1 /*
2 * Copyright (C) 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <CameraSessionStats.h>
18 #include <binder/Parcel.h>
19 #include <fuzzer/FuzzedDataProvider.h>
20 #include <camera/StringUtils.h>
21 #include "camera2common.h"
22
23 using namespace std;
24 using namespace android;
25 using namespace android::hardware;
26
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)27 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
28 FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
29 CameraStreamStats* cameraStreamStats = nullptr;
30 Parcel parcelCamStreamStats;
31
32 if (fdp.ConsumeBool()) {
33 cameraStreamStats = new CameraStreamStats();
34 } else {
35 int32_t width = fdp.ConsumeIntegral<int32_t>();
36 if (fdp.ConsumeBool()) {
37 parcelCamStreamStats.writeInt32(width);
38 }
39 int32_t height = fdp.ConsumeIntegral<int32_t>();
40 if (fdp.ConsumeBool()) {
41 parcelCamStreamStats.writeInt32(height);
42 }
43 int32_t format = fdp.ConsumeIntegral<int32_t>();
44 if (fdp.ConsumeBool()) {
45 parcelCamStreamStats.writeInt32(format);
46 }
47 float maxPreviewFps = fdp.ConsumeFloatingPoint<float>();
48 if (fdp.ConsumeBool()) {
49 parcelCamStreamStats.writeFloat(maxPreviewFps);
50 }
51 int32_t dataSpace = fdp.ConsumeIntegral<int32_t>();
52 if (fdp.ConsumeBool()) {
53 parcelCamStreamStats.writeInt32(dataSpace);
54 }
55 int64_t usage = fdp.ConsumeIntegral<int64_t>();
56 if (fdp.ConsumeBool()) {
57 parcelCamStreamStats.writeInt64(usage);
58 }
59 int64_t requestCount = fdp.ConsumeIntegral<int64_t>();
60 if (fdp.ConsumeBool()) {
61 parcelCamStreamStats.writeInt64(requestCount);
62 }
63 int64_t errorCount = fdp.ConsumeIntegral<int64_t>();
64 if (fdp.ConsumeBool()) {
65 parcelCamStreamStats.writeInt64(errorCount);
66 }
67 int32_t maxHalBuffers = fdp.ConsumeIntegral<int32_t>();
68 if (fdp.ConsumeBool()) {
69 parcelCamStreamStats.writeInt32(maxHalBuffers);
70 }
71 int32_t maxAppBuffers = fdp.ConsumeIntegral<int32_t>();
72 if (fdp.ConsumeBool()) {
73 parcelCamStreamStats.writeInt32(maxAppBuffers);
74 }
75 int32_t dynamicRangeProfile = fdp.ConsumeIntegral<int32_t>();
76 if (fdp.ConsumeBool()) {
77 parcelCamStreamStats.writeInt32(dynamicRangeProfile);
78 }
79 int32_t streamUseCase = fdp.ConsumeIntegral<int32_t>();
80 if (fdp.ConsumeBool()) {
81 parcelCamStreamStats.writeInt32(streamUseCase);
82 }
83 int32_t colorSpace = fdp.ConsumeIntegral<int32_t>();
84 if (fdp.ConsumeBool()) {
85 parcelCamStreamStats.writeInt32(colorSpace);
86 }
87
88 cameraStreamStats = new CameraStreamStats(width, height, format, maxPreviewFps, dataSpace,
89 usage, maxHalBuffers, maxAppBuffers,
90 dynamicRangeProfile, streamUseCase, colorSpace);
91 }
92
93 parcelCamStreamStats.setDataPosition(0);
94 cameraStreamStats->readFromParcel(&parcelCamStreamStats);
95 invokeReadWriteNullParcel<CameraStreamStats>(cameraStreamStats);
96 invokeReadWriteParcel<CameraStreamStats>(cameraStreamStats);
97
98 CameraSessionStats* cameraSessionStats = nullptr;
99 Parcel parcelCamSessionStats;
100
101 if (fdp.ConsumeBool()) {
102 cameraSessionStats = new CameraSessionStats();
103 } else {
104 string cameraId = fdp.ConsumeRandomLengthString();
105 if (fdp.ConsumeBool()) {
106 parcelCamSessionStats.writeString16(toString16(cameraId));
107 }
108 int32_t facing = fdp.ConsumeIntegral<int32_t>();
109 if (fdp.ConsumeBool()) {
110 parcelCamSessionStats.writeInt32(facing);
111 }
112 int32_t newCameraState = fdp.ConsumeIntegral<int32_t>();
113 if (fdp.ConsumeBool()) {
114 parcelCamSessionStats.writeInt32(newCameraState);
115 }
116 string clientName = fdp.ConsumeRandomLengthString();
117 if (fdp.ConsumeBool()) {
118 parcelCamSessionStats.writeString16(toString16(clientName));
119 }
120 int32_t apiLevel = fdp.ConsumeIntegral<int32_t>();
121 if (fdp.ConsumeBool()) {
122 parcelCamSessionStats.writeInt32(apiLevel);
123 }
124 bool isNdk = fdp.ConsumeBool();
125 if (fdp.ConsumeBool()) {
126 parcelCamSessionStats.writeBool(isNdk);
127 }
128 int32_t latencyMs = fdp.ConsumeIntegral<int32_t>();
129 if (fdp.ConsumeBool()) {
130 parcelCamSessionStats.writeInt32(latencyMs);
131 }
132
133 int64_t logId = fdp.ConsumeIntegral<int64_t>();
134 if (fdp.ConsumeBool()) {
135 parcelCamSessionStats.writeInt64(logId);
136 }
137
138 cameraSessionStats = new CameraSessionStats(cameraId, facing, newCameraState, clientName,
139 apiLevel, isNdk, latencyMs, logId);
140 }
141
142 if (fdp.ConsumeBool()) {
143 int32_t internalReconfigure = fdp.ConsumeIntegral<int32_t>();
144 parcelCamSessionStats.writeInt32(internalReconfigure);
145 }
146
147 if (fdp.ConsumeBool()) {
148 int64_t requestCount = fdp.ConsumeIntegral<int64_t>();
149 parcelCamSessionStats.writeInt64(requestCount);
150 }
151
152 if (fdp.ConsumeBool()) {
153 int64_t resultErrorCount = fdp.ConsumeIntegral<int64_t>();
154 parcelCamSessionStats.writeInt64(resultErrorCount);
155 }
156
157 if (fdp.ConsumeBool()) {
158 bool deviceError = fdp.ConsumeBool();
159 parcelCamSessionStats.writeBool(deviceError);
160 }
161
162 parcelCamSessionStats.setDataPosition(0);
163 cameraSessionStats->readFromParcel(&parcelCamSessionStats);
164 invokeReadWriteNullParcel<CameraSessionStats>(cameraSessionStats);
165 invokeReadWriteParcel<CameraSessionStats>(cameraSessionStats);
166
167 delete cameraStreamStats;
168 delete cameraSessionStats;
169 return 0;
170 }
171