1 /*
2 * Copyright (c) 2021-2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "defferred_delivery_image_fuzzer.h"
17 #include "camera.h"
18
19 namespace OHOS {
20 const size_t THRESHOLD = 10;
21 enum BitOperat {
22 INDEX_0 = 0,
23 INDEX_1,
24 INDEX_2,
25 INDEX_3,
26 MOVE_EIGHT_BITS = 8,
27 MOVE_SIXTEEN_BITS = 16,
28 MOVE_TWENTY_FOUR_BITS = 24,
29 };
ConvertUint32(const uint8_t * bitOperat)30 static uint32_t ConvertUint32(const uint8_t *bitOperat)
31 {
32 if (bitOperat == nullptr) {
33 return 0;
34 }
35
36 return (bitOperat[INDEX_0] << MOVE_TWENTY_FOUR_BITS) | (bitOperat[INDEX_1] << MOVE_SIXTEEN_BITS) |
37 (bitOperat[INDEX_2] << MOVE_EIGHT_BITS) | (bitOperat[INDEX_3]);
38 }
39
GetConcurrencyApi(const uint8_t * rawData)40 bool GetConcurrencyApi(const uint8_t *rawData)
41 {
42 int taskCount;
43 imageProcessSession_->GetCoucurrency(
44 static_cast<OHOS::HDI::Camera::V1_2::ExecutionMode>(ConvertUint32(rawData)), taskCount);
45 return true;
46 }
47
SetExecutionModeApi(const uint8_t * rawData)48 bool SetExecutionModeApi(const uint8_t *rawData)
49 {
50 imageProcessSession_->SetExecutionMode(
51 static_cast<OHOS::HDI::Camera::V1_2::ExecutionMode>(ConvertUint32(rawData)));
52 return true;
53 }
54
GetPendingImagesApi(const uint8_t * rawData)55 bool GetPendingImagesApi(const uint8_t *rawData)
56 {
57 (void) rawData;
58 imageProcessSession_->GetPendingImages(pendingImageIds_);
59 return true;
60 }
61
ProcessImageApi(const uint8_t * rawData)62 bool ProcessImageApi(const uint8_t *rawData)
63 {
64 int imagesCount = pendingImageIds_.size();
65 std::string imageId;
66 if (imagesCount != 0) {
67 imageId = pendingImageIds_[rawData[0] % imagesCount];
68 }
69 imageProcessSession_->ProcessImage(imageId);
70 return true;
71 }
72
RemoveImageApi(const uint8_t * rawData)73 bool RemoveImageApi(const uint8_t *rawData)
74 {
75 int imagesCount = pendingImageIds_.size();
76 std::string imageId;
77 if (imagesCount != 0) {
78 imageId = pendingImageIds_[rawData[0] % imagesCount];
79 }
80 imageProcessSession_->RemoveImage(imageId);
81 return true;
82 }
83
InterruptApi(const uint8_t * rawData)84 bool InterruptApi(const uint8_t *rawData)
85 {
86 (void) rawData;
87 imageProcessSession_->Interrupt();
88 return true;
89 }
90
91 typedef bool (*TestFuncDef)(const uint8_t *rawData);
92 static TestFuncDef g_allTestFunc[] = {
93 GetConcurrencyApi,
94 GetPendingImagesApi,
95 SetExecutionModeApi,
96 ProcessImageApi,
97 RemoveImageApi,
98 InterruptApi,
99 };
100
101
TestFuncSwitch(uint32_t cmd,const uint8_t * rawData)102 static void TestFuncSwitch(uint32_t cmd, const uint8_t *rawData)
103 {
104 int testCount = sizeof(g_allTestFunc) / sizeof(g_allTestFunc[0]);
105 TestFuncDef curFunc = g_allTestFunc[cmd % testCount];
106 curFunc(rawData);
107 }
108
DoSomethingInterestingWithMyApi(const uint8_t * rawData,size_t size)109 bool DoSomethingInterestingWithMyApi(const uint8_t *rawData, size_t size)
110 {
111 constexpr const int userId = 100;
112 (void)size;
113 if (rawData == nullptr) {
114 return false;
115 }
116
117 uint32_t cmd = ConvertUint32(rawData);
118 rawData += sizeof(cmd);
119
120 cameraTest_ = std::make_shared<OHOS::Camera::CameraManager>();
121 cameraTest_->InitV1_2();
122 if (cameraTest_->serviceV1_1 == nullptr) {
123 return false;
124 }
125 cameraTest_->OpenCameraV1_2();
126 if (cameraTest_->cameraDeviceV1_1 == nullptr) {
127 return false;
128 }
129 imageProcessService_ = OHOS::HDI::Camera::V1_2::ImageProcessServiceProxy::Get();
130 if (imageProcessService_ == nullptr) {
131 return false;
132 }
133 imageProcessCallback_ = new TestImageProcessCallback();
134 imageProcessService_->CreateImageProcessSession(userId, imageProcessCallback_, imageProcessSession_);
135 if (imageProcessSession_ == nullptr) {
136 return false;
137 }
138
139 TestFuncSwitch(cmd, rawData);
140 cameraTest_->Close();
141 return true;
142 }
143
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)144 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
145 {
146 if (size < OHOS::THRESHOLD) {
147 return 0;
148 }
149
150 OHOS::DoSomethingInterestingWithMyApi(data, size);
151 return 0;
152 }
153 } // namespace OHOS
154