/* * Copyright (c) 2024 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include "bufferqueueproducer_fuzzer.h" #include #include #include #include "buffer_queue.h" #include "buffer_queue_producer.h" #include "data_generate.h" #include "surface.h" #include "surface_buffer.h" #include "surface_buffer_impl.h" #include "buffer_extra_data.h" #include "buffer_extra_data_impl.h" #include "sync_fence.h" #include using namespace g_fuzzCommon; namespace OHOS { sptr GetBufferExtraDataFromData() { // get data std::string keyInt32 = GetStringFromData(STR_LEN); int32_t valueInt32 = GetData(); std::string keyInt64 = GetStringFromData(STR_LEN); int64_t valueInt64 = GetData(); std::string keyDouble = GetStringFromData(STR_LEN); double valueDouble = GetData(); std::string keyStr = GetStringFromData(STR_LEN); std::string valueStr = GetStringFromData(STR_LEN); // test sptr bedata = new BufferExtraDataImpl(); bedata->ExtraSet(keyInt32, valueInt32); bedata->ExtraSet(keyInt64, valueInt64); bedata->ExtraSet(keyDouble, valueDouble); bedata->ExtraSet(keyStr, valueStr); bedata->ExtraGet(keyInt32, valueInt32); bedata->ExtraGet(keyInt64, valueInt64); bedata->ExtraGet(keyDouble, valueDouble); bedata->ExtraGet(keyStr, valueStr); return bedata; } void BufferQueueProducerFuzzTest(const sptr &bqp) { // get data std::string name = GetStringFromData(STR_LEN); uint32_t queueSize = GetData(); uint64_t usage = GetData(); GraphicTransformType transform = GetData(); uint32_t sequence = GetData(); std::vector metaData; for (int i = 0; i < 10; i++) { // add 10 elements to the vector GraphicHDRMetaData hDRMetaData = GetData(); metaData.push_back(hDRMetaData); } GraphicHDRMetadataKey key = GetData(); std::vector metaDataSet; for (int i = 0; i < 10; i++) { // add 10 elements to the vector uint8_t metaDataElement = GetData(); metaDataSet.push_back(metaDataElement); } std::string result = GetStringFromData(STR_LEN); bool status = GetData(); uint32_t reserveInts = GetData() % 0x100000; // no more than 0x100000 OHSurfaceSource sourceType = GetData(); std::string appFrameworkType = GetStringFromData(STR_LEN); // test bqp->SetQueueSize(queueSize); bqp->SetDefaultUsage(usage); bqp->SetTransform(transform); bqp->SetMetaData(sequence, metaData); bqp->SetMetaDataSet(sequence, key, metaDataSet); bqp->SetStatus(status); GraphicExtDataHandle *handle = AllocExtDataHandle(reserveInts); sptr tunnelHandle = new SurfaceTunnelHandle(); tunnelHandle->SetHandle(handle); FreeExtDataHandle(handle); bqp->SetSurfaceSourceType(sourceType); bqp->GetSurfaceSourceType(sourceType); bqp->SetSurfaceAppFrameworkType(appFrameworkType); ScalingMode mode = GetData(); bqp->SetScalingMode(mode); bool bufferHold = GetData(); bqp->SetBufferHold(bufferHold); int64_t time = 0; GraphicPresentTimestampType timestampType = GetData(); bqp->GetPresentTimestamp(sequence, timestampType, time); } void BufferQueueProducerFuzzTest1(const sptr &bqp) { bqp->GetNativeSurface(); bqp->GetStatus(); bool cleanAll = GetData(); bqp->CleanCache(cleanAll); sptr buffer1 = SurfaceBuffer::Create(); sptr buffer = SurfaceBuffer::Create(); int32_t timeOut = 0; bqp->AttachBuffer(buffer1, timeOut); bqp->DetachBuffer(buffer1); bqp->GetUniqueId(); float matrix[16] = {0}; bool isUseNewMatrix = GetData(); sptr syncFence = new SyncFence(-1); bqp->GetLastFlushedBuffer(buffer, syncFence, matrix, isUseNewMatrix); bqp->AttachBufferToQueue(buffer); bqp->DetachBufferFromQueue(buffer); bqp->UnRegisterReleaseListener(); GraphicTransformType transformType = GetData(); bqp->SetTransform(transformType); bqp->GetTransform(transformType); bqp->SetTransformHint(transformType); bqp->GetTransformHint(transformType); uint64_t uniqueId = 0; std::string name = ""; bqp->GetNameAndUniqueId(name, uniqueId); float brightness = GetData(); bqp->SetHdrWhitePointBrightness(brightness); BufferQueueProducerFuzzTest(bqp); uint32_t code = GetData(); MessageParcel arguments; MessageParcel reply; MessageOption option; bqp->OnRemoteRequest(code, arguments, reply, option); for (auto iter : bqp->memberFuncMap_) { iter.second(reinterpret_cast(bqp.GetRefPtr()), arguments, reply, option); } } bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size) { if (data == nullptr) { return false; } // initialize g_data = data; g_size = size; g_pos = 0; // get data bool isShared = GetData(); uint32_t seqNum = GetData(); BufferRequestConfig requestConfig = GetData(); OHOS::Rect rect = GetData(); int64_t timestamp = GetData(); BufferFlushConfigWithDamages flushConfig = {.damages = { rect }, .timestamp = timestamp}; uint32_t sequence = GetData(); // test std::string name = GetStringFromData(STR_LEN); sptr bq = new BufferQueue(name, isShared); sptr bqp = new BufferQueueProducer(bq); sptr buffer = new SurfaceBufferImpl(seqNum); sptr bedata = GetBufferExtraDataFromData(); IBufferProducer::RequestBufferReturnValue retval; retval.buffer = buffer; OnReleaseFunc onBufferRelease = nullptr; sptr listener = new BufferReleaseProducerListener(onBufferRelease); bqp->RegisterReleaseListener(listener); OnDeleteBufferFunc deleteBufferFunc; bqp->RequestBuffer(requestConfig, bedata, retval); bqp->GoBackground(); bqp->CancelBuffer(sequence, bedata); sptr syncFence = SyncFence::INVALID_FENCE; bqp->FlushBuffer(sequence, bedata, syncFence, flushConfig); std::vector sequences; std::vector> bedataimpls; std::vector> fences; std::vector flushConfigs; for (size_t i = 0; i < sequences.size(); i++) { flushConfigs.emplace_back(flushConfig); fences.emplace_back(new SyncFence(-1)); } bqp->FlushBuffers(sequences, bedataimpls, fences, flushConfigs); BufferQueueProducerFuzzTest1(bqp); return true; } } /* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DoSomethingInterestingWithMyAPI(data, size); return 0; }