1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "stream_metadata_stub_fuzzer.h"
17 #include "foundation/multimedia/camera_framework/common/utils/camera_log.h"
18 #include "hstream_metadata.h"
19 #include "nativetoken_kit.h"
20 #include "token_setproc.h"
21 #include "accesstoken_kit.h"
22 #include "camera_metadata_info.h"
23 #include "iconsumer_surface.h"
24 #include "metadata_utils.h"
25 #include "camera_service_ipc_interface_code.h"
26
27 namespace {
28
29 const int32_t LIMITSIZE = 2;
30 const size_t LIMITCOUNT = 4;
31 const int32_t PHOTO_FORMAT = 2000;
32 const uint32_t INVALID_CODE = 9999;
33 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IStreamCapture";
34
MakeMetadata(uint8_t * rawData,size_t size)35 std::shared_ptr<OHOS::Camera::CameraMetadata> MakeMetadata(uint8_t *rawData, size_t size)
36 {
37 int32_t itemCount = 10;
38 int32_t dataSize = 100;
39 int32_t *streams = reinterpret_cast<int32_t *>(rawData);
40 std::shared_ptr<OHOS::Camera::CameraMetadata> ability;
41 ability = std::make_shared<OHOS::Camera::CameraMetadata>(itemCount, dataSize);
42 ability->addEntry(OHOS_ABILITY_STREAM_AVAILABLE_EXTEND_CONFIGURATIONS, streams, size / LIMITCOUNT);
43 int32_t compensationRange[2] = {rawData[0], rawData[1]};
44 ability->addEntry(OHOS_CONTROL_AE_COMPENSATION_RANGE, compensationRange,
45 sizeof(compensationRange) / sizeof(compensationRange[0]));
46 float focalLength = rawData[0];
47 ability->addEntry(OHOS_ABILITY_FOCAL_LENGTH, &focalLength, 1);
48
49 int32_t sensorOrientation = rawData[0];
50 ability->addEntry(OHOS_SENSOR_ORIENTATION, &sensorOrientation, 1);
51
52 int32_t cameraPosition = rawData[0];
53 ability->addEntry(OHOS_ABILITY_CAMERA_POSITION, &cameraPosition, 1);
54
55 const camera_rational_t aeCompensationStep[] = {{rawData[0], rawData[1]}};
56 ability->addEntry(OHOS_CONTROL_AE_COMPENSATION_STEP, &aeCompensationStep,
57 sizeof(aeCompensationStep) / sizeof(aeCompensationStep[0]));
58 return ability;
59 }
60
61 }
62
63 namespace OHOS {
64 namespace CameraStandard {
65 namespace StreamMetadataStubFuzzer {
66
67 bool g_hasPermission = false;
68 HStreamMetadataStub *fuzz = nullptr;
69
CheckPermission()70 void CheckPermission()
71 {
72 if (!g_hasPermission) {
73 uint64_t tokenId;
74 const char *perms[0];
75 perms[0] = "ohos.permission.CAMERA";
76 NativeTokenInfoParams infoInstance = { .dcapsNum = 0, .permsNum = 1, .aclsNum = 0, .dcaps = NULL,
77 .perms = perms, .acls = NULL, .processName = "camera_capture", .aplStr = "system_basic",
78 };
79 tokenId = GetAccessTokenId(&infoInstance);
80 SetSelfTokenID(tokenId);
81 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
82 g_hasPermission = true;
83 }
84 }
85
Test(uint8_t * rawData,size_t size)86 void Test(uint8_t *rawData, size_t size)
87 {
88 if (rawData == nullptr || size < LIMITSIZE) {
89 return;
90 }
91 CheckPermission();
92
93 if (fuzz == nullptr) {
94 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
95 CHECK_AND_RETURN_LOG(photoSurface, "StreamMetadataStubFuzzer: Create photoSurface Error");
96 sptr<IBufferProducer> producer = photoSurface->GetProducer();
97 const int32_t face = 0;
98 std::vector<int32_t> type = {face};
99 fuzz = new HStreamMetadata(producer, PHOTO_FORMAT, type);
100 }
101
102 Test_OnRemoteRequest(rawData, size);
103 }
104
Test_OnRemoteRequest(uint8_t * rawData,size_t size)105 void Test_OnRemoteRequest(uint8_t *rawData, size_t size)
106 {
107 MessageParcel data;
108 data.WriteInterfaceToken(fuzz->GetDescriptor());
109 auto metadata = MakeMetadata(rawData, size);
110 CHECK_AND_RETURN_LOG(OHOS::Camera::MetadataUtils::EncodeCameraMetadata(metadata, data),
111 "StreamMetadataStubFuzzer: EncodeCameraMetadata Error");
112 uint32_t code;
113 MessageParcel reply;
114 MessageOption option;
115 code = static_cast<uint32_t>(StreamMetadataInterfaceCode::CAMERA_STREAM_META_START);
116 data.RewindRead(0);
117 fuzz->OnRemoteRequest(code, data, reply, option);
118
119 code = static_cast<uint32_t>(StreamMetadataInterfaceCode::CAMERA_STREAM_META_STOP);
120 data.RewindRead(0);
121 fuzz->OnRemoteRequest(code, data, reply, option);
122
123 code = static_cast<uint32_t>(StreamMetadataInterfaceCode::CAMERA_STREAM_META_RELEASE);
124 data.RewindRead(0);
125 fuzz->OnRemoteRequest(code, data, reply, option);
126
127 code = INVALID_CODE;
128 data.RewindRead(0);
129 fuzz->OnRemoteRequest(code, data, reply, option);
130 }
131
132 } // namespace StreamMetadataStubFuzzer
133 } // namespace CameraStandard
134 } // namespace OHOS
135
136 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)137 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
138 {
139 /* Run your code on data */
140 OHOS::CameraStandard::StreamMetadataStubFuzzer::Test(data, size);
141 return 0;
142 }