1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "surface_fuzzer.h"
17
18 #include <securec.h>
19
20 #include "iconsumer_surface.h"
21 #include "surface.h"
22 #include "surface_buffer.h"
23 #include "surface_buffer_impl.h"
24 #include "sync_fence.h"
25 #include <iostream>
26
27 namespace OHOS {
28 namespace {
29 const uint8_t* g_data = nullptr;
30 size_t g_size = 0;
31 size_t g_pos;
32 constexpr size_t STR_LEN = 10;
33 }
34
35 /*
36 * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T)
37 * tips: only support basic type
38 */
39 template<class T>
GetData()40 T GetData()
41 {
42 T object {};
43 size_t objectSize = sizeof(object);
44 if (g_data == nullptr || objectSize > g_size - g_pos) {
45 return object;
46 }
47 errno_t ret = memcpy_s(&object, objectSize, g_data + g_pos, objectSize);
48 if (ret != EOK) {
49 return {};
50 }
51 g_pos += objectSize;
52 return object;
53 }
54
55 /*
56 * get a string from g_data
57 */
GetStringFromData(int strlen)58 std::string GetStringFromData(int strlen)
59 {
60 char cstr[strlen];
61 cstr[strlen - 1] = '\0';
62 for (int i = 0; i < strlen - 1; i++) {
63 char tmp = GetData<char>();
64 if (tmp == '\0') {
65 tmp = '1';
66 }
67 cstr[i] = tmp;
68 }
69 std::string str(cstr);
70 return str;
71 }
72
SurfaceFuzzTest2()73 void SurfaceFuzzTest2()
74 {
75 // get data
76 std::string name = GetStringFromData(STR_LEN);
77 bool isShared = GetData<bool>();
78 std::string key = GetStringFromData(STR_LEN);
79 std::string val = GetStringFromData(STR_LEN);
80 BufferVerifyAllocInfo info = GetData<BufferVerifyAllocInfo>();
81 bool supported = GetData<bool>();
82 uint32_t sequence = GetData<uint32_t>();
83 ScalingMode scalingMode = GetData<ScalingMode>();
84 GraphicHDRMetaData metaData = GetData<GraphicHDRMetaData>();
85 GraphicHDRMetadataKey metakey = GetData<GraphicHDRMetadataKey>();
86 uint8_t metaData2 = GetData<uint8_t>();
87 HDRMetaDataType metaType = GetData<HDRMetaDataType>();
88 GraphicPresentTimestamp ptimestamp = GetData<GraphicPresentTimestamp>();
89 GraphicPresentTimestampType type = GetData<GraphicPresentTimestampType>();
90 int64_t time = GetData<int64_t>();
91 std::string result = GetStringFromData(STR_LEN);
92
93 std::vector<BufferVerifyAllocInfo> infos = {info};
94 std::vector<bool> supporteds = {supported};
95 std::vector<GraphicHDRMetaData> metaDatas = {metaData};
96 std::vector<uint8_t> metaDatas2 = {metaData2};
97
98 // test
99 sptr<OHOS::IConsumerSurface> cSurface = OHOS::IConsumerSurface::Create(name, isShared);
100 auto producer = cSurface->GetProducer();
101 sptr<OHOS::Surface> pSurface = OHOS::Surface::CreateSurfaceAsProducer(producer);
102
103 pSurface->SetUserData(key, val);
104 pSurface->IsSupportedAlloc(infos, supporteds);
105 pSurface->SetScalingMode(sequence, scalingMode);
106 pSurface->GetPresentTimestamp(sequence, type, time);
107 cSurface->SetUserData(key, val);
108
109 cSurface->SetScalingMode(sequence, scalingMode);
110 cSurface->GetScalingMode(sequence, scalingMode);
111 cSurface->SetMetaData(sequence, metaDatas);
112 cSurface->SetMetaDataSet(sequence, metakey, metaDatas2);
113 cSurface->QueryMetaDataType(sequence, metaType);
114 cSurface->GetMetaData(sequence, metaDatas);
115 cSurface->GetMetaDataSet(sequence, metakey, metaDatas2);
116 cSurface->SetPresentTimestamp(sequence, ptimestamp);
117 cSurface->Dump(result);
118 }
119
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)120 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
121 {
122 if (data == nullptr) {
123 return false;
124 }
125
126 // initialize
127 g_data = data;
128 g_size = size;
129 g_pos = 0;
130
131 // get data
132 std::string name = GetStringFromData(STR_LEN);
133 bool isShared = GetData<bool>();
134 BufferRequestConfig requestConfig = GetData<BufferRequestConfig>();
135 BufferFlushConfig flushConfig = GetData<BufferFlushConfig>();
136 int64_t timestamp = GetData<int64_t>();
137 Rect damage = GetData<Rect>();
138 uint32_t seqNum = GetData<uint32_t>();
139 uint32_t queueSize = GetData<uint32_t>();
140 int32_t width = GetData<int32_t>();
141 int32_t height = GetData<int32_t>();
142 uint32_t usage = GetData<uint32_t>();
143 GraphicTransformType transform = GetData<GraphicTransformType>();
144
145 // test
146 sptr<OHOS::IConsumerSurface> cSurface = OHOS::IConsumerSurface::Create(name, isShared);
147 auto producer = cSurface->GetProducer();
148 sptr<OHOS::Surface> pSurface = OHOS::Surface::CreateSurfaceAsProducer(producer);
149 sptr<OHOS::SurfaceBuffer> buffer = new SurfaceBufferImpl(seqNum);
150 sptr<SyncFence> syncFence = SyncFence::INVALID_FENCE;
151 int32_t fenceFd = syncFence->Get();
152
153 pSurface->RequestBuffer(buffer, fenceFd, requestConfig);
154 pSurface->CancelBuffer(buffer);
155 pSurface->FlushBuffer(buffer, fenceFd, flushConfig);
156 pSurface->AttachBuffer(buffer);
157 pSurface->DetachBuffer(buffer);
158 pSurface->SetQueueSize(queueSize);
159 pSurface->SetTransform(transform);
160
161 cSurface->AcquireBuffer(buffer, fenceFd, timestamp, damage);
162 cSurface->ReleaseBuffer(buffer, fenceFd);
163 cSurface->AttachBuffer(buffer);
164 cSurface->DetachBuffer(buffer);
165 cSurface->SetQueueSize(queueSize);
166 cSurface->SetDefaultWidthAndHeight(width, height);
167 cSurface->SetDefaultUsage(usage);
168 cSurface->SetTransform(transform);
169
170 SurfaceFuzzTest2();
171
172 return true;
173 }
174 } // namespace OHOS
175
176 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)177 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
178 {
179 /* Run your code on data */
180 OHOS::DoSomethingInterestingWithMyAPI(data, size);
181 return 0;
182 }
183
184