/* * Copyright (c) 2022 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include "bufferqueue_fuzzer.h" #include #include "buffer_queue.h" #include "data_generate.h" #include "surface.h" #include "surface_buffer.h" #include "surface_buffer_impl.h" #include "buffer_extra_data.h" #include "buffer_extra_data_impl.h" #include "sync_fence.h" using namespace g_fuzzCommon; namespace OHOS { sptr GetBufferExtraDataFromData() { // get data std::string keyInt32 = GetStringFromData(STR_LEN); int32_t valueInt32 = GetData(); std::string keyInt64 = GetStringFromData(STR_LEN); int64_t valueInt64 = GetData(); std::string keyDouble = GetStringFromData(STR_LEN); double valueDouble = GetData(); std::string keyStr = GetStringFromData(STR_LEN); std::string valueStr = GetStringFromData(STR_LEN); // test sptr bedata = new BufferExtraDataImpl(); bedata->ExtraSet(keyInt32, valueInt32); bedata->ExtraSet(keyInt64, valueInt64); bedata->ExtraSet(keyDouble, valueDouble); bedata->ExtraSet(keyStr, valueStr); bedata->ExtraGet(keyInt32, valueInt32); bedata->ExtraGet(keyInt64, valueInt64); bedata->ExtraGet(keyDouble, valueDouble); bedata->ExtraGet(keyStr, valueStr); return bedata; } void BufferQueueFuzzTest2() { std::string name = GetStringFromData(STR_LEN); bool isShared = GetData(); uint32_t queueSize = GetData(); int32_t width = GetData(); int32_t height = GetData(); uint64_t usage = GetData(); uint32_t sequence = GetData(); std::vector metaData; for (int i = 0; i < 10; i++) { // add 10 elements to the vector GraphicHDRMetaData hDRMetaData = GetData(); metaData.push_back(hDRMetaData); } GraphicHDRMetadataKey key = GetData(); std::vector metaDataSet; for (int i = 0; i < 10; i++) { // add 10 elements to the vector uint8_t metaDataElement = GetData(); metaDataSet.push_back(metaDataElement); } bool flag = GetData(); std::string result = GetStringFromData(STR_LEN); bool status = GetData(); GraphicPresentTimestamp timestamp = GetData(); OHSurfaceSource sourceType = GetData(); std::string appFrameworkType = GetStringFromData(STR_LEN); // test sptr bufferqueue = new BufferQueue(name, isShared); bufferqueue->SetQueueSize(queueSize); bufferqueue->SetDefaultWidthAndHeight(width, height); bufferqueue->SetDefaultUsage(usage); GraphicTransformType transform = GetData(); bufferqueue->SetTransform(transform); bufferqueue->SetMetaData(sequence, metaData); bufferqueue->SetMetaDataSet(sequence, key, metaDataSet); bufferqueue->SetProducerCacheCleanFlag(flag); bufferqueue->Dump(result); bufferqueue->SetStatus(status); bufferqueue->SetPresentTimestamp(sequence, timestamp); bufferqueue->SetSurfaceSourceType(sourceType); bufferqueue->SetSurfaceAppFrameworkType(appFrameworkType); int64_t time = 0; GraphicPresentTimestampType timestampType = GetData(); bufferqueue->GetPresentTimestamp(sequence, timestampType, time); } void BufferQueueFuzzTest1() { int32_t timeOut = 0; std::string name = GetStringFromData(STR_LEN); bool isShared = GetData(); sptr bufferqueue = new BufferQueue(name, isShared); uint32_t seqNum = GetData(); BufferRequestConfig requestConfig = GetData(); OHOS::Rect rect = GetData(); int64_t timestamp = GetData(); BufferFlushConfigWithDamages flushConfig = {.damages = { rect }, .timestamp = timestamp}; uint32_t sequence = GetData(); std::vector damages; sptr buffer = new SurfaceBufferImpl(seqNum); sptr buffer1 = SurfaceBuffer::Create(); sptr bedata = GetBufferExtraDataFromData(); IBufferProducer::RequestBufferReturnValue retval; retval.buffer = buffer; bufferqueue->RegisterConsumerListener(nullptr); OnReleaseFunc func; bufferqueue->RegisterReleaseListener(func); OnDeleteBufferFunc deleteBufferFunc; bool isForUniRedraw = GetData(); bufferqueue->RegisterDeleteBufferListener(deleteBufferFunc, isForUniRedraw); bufferqueue->RequestBuffer(requestConfig, bedata, retval); bufferqueue->ReuseBuffer(requestConfig, bedata, retval); bufferqueue->CancelBuffer(sequence, bedata); sptr syncFence = SyncFence::INVALID_FENCE; bufferqueue->FlushBuffer(sequence, bedata, syncFence, flushConfig); bufferqueue->DoFlushBuffer(sequence, bedata, syncFence, flushConfig); bufferqueue->AcquireBuffer(buffer, syncFence, timestamp, damages); bufferqueue->ReleaseBuffer(buffer, syncFence); bufferqueue->AttachBuffer(buffer1, timeOut); bufferqueue->DetachBuffer(buffer1); float matrix[16] = {0}; uint32_t matrixSize = GetData(); bool isUseNewMatrix = GetData(); bool needRecordSequence = GetData(); bufferqueue->GetLastFlushedBuffer(buffer, syncFence, matrix, matrixSize, isUseNewMatrix, needRecordSequence); bufferqueue->UnregisterConsumerListener(); bufferqueue->UnRegisterProducerReleaseListener(); GraphicTransformType transformType = GetData(); bufferqueue->SetTransform(transformType); bufferqueue->GetTransform(); bufferqueue->SetTransformHint(transformType); bufferqueue->GetSurfaceSourceType(); float brightness = GetData(); bufferqueue->SetHdrWhitePointBrightness(brightness); } bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size) { if (data == nullptr) { return false; } // initialize g_data = data; g_size = size; g_pos = 0; std::string name = GetStringFromData(STR_LEN); bool isShared = GetData(); sptr bufferqueue = new BufferQueue(name, isShared); bool cleanAll = GetData(); bufferqueue->CleanCache(cleanAll); bufferqueue->GetHdrWhitePointBrightness(); bufferqueue->GetUniqueId(); bufferqueue->GoBackground(); ScalingMode mode = GetData(); bufferqueue->SetScalingMode(mode); bool bufferHold = GetData(); bufferqueue->SetBufferHold(bufferHold); uint32_t reserveInts = GetData() % 0x100000; // no more than 0x100000 GraphicExtDataHandle *handle = AllocExtDataHandle(reserveInts); sptr tunnelHandle = new SurfaceTunnelHandle(); tunnelHandle->SetHandle(handle); bufferqueue->SetTunnelHandle(tunnelHandle); FreeExtDataHandle(handle); BufferQueueFuzzTest1(); BufferQueueFuzzTest2(); return true; } } /* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DoSomethingInterestingWithMyAPI(data, size); return 0; }