1 /*
2 * Copyright (c) 2021-2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "camera_device_fuzzer.h"
17 #include "camera.h"
18 #include "v1_1/icamera_device.h"
19
20 namespace OHOS {
21 const size_t THRESHOLD = 10;
22
23 enum DeviceCmdId {
24 CAMERA_DEVICE_GET_DEFAULT_SETTINGS,
25 CAMERA_DEVICE_GET_STREAM_V1_1,
26 CAMERA_DEVICE_GET_STREAM,
27 CAMERA_DEVICE_UPDATE_SETTINGS,
28 CAMERA_DEVICE_SET_RESULT_MODE,
29 CAMERA_DEVICE_GET_ENABLED_RESULTS,
30 CAMERA_DEVICE_ENABLE_RESULT,
31 CAMERA_DEVICE_DISABLE_RESULT,
32 };
33
34 enum BitOperat {
35 INDEX_0 = 0,
36 INDEX_1,
37 INDEX_2,
38 INDEX_3,
39 MOVE_EIGHT_BITS = 8,
40 MOVE_SIXTEEN_BITS = 16,
41 MOVE_TWENTY_FOUR_BITS = 24,
42 };
43
ConvertUint32(const uint8_t * bitOperat)44 static uint32_t ConvertUint32(const uint8_t *bitOperat)
45 {
46 if (bitOperat == nullptr) {
47 return 0;
48 }
49
50 return (bitOperat[INDEX_0] << MOVE_TWENTY_FOUR_BITS) | (bitOperat[INDEX_1] << MOVE_SIXTEEN_BITS) |
51 (bitOperat[INDEX_2] << MOVE_EIGHT_BITS) | (bitOperat[INDEX_3]);
52 }
53
DeviceFuncSwitch(uint32_t cmd,const uint8_t * & rawData)54 static void DeviceFuncSwitch(uint32_t cmd, const uint8_t *&rawData)
55 {
56 CAMERA_LOGI("DeviceFuncSwitch start, the cmd is:%{public}u", cmd);
57 switch (cmd) {
58 case CAMERA_DEVICE_GET_DEFAULT_SETTINGS: {
59 std::vector<uint8_t> abilityVec = {};
60 uint8_t *data = const_cast<uint8_t *>(rawData);
61 abilityVec.push_back(*data);
62 cameraTest->cameraDeviceV1_1->GetDefaultSettings(abilityVec);
63 break;
64 }
65 case CAMERA_DEVICE_GET_STREAM_V1_1: {
66 sptr<HDI::Camera::V1_1::IStreamOperator> g_StreamOperator = nullptr;
67 const sptr<HDI::Camera::V1_0::IStreamOperatorCallback> callback =
68 const_cast<HDI::Camera::V1_0::IStreamOperatorCallback *>(
69 reinterpret_cast<const HDI::Camera::V1_0::IStreamOperatorCallback *>(rawData));
70
71 cameraTest->cameraDeviceV1_1->GetStreamOperator_V1_1(callback, g_StreamOperator);
72 break;
73 }
74 case CAMERA_DEVICE_GET_STREAM: {
75 sptr<HDI::Camera::V1_0::IStreamOperator> g_StreamOperator = nullptr;
76 const sptr<HDI::Camera::V1_0::IStreamOperatorCallback> callback =
77 const_cast<HDI::Camera::V1_0::IStreamOperatorCallback *>(
78 reinterpret_cast<const HDI::Camera::V1_0::IStreamOperatorCallback *>(rawData));
79
80 cameraTest->cameraDeviceV1_1->GetStreamOperator(callback, g_StreamOperator);
81 break;
82 }
83 case CAMERA_DEVICE_UPDATE_SETTINGS: {
84 std::vector<uint8_t> abilityVec = {};
85 uint8_t *data = const_cast<uint8_t *>(rawData);
86 abilityVec.push_back(*data);
87 cameraTest->cameraDeviceV1_1->UpdateSettings(abilityVec);
88 break;
89 }
90 case CAMERA_DEVICE_SET_RESULT_MODE: {
91 cameraTest->cameraDeviceV1_1->SetResultMode(
92 *reinterpret_cast<const HDI::Camera::V1_0::ResultCallbackMode *>(rawData));
93 break;
94 }
95 case CAMERA_DEVICE_GET_ENABLED_RESULTS: {
96 std::vector<int32_t> result = {};
97 int32_t *data = const_cast<int32_t *>(reinterpret_cast<const int32_t *>(rawData));
98 result.push_back(*data);
99 cameraTest->cameraDeviceV1_1->GetEnabledResults(result);
100 break;
101 }
102 case CAMERA_DEVICE_ENABLE_RESULT: {
103 std::vector<int32_t> result = {};
104 int32_t *data = const_cast<int32_t *>(reinterpret_cast<const int32_t *>(rawData));
105 result.push_back(*data);
106 cameraTest->cameraDeviceV1_1->EnableResult(result);
107 break;
108 }
109 case CAMERA_DEVICE_DISABLE_RESULT: {
110 std::vector<int32_t> result = {};
111 int32_t *data = const_cast<int32_t *>(reinterpret_cast<const int32_t *>(rawData));
112 result.push_back(*data);
113 cameraTest->cameraDeviceV1_1->DisableResult(result);
114 break;
115 }
116 default: {
117 CAMERA_LOGW("The interfaces is not tested, the cmd is:%{public}u", cmd);
118 return;
119 }
120 }
121 }
122
DoSomethingInterestingWithMyApi(const uint8_t * rawData,size_t size)123 bool DoSomethingInterestingWithMyApi(const uint8_t *rawData, size_t size)
124 {
125 (void)size;
126 if (rawData == nullptr) {
127 return false;
128 }
129
130 uint32_t cmd = ConvertUint32(rawData);
131 rawData += sizeof(cmd);
132
133 cameraTest = std::make_shared<OHOS::Camera::CameraManager>();
134 cameraTest->Init();
135 if (cameraTest->serviceV1_1 == nullptr) {
136 return false;
137 }
138 cameraTest->Open();
139 if (cameraTest->cameraDeviceV1_1 == nullptr) {
140 return false;
141 }
142
143 DeviceFuncSwitch(cmd, rawData);
144 cameraTest->Close();
145 return true;
146 }
147
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)148 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
149 {
150 if (size < OHOS::THRESHOLD) {
151 CAMERA_LOGW("Fuzz test input is invalid. The size is smaller than %{public}d", OHOS::THRESHOLD);
152 return 0;
153 }
154
155 OHOS::DoSomethingInterestingWithMyApi(data, size);
156 return 0;
157 }
158 } // namespace OHOS
159