1 /*
2 * Copyright (C) 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <CameraSessionStats.h>
18 #include <binder/Parcel.h>
19 #include <fuzzer/FuzzedDataProvider.h>
20 #include "camera2common.h"
21
22 using namespace std;
23 using namespace android;
24 using namespace android::hardware;
25
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)26 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
27 FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
28 CameraStreamStats* cameraStreamStats = nullptr;
29 Parcel parcelCamStreamStats;
30
31 if (fdp.ConsumeBool()) {
32 cameraStreamStats = new CameraStreamStats();
33 } else {
34 int32_t width = fdp.ConsumeIntegral<int32_t>();
35 if (fdp.ConsumeBool()) {
36 parcelCamStreamStats.writeInt32(width);
37 }
38 int32_t height = fdp.ConsumeIntegral<int32_t>();
39 if (fdp.ConsumeBool()) {
40 parcelCamStreamStats.writeInt32(height);
41 }
42 int32_t format = fdp.ConsumeIntegral<int32_t>();
43 if (fdp.ConsumeBool()) {
44 parcelCamStreamStats.writeInt32(format);
45 }
46 float maxPreviewFps = fdp.ConsumeFloatingPoint<float>();
47 if (fdp.ConsumeBool()) {
48 parcelCamStreamStats.writeFloat(maxPreviewFps);
49 }
50 int32_t dataSpace = fdp.ConsumeIntegral<int32_t>();
51 if (fdp.ConsumeBool()) {
52 parcelCamStreamStats.writeInt32(dataSpace);
53 }
54 int64_t usage = fdp.ConsumeIntegral<int64_t>();
55 if (fdp.ConsumeBool()) {
56 parcelCamStreamStats.writeInt64(usage);
57 }
58 int64_t requestCount = fdp.ConsumeIntegral<int64_t>();
59 if (fdp.ConsumeBool()) {
60 parcelCamStreamStats.writeInt64(requestCount);
61 }
62 int64_t errorCount = fdp.ConsumeIntegral<int64_t>();
63 if (fdp.ConsumeBool()) {
64 parcelCamStreamStats.writeInt64(errorCount);
65 }
66 int32_t maxHalBuffers = fdp.ConsumeIntegral<int32_t>();
67 if (fdp.ConsumeBool()) {
68 parcelCamStreamStats.writeInt32(maxHalBuffers);
69 }
70 int32_t maxAppBuffers = fdp.ConsumeIntegral<int32_t>();
71 if (fdp.ConsumeBool()) {
72 parcelCamStreamStats.writeInt32(maxAppBuffers);
73 }
74 int32_t dynamicRangeProfile = fdp.ConsumeIntegral<int32_t>();
75 if (fdp.ConsumeBool()) {
76 parcelCamStreamStats.writeInt32(dynamicRangeProfile);
77 }
78 int32_t streamUseCase = fdp.ConsumeIntegral<int32_t>();
79 if (fdp.ConsumeBool()) {
80 parcelCamStreamStats.writeInt32(streamUseCase);
81 }
82 int32_t colorSpace = fdp.ConsumeIntegral<int32_t>();
83 if (fdp.ConsumeBool()) {
84 parcelCamStreamStats.writeInt32(colorSpace);
85 }
86
87 cameraStreamStats = new CameraStreamStats(width, height, format, maxPreviewFps, dataSpace,
88 usage, maxHalBuffers, maxAppBuffers,
89 dynamicRangeProfile, streamUseCase, colorSpace);
90 }
91
92 parcelCamStreamStats.setDataPosition(0);
93 cameraStreamStats->readFromParcel(&parcelCamStreamStats);
94 invokeReadWriteNullParcel<CameraStreamStats>(cameraStreamStats);
95 invokeReadWriteParcel<CameraStreamStats>(cameraStreamStats);
96
97 CameraSessionStats* cameraSessionStats = nullptr;
98 Parcel parcelCamSessionStats;
99
100 if (fdp.ConsumeBool()) {
101 cameraSessionStats = new CameraSessionStats();
102 } else {
103 string camId = fdp.ConsumeRandomLengthString();
104 String16 cameraId(camId.c_str());
105 if (fdp.ConsumeBool()) {
106 parcelCamSessionStats.writeString16(cameraId);
107 }
108 int32_t facing = fdp.ConsumeIntegral<int32_t>();
109 if (fdp.ConsumeBool()) {
110 parcelCamSessionStats.writeInt32(facing);
111 }
112 int32_t newCameraState = fdp.ConsumeIntegral<int32_t>();
113 if (fdp.ConsumeBool()) {
114 parcelCamSessionStats.writeInt32(newCameraState);
115 }
116 string name = fdp.ConsumeRandomLengthString();
117 String16 clientName(name.c_str());
118 if (fdp.ConsumeBool()) {
119 parcelCamSessionStats.writeString16(clientName);
120 }
121 int32_t apiLevel = fdp.ConsumeIntegral<int32_t>();
122 if (fdp.ConsumeBool()) {
123 parcelCamSessionStats.writeInt32(apiLevel);
124 }
125 bool isNdk = fdp.ConsumeBool();
126 if (fdp.ConsumeBool()) {
127 parcelCamSessionStats.writeBool(isNdk);
128 }
129 int32_t latencyMs = fdp.ConsumeIntegral<int32_t>();
130 if (fdp.ConsumeBool()) {
131 parcelCamSessionStats.writeInt32(latencyMs);
132 }
133
134 int64_t logId = fdp.ConsumeIntegral<int64_t>();
135 if (fdp.ConsumeBool()) {
136 parcelCamSessionStats.writeInt64(logId);
137 }
138
139 cameraSessionStats = new CameraSessionStats(cameraId, facing, newCameraState, clientName,
140 apiLevel, isNdk, latencyMs, logId);
141 }
142
143 if (fdp.ConsumeBool()) {
144 int32_t internalReconfigure = fdp.ConsumeIntegral<int32_t>();
145 parcelCamSessionStats.writeInt32(internalReconfigure);
146 }
147
148 if (fdp.ConsumeBool()) {
149 int64_t requestCount = fdp.ConsumeIntegral<int64_t>();
150 parcelCamSessionStats.writeInt64(requestCount);
151 }
152
153 if (fdp.ConsumeBool()) {
154 int64_t resultErrorCount = fdp.ConsumeIntegral<int64_t>();
155 parcelCamSessionStats.writeInt64(resultErrorCount);
156 }
157
158 if (fdp.ConsumeBool()) {
159 bool deviceError = fdp.ConsumeBool();
160 parcelCamSessionStats.writeBool(deviceError);
161 }
162
163 parcelCamSessionStats.setDataPosition(0);
164 cameraSessionStats->readFromParcel(&parcelCamSessionStats);
165 invokeReadWriteNullParcel<CameraSessionStats>(cameraSessionStats);
166 invokeReadWriteParcel<CameraSessionStats>(cameraSessionStats);
167
168 delete cameraStreamStats;
169 delete cameraSessionStats;
170 return 0;
171 }
172