUG) << "EVS_FUZZ_DELIVER_FRAME";
230 BufferDesc_1_0 buffer;
231 buffer.bufferId = fdp.ConsumeIntegral<int32_t>();
232 halCamera->deliverFrame(buffer);
233 vBufferDesc_1_0.emplace_back(buffer);
234 break;
235 }
236 case EVS_FUZZ_DELIVER_FRAME_1_1: {
237 LOG(DEBUG) << "EVS_FUZZ_DELIVER_FRAME_1_1";
238 std::vector<BufferDesc_1_1> vec;
239 BufferDesc_1_1 buffer;
240 buffer.bufferId = fdp.ConsumeIntegral<int32_t>();
241 vec.push_back(buffer);
242 hardware::hidl_vec<BufferDesc_1_1> hidl_vec(vec);
243 halCamera->deliverFrame_1_1(hidl_vec);
244 vBufferDesc_1_1.emplace_back(buffer);
245 break;
246 }
247 case EVS_FUZZ_NOTIFY: {
248 LOG(DEBUG) << "EVS_FUZZ_NOTIFY";
249 EvsEventDesc event;
250 uint32_t type =
251 fdp.ConsumeIntegralInRange<uint32_t>(0,
252 static_cast<uint32_t>(
253 EvsEventType::STREAM_ERROR));
254 event.aType = static_cast<EvsEventType>(type);
255 // TODO(b/160824438) let's comment this for now because of the failure.
256 // If virtualCamera does not call startVideoStream, and notify(1) is called
257 // it will fail.
258 // halCamera->notify(event);
259 break;
260 }
261 default:
262 LOG(ERROR) << "Unexpected option, aborting...";
263 break;
264 }
265 }
266 return 0;
267 }
268
269 } // namespace
270 } // namespace implementation
271 } // namespace V1_1
272 } // namespace evs
273 } // namespace automotive
274 } // namespace android
275