1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "bufferqueue_fuzzer.h"
17 
18 #include <securec.h>
19 
20 #include "buffer_queue.h"
21 #include "data_generate.h"
22 #include "surface.h"
23 #include "surface_buffer.h"
24 #include "surface_buffer_impl.h"
25 #include "buffer_extra_data.h"
26 #include "buffer_extra_data_impl.h"
27 #include "sync_fence.h"
28 
29 using namespace g_fuzzCommon;
30 namespace OHOS {
GetBufferExtraDataFromData()31     sptr<BufferExtraData> GetBufferExtraDataFromData()
32     {
33         // get data
34         std::string keyInt32 = GetStringFromData(STR_LEN);
35         int32_t valueInt32 = GetData<int32_t>();
36         std::string keyInt64 = GetStringFromData(STR_LEN);
37         int64_t valueInt64 = GetData<int64_t>();
38         std::string keyDouble = GetStringFromData(STR_LEN);
39         double valueDouble = GetData<double>();
40         std::string keyStr = GetStringFromData(STR_LEN);
41         std::string valueStr = GetStringFromData(STR_LEN);
42 
43         // test
44         sptr<BufferExtraData> bedata = new BufferExtraDataImpl();
45         bedata->ExtraSet(keyInt32, valueInt32);
46         bedata->ExtraSet(keyInt64, valueInt64);
47         bedata->ExtraSet(keyDouble, valueDouble);
48         bedata->ExtraSet(keyStr, valueStr);
49 
50         bedata->ExtraGet(keyInt32, valueInt32);
51         bedata->ExtraGet(keyInt64, valueInt64);
52         bedata->ExtraGet(keyDouble, valueDouble);
53         bedata->ExtraGet(keyStr, valueStr);
54         return bedata;
55     }
56 
BufferQueueFuzzTest2()57     void BufferQueueFuzzTest2()
58     {
59         std::string name = GetStringFromData(STR_LEN);
60         bool isShared = GetData<bool>();
61         uint32_t queueSize = GetData<uint32_t>();
62         int32_t width = GetData<int32_t>();
63         int32_t height = GetData<int32_t>();
64         uint64_t usage = GetData<uint64_t>();
65         uint32_t sequence = GetData<uint32_t>();
66         std::vector<GraphicHDRMetaData> metaData;
67         for (int i = 0; i < 10; i++) { // add 10 elements to the vector
68             GraphicHDRMetaData hDRMetaData = GetData<GraphicHDRMetaData>();
69             metaData.push_back(hDRMetaData);
70         }
71         GraphicHDRMetadataKey key = GetData<GraphicHDRMetadataKey>();
72         std::vector<uint8_t> metaDataSet;
73         for (int i = 0; i < 10; i++) { // add 10 elements to the vector
74             uint8_t metaDataElement = GetData<uint8_t>();
75             metaDataSet.push_back(metaDataElement);
76         }
77         bool flag = GetData<bool>();
78         std::string result = GetStringFromData(STR_LEN);
79         bool status = GetData<bool>();
80         GraphicPresentTimestamp timestamp = GetData<GraphicPresentTimestamp>();
81         OHSurfaceSource sourceType = GetData<OHSurfaceSource>();
82         std::string appFrameworkType = GetStringFromData(STR_LEN);
83         // test
84         sptr<BufferQueue> bufferqueue = new BufferQueue(name, isShared);
85         bufferqueue->SetQueueSize(queueSize);
86         bufferqueue->SetDefaultWidthAndHeight(width, height);
87         bufferqueue->SetDefaultUsage(usage);
88         GraphicTransformType transform = GetData<GraphicTransformType >();
89         bufferqueue->SetTransform(transform);
90         bufferqueue->SetMetaData(sequence, metaData);
91         bufferqueue->SetMetaDataSet(sequence, key, metaDataSet);
92         bufferqueue->SetProducerCacheCleanFlag(flag);
93         bufferqueue->Dump(result);
94         bufferqueue->SetStatus(status);
95         bufferqueue->SetPresentTimestamp(sequence, timestamp);
96         bufferqueue->SetSurfaceSourceType(sourceType);
97         bufferqueue->SetSurfaceAppFrameworkType(appFrameworkType);
98         int64_t time = 0;
99         GraphicPresentTimestampType timestampType = GetData<GraphicPresentTimestampType>();
100         bufferqueue->GetPresentTimestamp(sequence, timestampType, time);
101     }
102 
BufferQueueFuzzTest1()103     void BufferQueueFuzzTest1()
104     {
105         int32_t timeOut = 0;
106         std::string name = GetStringFromData(STR_LEN);
107         bool isShared = GetData<bool>();
108         sptr<BufferQueue> bufferqueue = new BufferQueue(name, isShared);
109         uint32_t seqNum = GetData<uint32_t>();
110         BufferRequestConfig requestConfig = GetData<BufferRequestConfig>();
111         OHOS::Rect rect = GetData<OHOS::Rect>();
112         int64_t timestamp = GetData<int64_t>();
113         BufferFlushConfigWithDamages flushConfig = {.damages =  { rect }, .timestamp = timestamp};
114         uint32_t sequence = GetData<uint32_t>();
115         std::vector<Rect> damages;
116         sptr<OHOS::SurfaceBuffer> buffer = new SurfaceBufferImpl(seqNum);
117         sptr<OHOS::SurfaceBuffer> buffer1 = SurfaceBuffer::Create();
118         sptr<BufferExtraData> bedata = GetBufferExtraDataFromData();
119         IBufferProducer::RequestBufferReturnValue retval;
120         retval.buffer = buffer;
121         bufferqueue->RegisterConsumerListener(nullptr);
122         OnReleaseFunc func;
123         bufferqueue->RegisterReleaseListener(func);
124         OnDeleteBufferFunc deleteBufferFunc;
125         bool isForUniRedraw = GetData<bool>();
126         bufferqueue->RegisterDeleteBufferListener(deleteBufferFunc, isForUniRedraw);
127         bufferqueue->RequestBuffer(requestConfig, bedata, retval);
128         bufferqueue->ReuseBuffer(requestConfig, bedata, retval);
129         bufferqueue->CancelBuffer(sequence, bedata);
130         sptr<SyncFence> syncFence = SyncFence::INVALID_FENCE;
131         bufferqueue->FlushBuffer(sequence, bedata, syncFence, flushConfig);
132         bufferqueue->DoFlushBuffer(sequence, bedata, syncFence, flushConfig);
133         bufferqueue->AcquireBuffer(buffer, syncFence, timestamp, damages);
134         bufferqueue->ReleaseBuffer(buffer, syncFence);
135         bufferqueue->AttachBuffer(buffer1, timeOut);
136         bufferqueue->DetachBuffer(buffer1);
137         float matrix[16] = {0};
138         uint32_t matrixSize = GetData<uint32_t>();
139         bool isUseNewMatrix = GetData<bool>();
140         bool needRecordSequence = GetData<bool>();
141         bufferqueue->GetLastFlushedBuffer(buffer, syncFence, matrix, matrixSize, isUseNewMatrix, needRecordSequence);
142         bufferqueue->UnregisterConsumerListener();
143         bufferqueue->UnRegisterProducerReleaseListener();
144         GraphicTransformType transformType = GetData<GraphicTransformType>();
145         bufferqueue->SetTransform(transformType);
146         bufferqueue->GetTransform();
147         bufferqueue->SetTransformHint(transformType);
148         bufferqueue->GetSurfaceSourceType();
149         float brightness = GetData<float>();
150         bufferqueue->SetHdrWhitePointBrightness(brightness);
151     }
152 
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)153     bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
154     {
155         if (data == nullptr) {
156             return false;
157         }
158 
159         // initialize
160         g_data = data;
161         g_size = size;
162         g_pos = 0;
163         std::string name = GetStringFromData(STR_LEN);
164         bool isShared = GetData<bool>();
165         sptr<BufferQueue> bufferqueue = new BufferQueue(name, isShared);
166         bool cleanAll = GetData<bool>();
167         bufferqueue->CleanCache(cleanAll);
168         bufferqueue->GetHdrWhitePointBrightness();
169         bufferqueue->GetUniqueId();
170         bufferqueue->GoBackground();
171         ScalingMode mode = GetData<ScalingMode>();
172         bufferqueue->SetScalingMode(mode);
173         bool bufferHold = GetData<bool>();
174         bufferqueue->SetBufferHold(bufferHold);
175         uint32_t reserveInts = GetData<uint32_t>() % 0x100000; // no more than 0x100000
176         GraphicExtDataHandle *handle = AllocExtDataHandle(reserveInts);
177         sptr<SurfaceTunnelHandle> tunnelHandle = new SurfaceTunnelHandle();
178         tunnelHandle->SetHandle(handle);
179         bufferqueue->SetTunnelHandle(tunnelHandle);
180         FreeExtDataHandle(handle);
181         BufferQueueFuzzTest1();
182         BufferQueueFuzzTest2();
183 
184         return true;
185     }
186 }
187 
188 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)189 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
190 {
191     /* Run your code on data */
192     OHOS::DoSomethingInterestingWithMyAPI(data, size);
193     return 0;
194 }
195 
196