1 /*
2 * Copyright 2023 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "Common.h"
18 #include "Enumerator.h"
19 #include "MockEvsHal.h"
20 #include "VirtualCamera.h"
21 #include "utils/include/Utils.h"
22
23 #include <fuzzer/FuzzedDataProvider.h>
24
25 #include <iostream>
26
27 namespace {
28
29 using aidl::android::automotive::evs::implementation::HalCamera;
30 using aidl::android::automotive::evs::implementation::initializeMockEvsHal;
31 using aidl::android::automotive::evs::implementation::MockEvsHal;
32 using aidl::android::automotive::evs::implementation::NiceMockEvsCamera;
33 using aidl::android::automotive::evs::implementation::openFirstCamera;
34 using aidl::android::automotive::evs::implementation::Utils;
35 using aidl::android::automotive::evs::implementation::VirtualCamera;
36 using aidl::android::hardware::automotive::evs::BufferDesc;
37 using aidl::android::hardware::automotive::evs::CameraDesc;
38 using aidl::android::hardware::automotive::evs::CameraParam;
39 using aidl::android::hardware::automotive::evs::EvsEventDesc;
40 using aidl::android::hardware::automotive::evs::EvsEventType;
41 using aidl::android::hardware::automotive::evs::IEvsCamera;
42 using aidl::android::hardware::automotive::evs::IEvsEnumerator;
43 using aidl::android::hardware::automotive::evs::ParameterRange;
44
45 enum EvsFuzzFuncs {
46 EVS_FUZZ_GET_ALLOWED_BUFFERS, // verify getAllowedBuffers
47 EVS_FUZZ_IS_STREAMING, // verify isStreaming
48 EVS_FUZZ_SET_DESCRIPTOR, // verify setDescriptor
49 EVS_FUZZ_GET_CAMERA_INFO, // verify getCameraInfo
50 EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT, // verify setMaxFramesInFlight
51 EVS_FUZZ_START_VIDEO_STREAM, // verify startVideoStream
52 EVS_FUZZ_STOP_VIDEO_STREAM, // verify stopVideoStream
53 EVS_FUZZ_GET_EXTENDED_INFO, // verify getExtendedInfo
54 EVS_FUZZ_SET_EXTENDED_INFO, // verify setExtendedInfo
55 EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO, // verify getPhysicalCameraInfo
56 EVS_FUZZ_PAUSE_VIDEO_STREAM, // verify pauseVideoStream
57 EVS_FUZZ_RESUME_VIDEO_STREAM, // verify resumeVideoStream
58 EVS_FUZZ_GET_PARAMETER_LIST, // verify getParameterList
59 EVS_FUZZ_GET_INT_PARAMETER_RANGE, // verify getIntParameterRange
60 EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS, // verify importExternalBuffers
61 EVS_FUZZ_BASE_ENUM // verify common functions
62 };
63
64 const int kMaxFuzzerConsumedBytes = 12;
65
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)66 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
67 FuzzedDataProvider fdp(data, size);
68
69 std::shared_ptr<MockEvsHal> mockEvsHal = initializeMockEvsHal();
70 EXPECT_NE(mockEvsHal, nullptr);
71
72 std::shared_ptr<IEvsCamera> mockHwCamera = openFirstCamera(mockEvsHal);
73 EXPECT_NE(mockHwCamera, nullptr);
74
75 std::shared_ptr<HalCamera> halCamera = ndk::SharedRefBase::make<HalCamera>(mockHwCamera);
76 EXPECT_NE(halCamera, nullptr);
77 std::shared_ptr<VirtualCamera> virtualCamera = halCamera->makeVirtualCamera();
78 EXPECT_NE(virtualCamera, nullptr);
79 std::vector<BufferDesc> buffers;
80
81 bool videoStarted = false;
82
83 while (fdp.remaining_bytes() > kMaxFuzzerConsumedBytes) {
84 switch (fdp.ConsumeIntegralInRange<uint32_t>(0, EVS_FUZZ_API_SUM)) {
85 case EVS_FUZZ_GET_ALLOWED_BUFFERS: {
86 LOG(DEBUG) << "EVS_FUZZ_GET_ALLOWED_BUFFERS";
87 virtualCamera->getAllowedBuffers();
88 break;
89 }
90 case EVS_FUZZ_IS_STREAMING: {
91 LOG(DEBUG) << "EVS_FUZZ_IS_STREAMING";
92 virtualCamera->isStreaming();
93 break;
94 }
95 case EVS_FUZZ_GET_HW_CAMERA: {
96 LOG(DEBUG) << "EVS_FUZZ_GET_HW_CAMERA";
97 virtualCamera->getHalCameras();
98 break;
99 }
100 case EVS_FUZZ_SET_DESCRIPTOR: {
101 LOG(DEBUG) << "EVS_FUZZ_SET_DESCRIPTOR";
102 CameraDesc* desc = new CameraDesc();
103 virtualCamera->setDescriptor(desc);
104 break;
105 }
106 case EVS_FUZZ_NOTIFY: {
107 LOG(DEBUG) << "EVS_FUZZ_NOTIFY";
108 if (videoStarted) {
109 EvsEventDesc event;
110 uint32_t type = fdp.ConsumeIntegralInRange<
111 uint32_t>(0, static_cast<uint32_t>(EvsEventType::STREAM_ERROR));
112 event.aType = static_cast<EvsEventType>(type);
113 virtualCamera->notify(event);
114 }
115 break;
116 }
117 case EVS_FUZZ_DELIVER_FRAME: {
118 LOG(DEBUG) << "EVS_FUZZ_DELIVER_FRAME";
119 BufferDesc buffer;
120 buffer.bufferId = fdp.ConsumeIntegral<int32_t>();
121 virtualCamera->deliverFrame(buffer);
122 buffers.emplace_back(std::move(buffer));
123 break;
124 }
125 case EVS_FUZZ_GET_CAMERA_INFO: {
126 LOG(DEBUG) << "EVS_FUZZ_GET_CAMERA_INFO";
127 CameraDesc desc;
128 virtualCamera->getCameraInfo(&desc);
129 break;
130 }
131 case EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT: {
132 LOG(DEBUG) << "EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT";
133 uint32_t delta = fdp.ConsumeIntegral<uint32_t>();
134 virtualCamera->setMaxFramesInFlight(delta);
135 break;
136 }
137 case EVS_FUZZ_START_VIDEO_STREAM: {
138 LOG(DEBUG) << "EVS_FUZZ_START_VIDEO_STREAM";
139 if (!videoStarted) {
140 std::shared_ptr<IEvsCamera> anotherMockHwCamera =
141 ndk::SharedRefBase::make<NiceMockEvsCamera>("another");
142 std::shared_ptr<HalCamera> anotherHalCamera =
143 ndk::SharedRefBase::make<HalCamera>(anotherMockHwCamera);
144 virtualCamera->startVideoStream(anotherHalCamera);
145 videoStarted = true;
146 }
147 break;
148 }
149 case EVS_FUZZ_DONE_WITH_FRAME: {
150 LOG(DEBUG) << "EVS_FUZZ_DONE_WITH_FRAME";
151 if (!buffers.empty()) {
152 uint32_t whichBuffer =
153 fdp.ConsumeIntegralInRange<uint32_t>(0, buffers.size() - 1);
154 std::vector<BufferDesc> buffersToReturn(1);
155 buffersToReturn.push_back(
156 Utils::dupBufferDesc(buffers[whichBuffer], /* doDup= */ true));
157 virtualCamera->doneWithFrame(buffersToReturn);
158 }
159 break;
160 }
161 case EVS_FUZZ_STOP_VIDEO_STREAM: {
162 LOG(DEBUG) << "EVS_FUZZ_STOP_VIDEO_STREAM";
163 virtualCamera->stopVideoStream();
164 videoStarted = false;
165 break;
166 }
167 case EVS_FUZZ_GET_EXTENDED_INFO: {
168 LOG(DEBUG) << "EVS_FUZZ_GET_EXTENDED_INFO";
169 uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
170 std::vector<uint8_t> value;
171 virtualCamera->getExtendedInfo(opaqueIdentifier, &value);
172 break;
173 }
174 case EVS_FUZZ_SET_EXTENDED_INFO: {
175 LOG(DEBUG) << "EVS_FUZZ_SET_EXTENDED_INFO";
176 uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
177 std::vector<uint8_t> value(sizeof(int32_t));
178 *reinterpret_cast<uint32_t*>(value.data()) = fdp.ConsumeIntegral<int32_t>();
179 virtualCamera->setExtendedInfo(opaqueIdentifier, value);
180 break;
181 }
182 case EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO: {
183 LOG(DEBUG) << "EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO";
184 std::string deviceId("");
185 CameraDesc desc;
186 virtualCamera->getPhysicalCameraInfo(deviceId, &desc);
187 break;
188 }
189 case EVS_FUZZ_PAUSE_VIDEO_STREAM: {
190 LOG(DEBUG) << "EVS_FUZZ_PAUSE_VIDEO_STREAM";
191 virtualCamera->pauseVideoStream();
192 break;
193 }
194 case EVS_FUZZ_RESUME_VIDEO_STREAM: {
195 LOG(DEBUG) << "EVS_FUZZ_RESUME_VIDEO_STREAM";
196 virtualCamera->resumeVideoStream();
197 break;
198 }
199 case EVS_FUZZ_SET_PRIMARY: {
200 LOG(DEBUG) << "EVS_FUZZ_SET_PRIMARY";
201 virtualCamera->setPrimaryClient();
202 break;
203 }
204 case EVS_FUZZ_FORCE_PRIMARY: {
205 LOG(DEBUG) << "EVS_FUZZ_FORCE_PRIMARY";
206 // TODO(161388489) skip this until we finished fuzzing evs display
207 break;
208 }
209 case EVS_FUZZ_UNSET_PRIMARY: {
210 LOG(DEBUG) << "EVS_FUZZ_UNSET_PRIMARY";
211 virtualCamera->unsetPrimaryClient();
212 break;
213 }
214 case EVS_FUZZ_GET_PARAMETER_LIST: {
215 LOG(DEBUG) << "EVS_FUZZ_GET_PARAMETER_LIST";
216 std::vector<CameraParam> list;
217 virtualCamera->getParameterList(&list);
218 break;
219 }
220 case EVS_FUZZ_GET_INT_PARAMETER_RANGE: {
221 LOG(DEBUG) << "EVS_FUZZ_GET_INT_PARAMETER_RANGE";
222 uint32_t whichParam =
223 fdp.ConsumeIntegralInRange<uint32_t>(0,
224 static_cast<uint32_t>(
225 CameraParam::ABSOLUTE_ZOOM));
226 ParameterRange range;
227 virtualCamera->getIntParameterRange(static_cast<CameraParam>(whichParam), &range);
228 break;
229 }
230 case EVS_FUZZ_SET_PARAMETER: {
231 LOG(DEBUG) << "EVS_FUZZ_SET_PARAMETER";
232 uint32_t whichParam =
233 fdp.ConsumeIntegralInRange<uint32_t>(0,
234 static_cast<uint32_t>(
235 CameraParam::ABSOLUTE_ZOOM));
236 int32_t val = fdp.ConsumeIntegral<int32_t>();
237 std::vector<int32_t> effectiveValue;
238 virtualCamera->setIntParameter(static_cast<CameraParam>(whichParam), val,
239 &effectiveValue);
240 break;
241 }
242 case EVS_FUZZ_GET_PARAMETER: {
243 LOG(DEBUG) << "EVS_FUZZ_GET_PARAMETER";
244 uint32_t whichParam =
245 fdp.ConsumeIntegralInRange<uint32_t>(0,
246 static_cast<uint32_t>(
247 CameraParam::ABSOLUTE_ZOOM));
248 std::vector<int32_t> effectiveValue;
249 virtualCamera->getIntParameter(static_cast<CameraParam>(whichParam),
250 &effectiveValue);
251 break;
252 }
253 case EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS: {
254 LOG(DEBUG) << "EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS";
255 if (!buffers.empty()) {
256 int32_t delta = 0;
257 virtualCamera->importExternalBuffers(buffers, &delta);
258 }
259 break;
260 }
261 default:
262 LOG(ERROR) << "Unexpected option, aborting...";
263 break;
264 }
265 }
266
267 if (videoStarted) {
268 // TODO(b/161762538) if we do not stop video stream manually here,
269 // there will be crash at VirtualCamera.cpp::pHwCamera->unsetMaster(this);
270 virtualCamera->stopVideoStream();
271 }
272 return 0;
273 }
274
275 } // namespace
276