1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "camera_input_fuzzer.h"
17 #include "camera_input.h"
18 #include "camera_log.h"
19 #include "input/camera_device.h"
20 #include "input/camera_manager.h"
21 #include "message_parcel.h"
22 #include <cstddef>
23 #include <cstdint>
24 #include <memory>
25 #include "token_setproc.h"
26 #include "nativetoken_kit.h"
27 #include "accesstoken_kit.h"
28
29 namespace OHOS {
30 namespace CameraStandard {
31 namespace CameraInputFuzzer {
32 const int32_t LIMITSIZE = 4;
33 const int32_t CAM_NUM = 2;
34 bool g_isCameraDevicePermission = false;
35
GetPermission()36 void GetPermission()
37 {
38 uint64_t tokenId;
39 const char* perms[2];
40 perms[0] = "ohos.permission.DISTRIBUTED_DATASYNC";
41 perms[1] = "ohos.permission.CAMERA";
42 NativeTokenInfoParams infoInstance = {
43 .dcapsNum = 0,
44 .permsNum = 2,
45 .aclsNum = 0,
46 .dcaps = NULL,
47 .perms = perms,
48 .acls = NULL,
49 .processName = "native_camera_tdd",
50 .aplStr = "system_basic",
51 };
52 tokenId = GetAccessTokenId(&infoInstance);
53 SetSelfTokenID(tokenId);
54 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
55 }
56
Test(uint8_t * rawData,size_t size)57 void Test(uint8_t *rawData, size_t size)
58 {
59 if (rawData == nullptr || size < LIMITSIZE) {
60 return;
61 }
62 GetPermission();
63 auto manager = CameraManager::GetInstance();
64 CHECK_AND_RETURN_LOG(manager, "CameraInputFuzzer: Get CameraManager instance Error");
65 auto cameras = manager->GetSupportedCameras();
66 CHECK_AND_RETURN_LOG(cameras.size() >= CAM_NUM, "CameraInputFuzzer: GetSupportedCameras Error");
67 MessageParcel data;
68 data.WriteRawData(rawData, size);
69 auto camera = cameras[data.ReadUint32() % cameras.size()];
70 CHECK_AND_RETURN_LOG(camera, "CameraInputFuzzer: Camera is null Error");
71 auto input = manager->CreateCameraInput(camera);
72 CHECK_AND_RETURN_LOG(input, "CameraInputFuzzer: CreateCameraInput Error");
73 TestInput(input, rawData, size);
74 }
75
TestInput(sptr<CameraInput> input,uint8_t * rawData,size_t size)76 void TestInput(sptr<CameraInput> input, uint8_t *rawData, size_t size)
77 {
78 MEDIA_INFO_LOG("CameraInputFuzzer: ENTER");
79 MessageParcel data;
80 data.WriteRawData(rawData, size);
81 input->Open();
82 input->SetErrorCallback(make_shared<ErrorCallbackMock>());
83 input->SetResultCallback(make_shared<ResultCallbackMock>());
84 input->GetCameraId();
85 input->GetCameraDevice();
86 input->GetErrorCallback();
87 input->GetResultCallback();
88 shared_ptr<OHOS::Camera::CameraMetadata> result;
89 data.RewindRead(0);
90 input->ProcessCallbackUpdates(data.ReadUint64(), result);
91 input->GetCameraSettings();
92 data.RewindRead(0);
93 input->SetCameraSettings(data.ReadString());
94 data.RewindRead(0);
95 input->GetMetaSetting(data.ReadUint32());
96 std::vector<vendorTag_t> infos;
97 input->GetCameraAllVendorTags(infos);
98 input->Release();
99 input->Close();
100 uint64_t secureSeqId;
101 data.RewindRead(0);
102 input->Open(data.ReadBool(), &secureSeqId);
103 input->Release();
104 }
105
106 } // namespace StreamRepeatStubFuzzer
107 } // namespace CameraStandard
108 } // namespace OHOS
109
110 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)111 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
112 {
113 /* Run your code on data */
114 OHOS::CameraStandard::CameraInputFuzzer::Test(data, size);
115 return 0;
116 }