README.md
1# Fuzzers for libcamera_client
2
3## Plugin Design Considerations
4The fuzzer plugins for libcamera_client are designed based on the understanding of the
5source code and try to achieve the following:
6
7##### Maximize code coverage
8The configuration parameters are not hardcoded, but instead selected based on
9incoming data. This ensures more code paths are reached by the fuzzers.
10
11libcamera_client supports the following parameters:
121. Command (parameter name: `cmd`)
132. Video Buffer Mode (parameter name: `videoBufferMode`)
143. Preview Callback Flag (parameter name: `previewCallbackFlag`)
154. Facing (parameter name: `facing`)
165. Orientation (parameter name: `orientation`)
176. Format (parameter name: `format`)
18
19| Parameter| Valid Values| Configured Value|
20|------------- |-------------| ----- |
21| `cmd` | 0.`CAMERA_CMD_START_SMOOTH_ZOOM` 1.`CAMERA_CMD_STOP_SMOOTH_ZOOM` 3.`CAMERA_CMD_SET_DISPLAY_ORIENTATION` 4.`CAMERA_CMD_ENABLE_SHUTTER_SOUND` 5.`CAMERA_CMD_PLAY_RECORDING_SOUND` 6.`CAMERA_CMD_START_FACE_DETECTION` 7.`CAMERA_CMD_STOP_FACE_DETECTION` 8.`CAMERA_CMD_ENABLE_FOCUS_MOVE_MSG` 9.`CAMERA_CMD_PING` 10.`CAMERA_CMD_SET_VIDEO_BUFFER_COUNT` 11.`CAMERA_CMD_SET_VIDEO_FORMAT`| Value obtained from FuzzedDataProvider|
22| `videoBufferMode` |0. `ICamera::VIDEO_BUFFER_MODE_DATA_CALLBACK_YUV` 1.`ICamera::VIDEO_BUFFER_MODE_DATA_CALLBACK_METADATA` 2.`ICamera::VIDEO_BUFFER_MODE_BUFFER_QUEUE`| Value obtained from FuzzedDataProvider|
23| `previewCallbackFlag` | 0. `CAMERA_FRAME_CALLBACK_FLAG_ENABLE_MASK` 1.`CAMERA_FRAME_CALLBACK_FLAG_ONE_SHOT_MASK` 2.`CAMERA_FRAME_CALLBACK_FLAG_COPY_OUT_MASK` 3.`CAMERA_FRAME_CALLBACK_FLAG_NOOP` 4.`CAMERA_FRAME_CALLBACK_FLAG_CAMCORDER` 5.`CAMERA_FRAME_CALLBACK_FLAG_CAMERA` 6.`CAMERA_FRAME_CALLBACK_FLAG_BARCODE_SCANNER`| Value obtained from FuzzedDataProvider|
24| `facing` | 0.`android::hardware::CAMERA_FACING_BACK` 1.`android::hardware::CAMERA_FACING_FRONT`| Value obtained from FuzzedDataProvider|
25| `orientation` | 0.`0` 1.`90` 2.`180`3.`270`| Value obtained from FuzzedDataProvider|
26| `format` | 0.`CameraParameters::PIXEL_FORMAT_YUV422SP` 1.`CameraParameters::PIXEL_FORMAT_YUV420SP` 2.`CameraParameters::PIXEL_FORMAT_YUV422I` 3.`CameraParameters::PIXEL_FORMAT_YUV420P` 4.`CameraParameters::PIXEL_FORMAT_RGB565` 5.`CameraParameters::PIXEL_FORMAT_RGBA8888` 6.`CameraParameters::PIXEL_FORMAT_JPEG` 7.`CameraParameters::PIXEL_FORMAT_BAYER_RGGB` 8.`CameraParameters::PIXEL_FORMAT_ANDROID_OPAQUE`| Value obtained from FuzzedDataProvider|
27
28This also ensures that the plugins are always deterministic for any given input.
29
30##### Maximize utilization of input data
31The plugins feed the entire input data to the module.
32This ensures that the plugins tolerate any kind of input (empty, huge,
33malformed, etc) and dont `exit()` on any input and thereby increasing the
34chance of identifying vulnerabilities.
35
36## Build
37
38This describes steps to build camera_fuzzer, camera2CaptureRequest_fuzzer, camera2ConcurrentCamera_fuzzer, camera2SubmitInfo_fuzzer, camera2SessionConfiguration_fuzzer, camera2OutputConfiguration_fuzzer, vendorTagDescriptor_fuzzer, cameraParameters_fuzzer, cameraSessionStats_fuzzer and captureResult_fuzzer binaries
39
40### Android
41
42#### Steps to build
43Build the fuzzer
44```
45 $ mm -j$(nproc) camera_fuzzer
46 $ mm -j$(nproc) camera_c2CaptureRequest_fuzzer
47 $ mm -j$(nproc) camera_c2ConcurrentCamera_fuzzer
48 $ mm -j$(nproc) camera_c2SubmitInfo_fuzzer
49 $ mm -j$(nproc) camera_c2SessionConfiguration_fuzzer
50 $ mm -j$(nproc) camera_c2OutputConfiguration_fuzzer
51 $ mm -j$(nproc) camera_vendorTagDescriptor_fuzzer
52 $ mm -j$(nproc) camera_Parameters_fuzzer
53 $ mm -j$(nproc) camera_SessionStats_fuzzer
54 $ mm -j$(nproc) camera_captureResult_fuzzer
55```
56#### Steps to run
57To run on device
58```
59 $ adb sync data
60 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_fuzzer/camera_fuzzer
61 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2CaptureRequest_fuzzer/camera_c2CaptureRequest_fuzzer
62 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2ConcurrentCamera_fuzzer/camera_c2ConcurrentCamera_fuzzer
63 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2SubmitInfo_fuzzer/camera_c2SubmitInfo_fuzzer
64 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2SessionConfiguration_fuzzer/camera_c2SessionConfiguration_fuzzer
65 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2OutputConfiguration_fuzzer/camera_c2OutputConfiguration_fuzzer
66 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_vendorTagDescriptor_fuzzer/camera_vendorTagDescriptor_fuzzer
67 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_Parameters_fuzzer/camera_Parameters_fuzzer
68 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_SessionStats_fuzzer/camera_SessionStats_fuzzer
69 $ adb shell /data/fuzz/${TARGET_ARCH}/camera_captureResult_fuzzer/camera_captureResult_fuzzer
70```
71
72## References:
73 * http://llvm.org/docs/LibFuzzer.html
74 * https://github.com/google/oss-fuzz
75