1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstddef>
17 #include <cstdint>
18 #include <fcntl.h>
19 #include <unistd.h>
20 #include <sys/stat.h>
21 #include "native_avdemuxer.h"
22 #include "native_avformat.h"
23 #include "native_avsource.h"
24 #include "native_avmemory.h"
25
26 #define FUZZ_PROJECT_NAME "demuxer_fuzzer"
27 namespace OHOS {
GetFileSize(const char * fileName)28 static int64_t GetFileSize(const char *fileName)
29 {
30 int64_t fileSize = 0;
31 if (fileName != nullptr) {
32 struct stat fileStatus {};
33 if (stat(fileName, &fileStatus) == 0) {
34 fileSize = static_cast<int64_t>(fileStatus.st_size);
35 }
36 }
37 return fileSize;
38 }
39
SetVarValue(OH_AVCodecBufferAttr attr,const int & tarckType,bool & audioIsEnd,bool & videoIsEnd)40 static void SetVarValue(OH_AVCodecBufferAttr attr, const int &tarckType, bool &audioIsEnd, bool &videoIsEnd)
41 {
42 if (tarckType == MEDIA_TYPE_AUD && (attr.flags & OH_AVCodecBufferFlags::AVCODEC_BUFFER_FLAGS_EOS)) {
43 audioIsEnd = true;
44 }
45
46 if (tarckType == MEDIA_TYPE_VID && (attr.flags & OH_AVCodecBufferFlags::AVCODEC_BUFFER_FLAGS_EOS)) {
47 videoIsEnd = true;
48 }
49 }
50
RunNormalDemuxer()51 void RunNormalDemuxer()
52 {
53 int tarckType = 0;
54 int32_t trackCount;
55 OH_AVCodecBufferAttr attr;
56 bool audioIsEnd = false;
57 bool videoIsEnd = false;
58 const char *file = "/data/test/media/01_video_audio.mp4";
59 int fd = open(file, O_RDONLY);
60 int64_t size = GetFileSize(file);
61 OH_AVSource *source = OH_AVSource_CreateWithFD(fd, 0, size);
62 if (!source) {
63 return;
64 }
65 OH_AVDemuxer *demuxer = OH_AVDemuxer_CreateWithSource(source);
66 if (!demuxer) {
67 return;
68 }
69
70 OH_AVFormat *sourceFormat = OH_AVSource_GetSourceFormat(source);
71 OH_AVFormat_GetIntValue(sourceFormat, OH_MD_KEY_TRACK_COUNT, &trackCount);
72 for (int32_t index = 0; index < trackCount; index++) {
73 OH_AVDemuxer_SelectTrackByID(demuxer, index);
74 }
75 static int32_t width = 3840;
76 static int32_t height = 2160;
77 OH_AVMemory *memory = OH_AVMemory_Create(width * height);
78 while (!audioIsEnd || !videoIsEnd) {
79 for (int32_t index = 0; index < trackCount; index++) {
80 OH_AVFormat *trackFormat = OH_AVSource_GetTrackFormat(source, index);
81 OH_AVFormat_GetIntValue(trackFormat, OH_MD_KEY_TRACK_TYPE, &tarckType);
82 if ((audioIsEnd && (tarckType == MEDIA_TYPE_AUD)) || (videoIsEnd && (tarckType == MEDIA_TYPE_VID))) {
83 continue;
84 }
85 OH_AVDemuxer_ReadSample(demuxer, index, memory, &attr);
86 SetVarValue(attr, tarckType, audioIsEnd, videoIsEnd);
87 }
88 }
89 OH_AVDemuxer_Destroy(demuxer);
90 OH_AVSource_Destroy(source);
91 close(fd);
92 }
93
RunNormalDemuxerApi11()94 void RunNormalDemuxerApi11()
95 {
96 int tarckType = 0;
97 int32_t trackCount;
98 OH_AVCodecBufferAttr attr;
99 bool audioIsEnd = false;
100 bool videoIsEnd = false;
101 const char *file = "/data/test/media/01_video_audio.mp4";
102 int fd = open(file, O_RDONLY);
103 int64_t size = GetFileSize(file);
104 OH_AVSource *source = OH_AVSource_CreateWithFD(fd, 0, size);
105 if (!source) {
106 return;
107 }
108 OH_AVDemuxer *demuxer = OH_AVDemuxer_CreateWithSource(source);
109 if (!demuxer) {
110 return;
111 }
112
113 OH_AVFormat *sourceFormat = OH_AVSource_GetSourceFormat(source);
114 OH_AVFormat_GetIntValue(sourceFormat, OH_MD_KEY_TRACK_COUNT, &trackCount);
115 for (int32_t index = 0; index < trackCount; index++) {
116 OH_AVDemuxer_SelectTrackByID(demuxer, index);
117 }
118 static int32_t width = 3840;
119 static int32_t height = 2160;
120 OH_AVBuffer *buffer = OH_AVBuffer_Create(width * height);
121 while (!audioIsEnd || !videoIsEnd) {
122 for (int32_t index = 0; index < trackCount; index++) {
123 OH_AVFormat *trackFormat = OH_AVSource_GetTrackFormat(source, index);
124 OH_AVFormat_GetIntValue(trackFormat, OH_MD_KEY_TRACK_TYPE, &tarckType);
125 if ((audioIsEnd && (tarckType == MEDIA_TYPE_AUD)) || (videoIsEnd && (tarckType == MEDIA_TYPE_VID))) {
126 continue;
127 }
128 OH_AVDemuxer_ReadSampleBuffer(demuxer, index, buffer);
129 OH_AVBuffer_GetBufferAttr(buffer, &attr);
130 SetVarValue(attr, tarckType, audioIsEnd, videoIsEnd);
131 }
132 }
133 OH_AVDemuxer_Destroy(demuxer);
134 OH_AVSource_Destroy(source);
135 close(fd);
136 }
137
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)138 bool DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
139 {
140 if (size < sizeof(int64_t)) {
141 return false;
142 }
143 RunNormalDemuxer();
144 RunNormalDemuxerApi11();
145 // FUZZ CreateFD
146 int32_t fd = *reinterpret_cast<const int32_t *>(data);
147 int64_t offset = *reinterpret_cast<const int64_t *>(data);
148 int64_t fileSize = *reinterpret_cast<const int64_t *>(data);
149 OH_AVSource *source = OH_AVSource_CreateWithFD(fd, offset, fileSize);
150 if (source) {
151 OH_AVSource_Destroy(source);
152 }
153 return true;
154 }
155 } // namespace OHOS
156
157 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)158 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
159 {
160 /* Run your code on data */
161 OHOS::DoSomethingInterestingWithMyAPI(data, size);
162 return 0;
163 }
164