1 /*
2 * Copyright 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 #include <gui/BufferQueueConsumer.h>
17 #include <gui/BufferQueueCore.h>
18 #include <gui/BufferQueueProducer.h>
19 #include <gui/GLConsumer.h>
20 #include <libgui_fuzzer_utils.h>
21
22 using namespace android;
23
24 constexpr int32_t kMinBuffer = 0;
25 constexpr int32_t kMaxBuffer = 100000;
26
27 class ConsumerFuzzer {
28 public:
ConsumerFuzzer(const uint8_t * data,size_t size)29 ConsumerFuzzer(const uint8_t* data, size_t size) : mFdp(data, size){};
30 void process();
31
32 private:
33 FuzzedDataProvider mFdp;
34 };
35
process()36 void ConsumerFuzzer::process() {
37 sp<BufferQueueCore> core(new BufferQueueCore());
38 sp<IGraphicBufferConsumer> consumer(new BufferQueueConsumer(core));
39
40 uint64_t maxBuffers = mFdp.ConsumeIntegralInRange<uint64_t>(kMinBuffer, kMaxBuffer);
41 sp<CpuConsumer> cpu(
42 new CpuConsumer(consumer, maxBuffers, mFdp.ConsumeBool() /*controlledByApp*/));
43 CpuConsumer::LockedBuffer lockBuffer;
44 cpu->lockNextBuffer(&lockBuffer);
45 cpu->unlockBuffer(lockBuffer);
46 cpu->abandon();
47
48 uint32_t tex = mFdp.ConsumeIntegral<uint32_t>();
49 sp<GLConsumer> glComsumer(new GLConsumer(consumer, tex, GLConsumer::TEXTURE_EXTERNAL,
50 mFdp.ConsumeBool() /*useFenceSync*/,
51 mFdp.ConsumeBool() /*isControlledByApp*/));
52 sp<Fence> releaseFence = new Fence(memfd_create("rfd", MFD_ALLOW_SEALING));
53 glComsumer->setReleaseFence(releaseFence);
54 glComsumer->updateTexImage();
55 glComsumer->releaseTexImage();
56
57 sp<GraphicBuffer> buffer =
58 new GraphicBuffer(mFdp.ConsumeIntegral<uint32_t>(), mFdp.ConsumeIntegral<uint32_t>(),
59 mFdp.ConsumeIntegral<int32_t>(), mFdp.ConsumeIntegral<uint32_t>(),
60 mFdp.ConsumeIntegral<uint64_t>());
61 float mtx[16];
62 glComsumer->getTransformMatrix(mtx);
63 glComsumer->computeTransformMatrix(mtx, buffer, getRect(&mFdp),
64 mFdp.ConsumeIntegral<uint32_t>(),
65 mFdp.ConsumeBool() /*filtering*/);
66 glComsumer->scaleDownCrop(getRect(&mFdp), mFdp.ConsumeIntegral<uint32_t>(),
67 mFdp.ConsumeIntegral<uint32_t>());
68
69 glComsumer->setDefaultBufferSize(mFdp.ConsumeIntegral<uint32_t>(),
70 mFdp.ConsumeIntegral<uint32_t>());
71 glComsumer->setFilteringEnabled(mFdp.ConsumeBool() /*enabled*/);
72
73 glComsumer->setConsumerUsageBits(mFdp.ConsumeIntegral<uint64_t>());
74 glComsumer->attachToContext(tex);
75 glComsumer->abandon();
76 }
77
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)78 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
79 ConsumerFuzzer consumerFuzzer(data, size);
80 consumerFuzzer.process();
81 return 0;
82 }
83