1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "avmetadata_service_proxy_fuzzer.h"
17 #include <iostream>
18 #include <fcntl.h>
19 #include <unistd.h>
20 #include <sys/stat.h>
21 
22 namespace OHOS {
23 namespace Media {
24 namespace {
25     using Fuzzer = AVMetadataServiceProxyFuzzer;
26     using AVMetaStubFunc = std::function<int32_t(Fuzzer*, uint8_t*, size_t, bool)>;
27     std::map<uint32_t, AVMetaStubFunc> avmetaFuncs_ = {
28         {Fuzzer::SET_URI_SOURCE, Fuzzer::SetUriSourceStatic},
29         {Fuzzer::SET_FD_SOURCE, Fuzzer::SetFdSourceStatic},
30         {Fuzzer::RESOLVE_METADATA, Fuzzer::ResolveMetadataStatic},
31         {Fuzzer::RESOLVE_METADATA_MAP, Fuzzer::ResolveMetadataMapStatic},
32         {Fuzzer::GET_AVMETADATA, Fuzzer::GetAVMetadataStatic},
33         {Fuzzer::FETCH_ALBUM_COVER, Fuzzer::FetchArtPictureStatic},
34         {Fuzzer::FETCH_FRAME_AT_TIME, Fuzzer::FetchFrameAtTimeStatic},
35         {Fuzzer::RELEASE, Fuzzer::ReleaseStatic},
36         {Fuzzer::DESTROY, Fuzzer::DestroyStubStatic}
37     };
38 }
AVMetadataServiceProxyFuzzer(const sptr<IRemoteObject> & impl)39 AVMetadataServiceProxyFuzzer::AVMetadataServiceProxyFuzzer(const sptr<IRemoteObject> &impl)
40     : IRemoteProxy<IStandardAVMetadataHelperService>(impl)
41 {
42 }
43 
Create()44 sptr<AVMetadataServiceProxyFuzzer> AVMetadataServiceProxyFuzzer::Create()
45 {
46     auto samgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
47     sptr<IRemoteObject> obj = samgr->GetSystemAbility(OHOS::PLAYER_DISTRIBUTED_SERVICE_ID);
48     if (obj == nullptr) {
49         std::cout << "media object is nullptr." << std::endl;
50         return nullptr;
51     }
52     sptr<IStandardMediaService> proxy = iface_cast<IStandardMediaService>(obj);
53     if (proxy == nullptr) {
54         std::cout << "media proxy is nullptr." << std::endl;
55         return nullptr;
56     }
57     sptr<IRemoteObject> listenerStub = new(std::nothrow) MediaListenerStubFuzzer();
58     sptr<IRemoteObject> avmetaObject = proxy->GetSubSystemAbility(
59         IStandardMediaService::MediaSystemAbility::MEDIA_AVMETADATAHELPER, listenerStub);
60     if (avmetaObject == nullptr) {
61         std::cout << "avmetaObject is nullptr." << std::endl;
62         return nullptr;
63     }
64 
65     sptr<AVMetadataServiceProxyFuzzer> avmetaProxy = iface_cast<AVMetadataServiceProxyFuzzer>(avmetaObject);
66     if (avmetaProxy == nullptr) {
67         std::cout << "avmetaProxy is nullptr." << std::endl;
68         return nullptr;
69     }
70     return avmetaProxy;
71 }
72 
SendRequest(uint32_t code,uint8_t * inputData,size_t size,bool isFuzz)73 void AVMetadataServiceProxyFuzzer::SendRequest(uint32_t code, uint8_t *inputData, size_t size, bool isFuzz)
74 {
75     auto itFunc = avmetaFuncs_.find(code);
76     if (itFunc != avmetaFuncs_.end()) {
77         auto memberFunc = itFunc->second;
78         if (memberFunc != nullptr) {
79             memberFunc(this, inputData, size, isFuzz);
80         }
81     }
82 }
83 
SetUriSourceStatic(AVMetadataServiceProxyFuzzer * ptr,uint8_t * inputData,size_t size,bool isFuzz)84 int32_t AVMetadataServiceProxyFuzzer::SetUriSourceStatic(AVMetadataServiceProxyFuzzer* ptr, uint8_t *inputData,
85     size_t size, bool isFuzz)
86 {
87     MessageParcel data;
88     MessageParcel reply;
89     MessageOption option;
90 
91     bool token = data.WriteInterfaceToken(AVMetadataServiceProxyFuzzer::GetDescriptor());
92     if (!token) {
93         std::cout << "SetUriSource:Failed to write descriptor!" << std::endl;
94         return false;
95     }
96     std::string url(reinterpret_cast<const char *>(inputData), size);
97     (void)data.WriteString(url);
98     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
99     return ptr->SendRequest(SET_URI_SOURCE, data, reply, option);
100 }
101 
SetFdSourceStatic(AVMetadataServiceProxyFuzzer * ptr,uint8_t * inputData,size_t size,bool isFuzz)102 int32_t AVMetadataServiceProxyFuzzer::SetFdSourceStatic(AVMetadataServiceProxyFuzzer* ptr, uint8_t *inputData,
103     size_t size, bool isFuzz)
104 {
105     MessageParcel data;
106     MessageParcel reply;
107     MessageOption option;
108 
109     bool token = data.WriteInterfaceToken(AVMetadataServiceProxyFuzzer::GetDescriptor());
110     if (!token) {
111         std::cout << "Failed to write descriptor!" << std::endl;
112         return false;
113     }
114 
115     int32_t fdValue;
116     int64_t offset;
117     int64_t lengthValue;
118     int32_t usage;
119     if (isFuzz) {
120         fdValue = *reinterpret_cast<int32_t *>(inputData);
121         lengthValue = *reinterpret_cast<int64_t *>(inputData);
122         offset = *reinterpret_cast<uint32_t *>(inputData) % *reinterpret_cast<int64_t *>(inputData);
123         usage = *reinterpret_cast<int32_t *>(inputData);
124         (void)data.WriteFileDescriptor(fdValue);
125         (void)data.WriteInt64(offset);
126         (void)data.WriteInt64(lengthValue);
127         (void)data.WriteInt32(usage);
128         return ptr->SendRequest(SET_FD_SOURCE, data, reply, option);
129     } else {
130         const std::string filePath = "/data/test/media/H264_AAC.mp4";
131         fdValue = open(filePath.c_str(), O_RDONLY);
132         offset = 0;
133         if (fdValue < 0) {
134             std::cout << "Open file failed." << std::endl;
135             (void)close(fdValue);
136             return -1;
137         }
138 
139         struct stat64 buf;
140         if (fstat64(fdValue, &buf) != 0) {
141             std::cout << "Get file state failed." << std::endl;
142             (void)close(fdValue);
143             return -1;
144         }
145         lengthValue = static_cast<int64_t>(buf.st_size);
146         usage = AVMetadataUsage::AV_META_USAGE_PIXEL_MAP;
147         (void)data.WriteFileDescriptor(fdValue);
148         (void)data.WriteInt64(offset);
149         (void)data.WriteInt64(lengthValue);
150         (void)data.WriteInt32(usage);
151         int32_t ret = ptr->SendRequest(SET_FD_SOURCE, data, reply, option);
152         (void)close(fdValue);
153         return ret;
154     }
155 }
156 
ResolveMetadataStatic(AVMetadataServiceProxyFuzzer * ptr,uint8_t * inputData,size_t size,bool isFuzz)157 int32_t AVMetadataServiceProxyFuzzer::ResolveMetadataStatic(AVMetadataServiceProxyFuzzer* ptr, uint8_t *inputData,
158     size_t size, bool isFuzz)
159 {
160     (void)isFuzz;
161     (void)size;
162     MessageParcel data;
163     MessageParcel reply;
164     MessageOption option;
165 
166     bool token = data.WriteInterfaceToken(AVMetadataServiceProxyFuzzer::GetDescriptor());
167     if (!token) {
168         std::cout << "ResolveMetadata:Failed to write descriptor!" << std::endl;
169         return false;
170     }
171     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
172     return ptr->SendRequest(RESOLVE_METADATA, data, reply, option);
173 }
174 
ResolveMetadataMapStatic(AVMetadataServiceProxyFuzzer * ptr,uint8_t * inputData,size_t size,bool isFuzz)175 int32_t AVMetadataServiceProxyFuzzer::ResolveMetadataMapStatic(AVMetadataServiceProxyFuzzer* ptr, uint8_t *inputData,
176     size_t size, bool isFuzz)
177 {
178     (void)size;
179     (void)isFuzz;
180     MessageParcel data;
181     MessageOption option;
182     MessageParcel reply;
183 
184     bool token = data.WriteInterfaceToken(AVMetadataServiceProxyFuzzer::GetDescriptor());
185     if (!token) {
186         std::cout << "ResolveMetadataMap:Failed to write descriptor!" << std::endl;
187         return false;
188     }
189     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
190     return ptr->SendRequest(RESOLVE_METADATA_MAP, data, reply, option);
191 }
192 
GetAVMetadataStatic(AVMetadataServiceProxyFuzzer * ptr,uint8_t * inputData,size_t size,bool isFuzz)193 int32_t AVMetadataServiceProxyFuzzer::GetAVMetadataStatic(AVMetadataServiceProxyFuzzer* ptr, uint8_t *inputData,
194     size_t size, bool isFuzz)
195 {
196     (void)size;
197     (void)isFuzz;
198     MessageParcel data;
199     MessageOption option;
200     MessageParcel reply;
201 
202     bool token = data.WriteInterfaceToken(AVMetadataServiceProxyFuzzer::GetDescriptor());
203     if (!token) {
204         std::cout << "GetAVMetadata:Failed to write descriptor!" << std::endl;
205         return false;
206     }
207     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
208     return ptr->SendRequest(RESOLVE_METADATA_MAP, data, reply, option);
209 }
210 
FetchArtPictureStatic(AVMetadataServiceProxyFuzzer * ptr,uint8_t * inputData,size_t size,bool isFuzz)211 int32_t AVMetadataServiceProxyFuzzer::FetchArtPictureStatic(AVMetadataServiceProxyFuzzer* ptr, uint8_t *inputData,
212     size_t size, bool isFuzz)
213 {
214     (void)size;
215     (void)isFuzz;
216     MessageOption option;
217     MessageParcel data;
218     MessageParcel reply;
219 
220     bool token = data.WriteInterfaceToken(AVMetadataServiceProxyFuzzer::GetDescriptor());
221     if (!token) {
222         std::cout << "FetchArtPicture:Failed to write descriptor!" << std::endl;
223         return false;
224     }
225     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
226     return ptr->SendRequest(FETCH_ALBUM_COVER, data, reply, option);
227 }
228 
FetchFrameAtTimeStatic(AVMetadataServiceProxyFuzzer * ptr,uint8_t * inputData,size_t size,bool isFuzz)229 int32_t AVMetadataServiceProxyFuzzer::FetchFrameAtTimeStatic(AVMetadataServiceProxyFuzzer* ptr, uint8_t *inputData,
230     size_t size, bool isFuzz)
231 {
232     (void)isFuzz;
233     (void)size;
234     MessageOption option;
235     MessageParcel data;
236     MessageParcel reply;
237 
238     bool token = data.WriteInterfaceToken(AVMetadataServiceProxyFuzzer::GetDescriptor());
239     if (!token) {
240         std::cout << "FetchFrameAtTime:Failed to write descriptor!" << std::endl;
241         return false;
242     }
243     (void)data.WriteInt64(*reinterpret_cast<int64_t *>(inputData));
244     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
245     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
246     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
247     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
248     return ptr->SendRequest(FETCH_FRAME_AT_TIME, data, reply, option);
249 }
250 
ReleaseStatic(AVMetadataServiceProxyFuzzer * ptr,uint8_t * inputData,size_t size,bool isFuzz)251 int32_t AVMetadataServiceProxyFuzzer::ReleaseStatic(AVMetadataServiceProxyFuzzer* ptr, uint8_t *inputData,
252     size_t size, bool isFuzz)
253 {
254     (void)size;
255     (void)isFuzz;
256     MessageParcel data;
257     MessageOption option;
258     MessageParcel reply;
259 
260     bool token = data.WriteInterfaceToken(AVMetadataServiceProxyFuzzer::GetDescriptor());
261     if (!token) {
262         std::cout << "Release:Failed to write descriptor!" << std::endl;
263         return false;
264     }
265     (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
266     return ptr->SendRequest(RELEASE, data, reply, option);
267 }
268 
DestroyStubStatic(AVMetadataServiceProxyFuzzer * ptr,uint8_t * inputData,size_t size,bool isFuzz)269 int32_t AVMetadataServiceProxyFuzzer::DestroyStubStatic(AVMetadataServiceProxyFuzzer* ptr, uint8_t *inputData,
270     size_t size, bool isFuzz)
271 {
272     (void)size;
273     MessageParcel data;
274     MessageOption option;
275     MessageParcel reply;
276 
277     bool token = data.WriteInterfaceToken(AVMetadataServiceProxyFuzzer::GetDescriptor());
278     if (!token) {
279         std::cout << "DestroyStub:Failed to write descriptor!" << std::endl;
280         return false;
281     }
282     if (isFuzz) {
283         (void)data.WriteInt32(*reinterpret_cast<int32_t *>(inputData));
284     }
285     return ptr->SendRequest(DESTROY, data, reply, option);
286 }
287 
SendRequest(uint32_t code,MessageParcel & data,MessageParcel & reply,MessageOption & option)288 int32_t AVMetadataServiceProxyFuzzer::SendRequest(uint32_t code,
289     MessageParcel &data, MessageParcel &reply, MessageOption &option)
290 {
291     return Remote()->SendRequest(code, data, reply, option);
292 }
293 }
294 }