1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "surface_fuzzer.h"
17 
18 #include <securec.h>
19 
20 #include "data_generate.h"
21 #include "iconsumer_surface.h"
22 #include "metadata_helper.h"
23 #include "producer_surface_delegator.h"
24 #include "surface.h"
25 #include "surface_buffer.h"
26 #include "surface_buffer_impl.h"
27 #include "sync_fence.h"
28 #include <iostream>
29 
30 using namespace g_fuzzCommon;
31 using namespace OHOS::HDI::Display::Graphic::Common::V1_0;
32 namespace OHOS {
33     class TestConsumerListenerClazz : public IBufferConsumerListenerClazz {
34     public:
OnBufferAvailable()35         void OnBufferAvailable() override
36         {
37         }
38     };
OnBufferRelease(sptr<SurfaceBuffer> & buffer)39     GSError OnBufferRelease(sptr<SurfaceBuffer> &buffer)
40     {
41         return GSERROR_OK;
42     }
43 
BufferDeleteCbFunc(int32_t seqNum)44     void BufferDeleteCbFunc(int32_t seqNum)
45     {
46         (void)seqNum;
47     }
48 
MetadataHelperFuzzTest()49     void MetadataHelperFuzzTest()
50     {
51         CM_ColorSpaceInfo colorSpaceInfo1;
52         MetadataHelper::ConvertColorSpaceTypeToInfo(CM_SRGB_FULL, colorSpaceInfo1);
53         CM_ColorSpaceInfo colorSpaceInfo = GetData<CM_ColorSpaceInfo>();
54         CM_ColorSpaceType colorSpaceType;
55         MetadataHelper::ConvertColorSpaceInfoToType(colorSpaceInfo, colorSpaceType);
56 
57         sptr<SurfaceBuffer> buffer = SurfaceBuffer::Create();
58         MetadataHelper::SetColorSpaceInfo(buffer, colorSpaceInfo);
59         MetadataHelper::GetColorSpaceInfo(buffer, colorSpaceInfo);
60 
61         MetadataHelper::SetColorSpaceType(buffer, CM_SRGB_FULL);
62         MetadataHelper::GetColorSpaceType(buffer, colorSpaceType);
63 
64         MetadataHelper::SetHDRMetadataType(buffer, CM_VIDEO_HDR_VIVID);
65         CM_HDR_Metadata_Type hdrMetadataType;
66         MetadataHelper::GetHDRMetadataType(buffer, hdrMetadataType);
67 
68         HdrStaticMetadata metadataSet = GetData<HdrStaticMetadata>();
69         MetadataHelper::SetHDRStaticMetadata(buffer, metadataSet);
70         MetadataHelper::GetHDRStaticMetadata(buffer, metadataSet);
71         std::vector<uint8_t> metadataSets;
72         for (uint32_t i = 0; i < UINT8_MAX; i++) {
73             metadataSets.emplace_back(GetData<uint8_t>());
74         }
75         MetadataHelper::SetHDRDynamicMetadata(buffer, metadataSets);
76         MetadataHelper::GetHDRDynamicMetadata(buffer, metadataSets);
77 
78         std::vector<uint8_t> hdrStaticMetadata;
79         for (uint32_t i = 0; i < UINT8_MAX; i++) {
80             hdrStaticMetadata.emplace_back(GetData<uint8_t>());
81         }
82         MetadataHelper::SetHDRStaticMetadata(buffer, hdrStaticMetadata);
83         MetadataHelper::GetHDRStaticMetadata(buffer, hdrStaticMetadata);
84     }
85 
SurfaceFuzzTest4(sptr<OHOS::Surface> pSurface,sptr<OHOS::IConsumerSurface> cSurface)86     void SurfaceFuzzTest4(sptr<OHOS::Surface> pSurface, sptr<OHOS::IConsumerSurface> cSurface)
87     {
88         int32_t width = GetData<int32_t>();
89         int32_t height = GetData<int32_t>();
90         cSurface->SetDefaultWidthAndHeight(width, height);
91         uint64_t usage = GetData<uint64_t>();
92         cSurface->SetDefaultUsage(usage);
93         GraphicTransformType transform = GetData<GraphicTransformType>();
94         pSurface->SetTransform(transform);
95         cSurface->SetTransform(transform);
96         OHSurfaceSource sourceType = GetData<OHSurfaceSource>();
97         pSurface->SetSurfaceSourceType(sourceType);
98         cSurface->SetSurfaceSourceType(sourceType);
99         std::string appFrameworkType = GetStringFromData(STR_LEN);
100         cSurface->SetSurfaceAppFrameworkType(appFrameworkType);
101         pSurface->SetSurfaceAppFrameworkType(appFrameworkType);
102         std::string key = "";
103         cSurface->GetUserData(key);
104         cSurface->GetQueueSize();
105         cSurface->GetSurfaceSourceType();
106         GraphicExtDataHandle *handle = static_cast<GraphicExtDataHandle *>(
107             malloc(sizeof(GraphicExtDataHandle) + sizeof(int32_t)));
108         if (handle != nullptr) {
109             handle->fd = -1;
110             handle->reserveInts = 1;
111             handle->reserve[0] = GetData<int32_t>();
112             cSurface->SetTunnelHandle(handle);
113             free(handle);
114             handle = nullptr;
115         }
116         cSurface->GetSurfaceAppFrameworkType();
117     }
118 
SurfaceFuzzTest3(sptr<OHOS::Surface> pSurface,sptr<OHOS::IConsumerSurface> cSurface)119     void SurfaceFuzzTest3(sptr<OHOS::Surface> pSurface, sptr<OHOS::IConsumerSurface> cSurface)
120     {
121         std::vector<sptr<SurfaceBuffer>> buffers;
122         std::vector<sptr<SyncFence>> fences;
123         BufferRequestConfig config = GetData<BufferRequestConfig>();
124         pSurface->RequestBuffers(buffers, fences, config);
125         BufferFlushConfigWithDamages flushConfig;
126         std::vector<Rect> rects{GetData<Rect>()};
127         flushConfig.damages = rects;
128         flushConfig.timestamp = GetData<int64_t>();
129         std::vector<BufferFlushConfigWithDamages> flushConfigs;
130         for (size_t i = 0; i < buffers.size(); i++) {
131             flushConfigs.emplace_back(flushConfig);
132             fences.emplace_back(SyncFence::INVALID_FENCE);
133         }
134         pSurface->FlushBuffers(buffers, fences, flushConfigs);
135         ScalingMode scalingMode = GetData<ScalingMode>();
136         uint32_t sequence = GetData<uint32_t>();
137         cSurface->SetScalingMode(sequence, scalingMode);
138         cSurface->SetScalingMode(scalingMode);
139         cSurface->GetScalingMode(sequence, scalingMode);
140         GraphicHDRMetaData metaData = GetData<GraphicHDRMetaData>();
141         std::vector<GraphicHDRMetaData> metaDatas = {metaData};
142         uint8_t metaData2 = GetData<uint8_t>();
143         std::vector<uint8_t> metaDatas2 = {metaData2};
144 
145         cSurface->SetMetaData(sequence, metaDatas);
146         GraphicHDRMetadataKey metakey = GetData<GraphicHDRMetadataKey>();
147         cSurface->SetMetaDataSet(sequence, metakey, metaDatas2);
148         HDRMetaDataType metaType = GetData<HDRMetaDataType>();
149         cSurface->QueryMetaDataType(sequence, metaType);
150         cSurface->GetMetaData(sequence, metaDatas);
151         cSurface->GetMetaDataSet(sequence, metakey, metaDatas2);
152         GraphicPresentTimestamp ptimestamp = GetData<GraphicPresentTimestamp>();
153         cSurface->SetPresentTimestamp(sequence, ptimestamp);
154         cSurface->GetTunnelHandle();
155         bool hold = GetData<bool>();
156         cSurface->SetBufferHold(hold);
157         cSurface->GoBackground();
158         cSurface->GetTransform();
159         GraphicTransformType hintType = GetData<GraphicTransformType>();
160         cSurface->SetTransformHint(hintType);
161         cSurface->GetTransformHint();
162         cSurface->UnregisterConsumerListener();
163         bool isIncache = GetData<bool>();
164         cSurface->IsSurfaceBufferInCache(sequence, isIncache);
165         pSurface->UnRegisterReleaseListener();
166     }
167 
SurfaceFuzzTest1(sptr<OHOS::Surface> pSurface,sptr<OHOS::IConsumerSurface> cSurface)168     void SurfaceFuzzTest1(sptr<OHOS::Surface> pSurface, sptr<OHOS::IConsumerSurface> cSurface)
169     {
170         pSurface->IsConsumer();
171         cSurface->IsConsumer();
172         bool cleanAll = GetData<bool>();
173         pSurface->CleanCache(cleanAll);
174         pSurface->QueryIfBufferAvailable();
175         pSurface->GetName();
176         pSurface->GoBackground();
177         pSurface->Connect();
178         uint64_t defaultUsage = GetData<uint64_t>();
179         pSurface->SetDefaultUsage(defaultUsage);
180         pSurface->GetDefaultUsage();
181         std::string userKey = GetStringFromData(STR_LEN);
182         pSurface->GetUserData(userKey);
183         sptr<SyncFence> syncFence = new SyncFence(-1);
184         uint32_t queueSize = GetData<uint32_t>();
185         int32_t fenceFd = syncFence->Get();
186         sptr<OHOS::SurfaceBuffer> buffer = new SurfaceBufferImpl(GetData<uint32_t>());
187         BufferRequestConfig requestConfig = GetData<BufferRequestConfig>();
188         BufferFlushConfig flushConfig = GetData<BufferFlushConfig>();
189         pSurface->RequestBuffer(buffer, fenceFd, requestConfig);
190         pSurface->CancelBuffer(buffer);
191         pSurface->FlushBuffer(buffer, fenceFd, flushConfig);
192         pSurface->AttachBuffer(buffer);
193         pSurface->DetachBuffer(buffer);
194         int32_t timeout = 0;
195         pSurface->AttachBuffer(buffer, timeout);
196         pSurface->DetachBuffer(buffer);
197         pSurface->SetQueueSize(queueSize);
198         Rect damage = GetData<Rect>();
199         int64_t timestamp = GetData<int64_t>();
200         cSurface->AcquireBuffer(buffer, fenceFd, timestamp, damage);
201         cSurface->ReleaseBuffer(buffer, fenceFd);
202         cSurface->AttachBuffer(buffer);
203         cSurface->DetachBuffer(buffer);
204         sptr<SurfaceBuffer> buffer1 = SurfaceBuffer::Create();
205         cSurface->AttachBuffer(buffer1, timeout);
206         cSurface->DetachBuffer(buffer1);
207         cSurface->AttachBufferToQueue(buffer);
208         cSurface->DetachBufferFromQueue(buffer);
209         cSurface->SetQueueSize(queueSize);
210     }
211 
SurfaceFuzzTest2()212     void SurfaceFuzzTest2()
213     {
214         // get data
215         std::string name = GetStringFromData(STR_LEN);
216         bool isShared = GetData<bool>();
217         std::string key = GetStringFromData(STR_LEN);
218         std::string val = GetStringFromData(STR_LEN);
219         BufferVerifyAllocInfo info = GetData<BufferVerifyAllocInfo>();
220         uint32_t sequence = GetData<uint32_t>();
221         ScalingMode scalingMode = GetData<ScalingMode>();
222         GraphicPresentTimestampType type = GetData<GraphicPresentTimestampType>();
223         int64_t time = GetData<int64_t>();
224         std::string result = GetStringFromData(STR_LEN);
225         sptr<OHOS::IConsumerSurface> cSurface = OHOS::IConsumerSurface::Create(name, isShared);
226         auto producer = cSurface->GetProducer();
227         sptr<OHOS::Surface> pSurface = OHOS::Surface::CreateSurfaceAsProducer(producer);
228         sptr<ProducerSurfaceDelegator> surfaceDelegator = ProducerSurfaceDelegator::Create();
229         cSurface->RegisterSurfaceDelegator(surfaceDelegator->AsObject());
230         cSurface->QueryIfBufferAvailable();
231         sptr<IBufferConsumerListener> listener = new BufferConsumerListener();
232         cSurface->RegisterConsumerListener(listener);
233         TestConsumerListenerClazz* listenerClazz = new TestConsumerListenerClazz();
234         cSurface->RegisterConsumerListener(listenerClazz);
235         cSurface->RegisterReleaseListener([](sptr<SurfaceBuffer> &buffer) { return GSERROR_OK; });
236         cSurface->RegisterDeleteBufferListener(BufferDeleteCbFunc);
237         std::string funcName = GetStringFromData(STR_LEN);
238         cSurface->RegisterUserDataChangeListener(funcName,
239             [](const std::string& key, const std::string& val) {});
240         pSurface->SetUserData(key, val);
241         bool supported = GetData<bool>();
242         std::vector<bool> supporteds = {supported};
243         std::vector<BufferVerifyAllocInfo> infos = {info};
244         pSurface->IsSupportedAlloc(infos, supporteds);
245         pSurface->SetScalingMode(sequence, scalingMode);
246         pSurface->GetPresentTimestamp(sequence, type, time);
247         cSurface->SetUserData(key, val);
248         cSurface->Dump(result);
249         cSurface->GetDefaultWidth();
250         cSurface->GetDefaultUsage();
251         cSurface->GetHdrWhitePointBrightness();
252         cSurface->GetName();
253         cSurface->GetDefaultHeight();
254         cSurface->GetSdrWhitePointBrightness();
255         SurfaceFuzzTest1(pSurface, cSurface);
256         SurfaceFuzzTest3(pSurface, cSurface);
257         SurfaceFuzzTest4(pSurface, cSurface);
258         MetadataHelperFuzzTest();
259     }
260 
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)261     bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
262     {
263         if (data == nullptr) {
264             return false;
265         }
266         g_data = data;
267         g_size = size;
268         g_pos = 0;
269         std::string name = GetStringFromData(STR_LEN);
270         bool isShared = GetData<bool>();
271         uint32_t seqNum = GetData<uint32_t>();
272         sptr<OHOS::IConsumerSurface> cSurface = OHOS::IConsumerSurface::Create(name, isShared);
273         auto producer = cSurface->GetProducer();
274         sptr<OHOS::Surface> pSurface = OHOS::Surface::CreateSurfaceAsProducer(producer);
275         sptr<ProducerSurfaceDelegator> surfaceDelegator = ProducerSurfaceDelegator::Create();
276         pSurface->RegisterSurfaceDelegator(surfaceDelegator->AsObject());
277         pSurface->RegisterReleaseListener([](sptr<SurfaceBuffer> &buffer) ->
278             GSError {
279                 return GSERROR_OK;
280         });
281         pSurface->RegisterReleaseListener([](const sptr<SurfaceBuffer> &buffer, const sptr<SyncFence> &fence) ->
282             GSError {
283                 return GSERROR_OK;
284         });
285         std::string funcName = GetStringFromData(STR_LEN);
286         pSurface->RegisterUserDataChangeListener(funcName,
287             [](const std::string& key, const std::string& value) -> void {});
288         sptr<OHOS::SurfaceBuffer> buffer = new SurfaceBufferImpl(seqNum);
289         sptr<SyncFence> syncFence = SyncFence::INVALID_FENCE;
290         float matrix[16];
291         uint32_t matrixSize = GetData<uint32_t>();
292         bool isUseNewMatrix = GetData<bool>();
293         pSurface->AcquireLastFlushedBuffer(buffer, syncFence, matrix, matrixSize, isUseNewMatrix);
294         pSurface->ReleaseLastFlushedBuffer(buffer);
295         GraphicTransformType transformType;
296         cSurface->GetSurfaceBufferTransformType(buffer, &transformType);
297         SurfaceFuzzTest2();
298         pSurface->UnRegisterUserDataChangeListener(funcName);
299         pSurface->ClearUserDataChangeListener();
300         cSurface->ClearUserDataChangeListener();
301         sptr<OHOS::Surface> tmp = OHOS::Surface::CreateSurfaceAsConsumer();
302         tmp->RegisterConsumerListener(nullptr);
303         return true;
304     }
305 } // namespace OHOS
306 
307 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)308 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
309 {
310     /* Run your code on data */
311     OHOS::DoSomethingInterestingWithMyAPI(data, size);
312     return 0;
313 }
314 
315