1 /*
2  * Copyright (C) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #include <arpa/inet.h>
16 #include <sys/time.h>
17 #include <utility>
18 #include "videodec_api11_sample.h"
19 #include "native_avcapability.h"
20 using namespace OHOS;
21 using namespace OHOS::Media;
22 using namespace std;
23 namespace {
24 const string MIME_TYPE = "video/avc";
25 constexpr int64_t NANOS_IN_SECOND = 1000000000L;
26 constexpr int64_t NANOS_IN_MICRO = 1000L;
27 
28 constexpr uint32_t START_CODE_SIZE = 4;
29 constexpr uint8_t SPS = 7;
30 constexpr uint8_t PPS = 8;
31 constexpr int32_t EIGHT = 8;
32 constexpr int32_t SIXTEEN = 16;
33 constexpr int32_t TWENTY_FOUR = 24;
34 constexpr uint8_t H264_NALU_TYPE = 0x1f;
35 
36 constexpr uint8_t START_CODE[START_CODE_SIZE] = {0, 0, 0, 1};
37 VDecApi11FuzzSample *g_decSample = nullptr;
38 
clearIntqueue(std::queue<uint32_t> & q)39 void clearIntqueue(std::queue<uint32_t> &q)
40 {
41     std::queue<uint32_t> empty;
42     swap(empty, q);
43 }
44 
clearAvBufferQueue(std::queue<OH_AVBuffer * > & q)45 void clearAvBufferQueue(std::queue<OH_AVBuffer *> &q)
46 {
47     std::queue<OH_AVBuffer *> empty;
48     swap(empty, q);
49 }
50 } // namespace
51 
52 class TestConsumerListener : public IBufferConsumerListener {
53 public:
TestConsumerListener(sptr<Surface> cs)54     TestConsumerListener(sptr<Surface> cs) : cs(cs) {};
~TestConsumerListener()55     ~TestConsumerListener() {}
OnBufferAvailable()56     void OnBufferAvailable() override
57     {
58         sptr<SurfaceBuffer> buffer;
59         int32_t flushFence;
60         cs->AcquireBuffer(buffer, flushFence, timestamp, damage);
61 
62         cs->ReleaseBuffer(buffer, -1);
63     }
64 
65 private:
66     int64_t timestamp = 0;
67     Rect damage = {};
68     sptr<Surface> cs {nullptr};
69 };
70 
~VDecApi11FuzzSample()71 VDecApi11FuzzSample::~VDecApi11FuzzSample()
72 {
73     Release();
74 }
75 
VdecError(OH_AVCodec * codec,int32_t errorCode,void * userData)76 void VdecError(OH_AVCodec *codec, int32_t errorCode, void *userData)
77 {
78     cout << "Error errorCode=" << errorCode << endl;
79 }
80 
VdecFormatChanged(OH_AVCodec * codec,OH_AVFormat * format,void * userData)81 void VdecFormatChanged(OH_AVCodec *codec, OH_AVFormat *format, void *userData)
82 {
83     cout << "Format Changed" << endl;
84     int32_t currentWidth = 0;
85     int32_t currentHeight = 0;
86     OH_AVFormat_GetIntValue(format, OH_MD_KEY_WIDTH, &currentWidth);
87     OH_AVFormat_GetIntValue(format, OH_MD_KEY_HEIGHT, &currentHeight);
88     g_decSample->defaultWidth = currentWidth;
89     g_decSample->defaultHeight = currentHeight;
90 }
91 
VdecInputDataReady(OH_AVCodec * codec,uint32_t index,OH_AVBuffer * buffer,void * userData)92 void VdecInputDataReady(OH_AVCodec *codec, uint32_t index, OH_AVBuffer *buffer, void *userData)
93 {
94     VDecSignal *signal = static_cast<VDecSignal *>(userData);
95     if (signal == nullptr) {
96         return;
97     }
98     unique_lock<mutex> lock(signal->inMutex_);
99     signal->inIdxQueue_.push(index);
100     signal->inBufferQueue_.push(buffer);
101     signal->inCond_.notify_all();
102 }
103 
VdecOutputDataReady(OH_AVCodec * codec,uint32_t index,OH_AVBuffer * buffer,void * userData)104 void VdecOutputDataReady(OH_AVCodec *codec, uint32_t index, OH_AVBuffer *buffer, void *userData)
105 {
106     int32_t ret = 0;
107     if (g_decSample->isSurfMode) {
108         ret = OH_VideoDecoder_RenderOutputBuffer(codec, index);
109     } else {
110         ret = OH_VideoDecoder_FreeOutputBuffer(codec, index);
111     }
112     if (ret != AV_ERR_OK) {
113         g_decSample->Flush();
114         g_decSample->Start();
115     }
116 }
117 
GetSystemTimeUs()118 int64_t VDecApi11FuzzSample::GetSystemTimeUs()
119 {
120     struct timespec now;
121     (void)clock_gettime(CLOCK_BOOTTIME, &now);
122     int64_t nanoTime = static_cast<int64_t>(now.tv_sec) * NANOS_IN_SECOND + now.tv_nsec;
123     return nanoTime / NANOS_IN_MICRO;
124 }
125 
ConfigureVideoDecoder()126 int32_t VDecApi11FuzzSample::ConfigureVideoDecoder()
127 {
128     OH_AVFormat *format = OH_AVFormat_Create();
129     if (format == nullptr) {
130         cout << "Fatal: Failed to create format" << endl;
131         return AV_ERR_UNKNOWN;
132     }
133     (void)OH_AVFormat_SetIntValue(format, OH_MD_KEY_WIDTH, defaultWidth);
134     (void)OH_AVFormat_SetIntValue(format, OH_MD_KEY_HEIGHT, defaultHeight);
135     (void)OH_AVFormat_SetDoubleValue(format, OH_MD_KEY_FRAME_RATE, defaultFrameRate);
136     (void)OH_AVFormat_SetIntValue(format, OH_MD_KEY_ROTATION, 0);
137     (void)OH_AVFormat_SetIntValue(format, OH_MD_KEY_PIXEL_FORMAT, AV_PIXEL_FORMAT_NV12);
138     int ret = OH_VideoDecoder_Configure(vdec_, format);
139     OH_AVFormat_Destroy(format);
140     if (isSurfMode) {
141         cs = Surface::CreateSurfaceAsConsumer();
142         sptr<IBufferConsumerListener> listener = new TestConsumerListener(cs);
143         cs->RegisterConsumerListener(listener);
144         auto p = cs->GetProducer();
145         ps = Surface::CreateSurfaceAsProducer(p);
146         nativeWindow = CreateNativeWindowFromSurface(&ps);
147         OH_VideoDecoder_SetSurface(vdec_, nativeWindow);
148     }
149     return ret;
150 }
151 
SetVideoDecoderCallback()152 int32_t VDecApi11FuzzSample::SetVideoDecoderCallback()
153 {
154     signal_ = new VDecSignal();
155     if (signal_ == nullptr) {
156         cout << "Failed to new VDecSignal" << endl;
157         return AV_ERR_UNKNOWN;
158     }
159 
160     cb_.onError = VdecError;
161     cb_.onStreamChanged = VdecFormatChanged;
162     cb_.onNeedInputBuffer = VdecInputDataReady;
163     cb_.onNewOutputBuffer = VdecOutputDataReady;
164     OH_VideoDecoder_RegisterCallback(vdec_, cb_, static_cast<void *>(signal_));
165     return OH_VideoDecoder_RegisterCallback(vdec_, cb_, static_cast<void *>(signal_));
166 }
167 
CreateVideoDecoder()168 int32_t VDecApi11FuzzSample::CreateVideoDecoder()
169 {
170     OH_AVCapability *cap = OH_AVCodec_GetCapabilityByCategory(OH_AVCODEC_MIMETYPE_VIDEO_AVC, false, HARDWARE);
171     string codecName = OH_AVCapability_GetName(cap);
172     vdec_ = OH_VideoDecoder_CreateByName("aabbcc");
173     if (vdec_) {
174         OH_VideoDecoder_Destroy(vdec_);
175         vdec_ = nullptr;
176     }
177     OH_AVCodec *tmpDec = OH_VideoDecoder_CreateByMime("aabbcc");
178     if (tmpDec) {
179         OH_VideoDecoder_Destroy(tmpDec);
180         tmpDec = nullptr;
181     }
182     tmpDec = OH_VideoDecoder_CreateByMime(OH_AVCODEC_MIMETYPE_VIDEO_AVC);
183     if (tmpDec) {
184         OH_VideoDecoder_Destroy(tmpDec);
185         tmpDec = nullptr;
186     }
187     vdec_ = OH_VideoDecoder_CreateByName(codecName.c_str());
188     g_decSample = this;
189     return vdec_ == nullptr ? AV_ERR_UNKNOWN : AV_ERR_OK;
190 }
191 
WaitForEOS()192 void VDecApi11FuzzSample::WaitForEOS()
193 {
194     if (inputLoop_ && inputLoop_->joinable()) {
195         inputLoop_->join();
196     }
197 }
198 
InputFuncFUZZ(const uint8_t * data,size_t size)199 OH_AVErrCode VDecApi11FuzzSample::InputFuncFUZZ(const uint8_t *data, size_t size)
200 {
201     uint32_t index;
202     unique_lock<mutex> lock(signal_->inMutex_);
203     if (!isRunning_.load()) {
204         return AV_ERR_NO_MEMORY;
205     }
206     signal_->inCond_.wait(lock, [this]() {
207         if (!isRunning_.load()) {
208             return true;
209         }
210         return signal_->inIdxQueue_.size() > 0;
211     });
212     if (!isRunning_.load()) {
213         return AV_ERR_NO_MEMORY;
214     }
215     index = signal_->inIdxQueue_.front();
216     auto buffer = signal_->inBufferQueue_.front();
217     lock.unlock();
218     int32_t bufferSize = OH_AVBuffer_GetCapacity(buffer);
219     uint8_t *bufferAddr = OH_AVBuffer_GetAddr(buffer);
220     if (size > bufferSize - START_CODE_SIZE) {
221         cout << "Fatal: memcpy fail" << endl;
222         return AV_ERR_NO_MEMORY;
223     }
224     if (memcpy_s(bufferAddr, bufferSize, START_CODE, START_CODE_SIZE) != EOK) {
225         cout << "Fatal: memcpy fail" << endl;
226         return AV_ERR_NO_MEMORY;
227     }
228     if (memcpy_s(bufferAddr + START_CODE_SIZE, bufferSize - START_CODE_SIZE, data, size) != EOK) {
229         cout << "Fatal: memcpy fail" << endl;
230         return AV_ERR_NO_MEMORY;
231     }
232     OH_AVCodecBufferAttr attr;
233     attr.pts = GetSystemTimeUs();
234     attr.size = size;
235     attr.offset = 0;
236     attr.flags = AVCODEC_BUFFER_FLAGS_NONE;
237     OH_AVBuffer_SetBufferAttr(buffer, &attr);
238     OH_AVErrCode ret = OH_VideoDecoder_PushInputBuffer(vdec_, index);
239     signal_->inIdxQueue_.pop();
240     signal_->inBufferQueue_.pop();
241     return ret;
242 }
243 
SetEOS(OH_AVBuffer * buffer,uint32_t index)244 void VDecApi11FuzzSample::SetEOS(OH_AVBuffer *buffer, uint32_t index)
245 {
246     OH_AVCodecBufferAttr attr;
247     attr.pts = 0;
248     attr.size = 0;
249     attr.offset = 0;
250     attr.flags = AVCODEC_BUFFER_FLAGS_EOS;
251     OH_AVBuffer_SetBufferAttr(buffer, &attr);
252     int32_t res = OH_VideoDecoder_PushInputBuffer(vdec_, index);
253     cout << "OH_VideoDecoder_PushInputData    EOS   res: " << res << endl;
254 }
255 
Flush()256 int32_t VDecApi11FuzzSample::Flush()
257 {
258     unique_lock<mutex> inLock(signal_->inMutex_);
259     clearIntqueue(signal_->inIdxQueue_);
260     clearAvBufferQueue(signal_->inBufferQueue_);
261     signal_->inCond_.notify_all();
262     inLock.unlock();
263     unique_lock<mutex> outLock(signal_->outMutex_);
264     clearIntqueue(signal_->outIdxQueue_);
265     signal_->outCond_.notify_all();
266     isRunning_.store(false);
267     outLock.unlock();
268 
269     return OH_VideoDecoder_Flush(vdec_);
270 }
271 
Reset()272 int32_t VDecApi11FuzzSample::Reset()
273 {
274     isRunning_.store(false);
275     return OH_VideoDecoder_Reset(vdec_);
276 }
277 
Release()278 int32_t VDecApi11FuzzSample::Release()
279 {
280     int ret = 0;
281     if (vdec_ != nullptr) {
282         ret = OH_VideoDecoder_Destroy(vdec_);
283         vdec_ = nullptr;
284     }
285     if (signal_ != nullptr) {
286         clearAvBufferQueue(signal_->inBufferQueue_);
287         delete signal_;
288         signal_ = nullptr;
289     }
290     return ret;
291 }
292 
Stop()293 int32_t VDecApi11FuzzSample::Stop()
294 {
295     clearIntqueue(signal_->outIdxQueue_);
296     isRunning_.store(false);
297     return OH_VideoDecoder_Stop(vdec_);
298 }
299 
Start()300 int32_t VDecApi11FuzzSample::Start()
301 {
302     int32_t ret = OH_VideoDecoder_Start(vdec_);
303     if (ret == AV_ERR_OK) {
304         isRunning_.store(true);
305     }
306     return ret;
307 }
308 
SetParameter(int32_t data)309 void VDecApi11FuzzSample::SetParameter(int32_t data)
310 {
311     OH_AVFormat *format = OH_AVFormat_Create();
312     (void)OH_AVFormat_SetIntValue(format, OH_MD_KEY_WIDTH, data);
313     (void)OH_AVFormat_SetIntValue(format, OH_MD_KEY_HEIGHT, data);
314     OH_VideoDecoder_SetParameter(vdec_, format);
315     OH_AVFormat_Destroy(format);
316 }
317 
StopInloop()318 void VDecApi11FuzzSample::StopInloop()
319 {
320     if (inputLoop_ != nullptr && inputLoop_->joinable()) {
321         unique_lock<mutex> lock(signal_->inMutex_);
322         clearIntqueue(signal_->inIdxQueue_);
323         isRunning_.store(false);
324         signal_->inCond_.notify_all();
325         lock.unlock();
326 
327         inputLoop_->join();
328         inputLoop_.reset();
329     }
330 }
331 
ReleaseInFile()332 void VDecApi11FuzzSample::ReleaseInFile()
333 {
334     if (inFile_ != nullptr) {
335         if (inFile_->is_open()) {
336             inFile_->close();
337         }
338         inFile_.reset();
339         inFile_ = nullptr;
340     }
341 }
342 
StartVideoDecoder()343 int32_t VDecApi11FuzzSample::StartVideoDecoder()
344 {
345     isRunning_.store(true);
346     int ret = OH_VideoDecoder_Start(vdec_);
347     if (ret != AV_ERR_OK) {
348         isRunning_.store(false);
349         ReleaseInFile();
350         Release();
351         cout << "Failed to start codec" << endl;
352         return ret;
353     }
354     inFile_ = make_unique<ifstream>();
355     if (inFile_ == nullptr) {
356         isRunning_.store(false);
357         (void)OH_VideoDecoder_Stop(vdec_);
358         return AV_ERR_UNKNOWN;
359     }
360     inFile_->open(inpDir, ios::in | ios::binary);
361     if (!inFile_->is_open()) {
362         cout << "open input file failed" << endl;
363         isRunning_.store(false);
364         (void)OH_VideoDecoder_Stop(vdec_);
365         inFile_->close();
366         inFile_.reset();
367         inFile_ = nullptr;
368         return AV_ERR_UNKNOWN;
369     }
370 
371     inputLoop_ = make_unique<thread>(&VDecApi11FuzzSample::InputFuncTest, this);
372     if (inputLoop_ == nullptr) {
373         cout << "Failed to create input loop" << endl;
374         isRunning_.store(false);
375         (void)OH_VideoDecoder_Stop(vdec_);
376         ReleaseInFile();
377         return AV_ERR_UNKNOWN;
378     }
379     return AV_ERR_OK;
380 }
381 
InputFuncTest()382 void VDecApi11FuzzSample::InputFuncTest()
383 {
384     while (isRunning_.load()) {
385         uint32_t index;
386         unique_lock<mutex> lock(signal_->inMutex_);
387         signal_->inCond_.wait(lock, [this]() {
388             if (!isRunning_.load()) {
389                 return true;
390             }
391             return signal_->inIdxQueue_.size() > 0;
392         });
393         if (!isRunning_.load()) {
394             break;
395         }
396         index = signal_->inIdxQueue_.front();
397         auto buffer = signal_->inBufferQueue_.front();
398 
399         signal_->inIdxQueue_.pop();
400         signal_->inBufferQueue_.pop();
401         lock.unlock();
402         if (!inFile_->eof()) {
403             int ret = PushData(index, buffer);
404             if (ret == 1) {
405                 break;
406             }
407         }
408     }
409 }
410 
PushData(uint32_t index,OH_AVBuffer * buffer)411 int32_t VDecApi11FuzzSample::PushData(uint32_t index, OH_AVBuffer *buffer)
412 {
413     char ch[4] = {};
414     (void)inFile_->read(ch, START_CODE_SIZE);
415     if (inFile_->eof()) {
416         SetEOS(buffer, index);
417         return 1;
418     }
419     uint32_t bufferSize = static_cast<uint32_t>(((ch[3] & 0xFF)) | ((ch[2] & 0xFF) << EIGHT) |
420      ((ch[1] & 0xFF) << SIXTEEN) | ((ch[0] & 0xFF) << TWENTY_FOUR));
421 
422     return SendData(bufferSize, index, buffer);
423 }
424 
425 
SendData(uint32_t bufferSize,uint32_t index,OH_AVBuffer * buffer)426 uint32_t VDecApi11FuzzSample::SendData(uint32_t bufferSize, uint32_t index, OH_AVBuffer *buffer)
427 {
428     OH_AVCodecBufferAttr attr;
429     uint8_t *fileBuffer = new uint8_t[bufferSize + START_CODE_SIZE];
430     if (fileBuffer == nullptr) {
431         delete[] fileBuffer;
432         return 0;
433     }
434     if (memcpy_s(fileBuffer, bufferSize + START_CODE_SIZE, START_CODE, START_CODE_SIZE) != EOK) {
435         cout << "Fatal: memory copy failed" << endl;
436     }
437     (void)inFile_->read((char *)fileBuffer + START_CODE_SIZE, bufferSize);
438     if ((fileBuffer[START_CODE_SIZE] & H264_NALU_TYPE) == SPS ||
439         (fileBuffer[START_CODE_SIZE] & H264_NALU_TYPE) == PPS) {
440         attr.flags = AVCODEC_BUFFER_FLAGS_CODEC_DATA;
441     } else {
442         attr.flags = AVCODEC_BUFFER_FLAGS_NONE;
443     }
444     int32_t size = OH_AVBuffer_GetCapacity(buffer);
445     if (size < bufferSize + START_CODE_SIZE) {
446         delete[] fileBuffer;
447         return 0;
448     }
449     uint8_t *avBuffer = OH_AVBuffer_GetAddr(buffer);
450     if (avBuffer == nullptr) {
451         cout << "avBuffer == nullptr" << endl;
452         inFile_->clear();
453         inFile_->seekg(0, ios::beg);
454         delete[] fileBuffer;
455         return 0;
456     }
457     if (memcpy_s(avBuffer, size, fileBuffer, bufferSize + START_CODE_SIZE) != EOK) {
458         delete[] fileBuffer;
459         return 0;
460     }
461     int64_t startPts = GetSystemTimeUs();
462     attr.pts = startPts;
463     attr.size = bufferSize + START_CODE_SIZE;
464     attr.offset = 0;
465     OH_AVBuffer_SetBufferAttr(buffer, &attr);
466     if (isRunning_.load()) {
467         OH_VideoDecoder_PushInputBuffer(vdec_, index) == AV_ERR_OK ? (0) : (errCount++);
468         frameCount_ = frameCount_ + 1;
469     }
470     delete[] fileBuffer;
471     return 0;
472 }