1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "capture_session_fuzzer.h"
17 #include "camera_input.h"
18 #include "camera_log.h"
19 #include "camera_photo_proxy.h"
20 #include "capture_input.h"
21 #include "capture_output.h"
22 #include "capture_scene_const.h"
23 #include "input/camera_manager.h"
24 #include "message_parcel.h"
25 #include "refbase.h"
26 #include <cstddef>
27 #include <cstdint>
28 #include <memory>
29 #include "token_setproc.h"
30 #include "nativetoken_kit.h"
31 #include "accesstoken_kit.h"
32 
33 namespace OHOS {
34 namespace CameraStandard {
35 namespace CaptureSessionFuzzer {
36 const int32_t LIMITSIZE = 4;
37 const int32_t NUM_2 = 2;
38 sptr<IBufferProducer> surface;
39 sptr<CameraDevice> camera;
40 Profile profile;
41 CaptureOutput* curOutput;
42 bool g_isSupported;
43 bool g_isCameraDevicePermission = false;
44 SceneMode g_sceneMode;
45 
GetPermission()46 void GetPermission()
47 {
48     uint64_t tokenId;
49     const char* perms[2];
50     perms[0] = "ohos.permission.DISTRIBUTED_DATASYNC";
51     perms[1] = "ohos.permission.CAMERA";
52     NativeTokenInfoParams infoInstance = {
53         .dcapsNum = 0,
54         .permsNum = 2,
55         .aclsNum = 0,
56         .dcaps = NULL,
57         .perms = perms,
58         .acls = NULL,
59         .processName = "native_camera_tdd",
60         .aplStr = "system_basic",
61     };
62     tokenId = GetAccessTokenId(&infoInstance);
63     SetSelfTokenID(tokenId);
64     OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
65 }
66 
Test(uint8_t * rawData,size_t size)67 void Test(uint8_t *rawData, size_t size)
68 {
69     if (rawData == nullptr || size < LIMITSIZE) {
70         return;
71     }
72     GetPermission();
73     MessageParcel data;
74     data.WriteRawData(rawData, size);
75     g_sceneMode = static_cast<SceneMode>(
76         data.ReadInt32() % (SceneMode::APERTURE_VIDEO + NUM_2));
77     auto manager = CameraManager::GetInstance();
78     auto session = manager->CreateCaptureSession(g_sceneMode);
79     CHECK_AND_RETURN_LOG(manager, "CaptureSessionFuzzer: CreateCaptureSession Error");
80     TestCallback(session, rawData, size);
81     TestSession(session, rawData, size);
82     TestWhiteBalance(session, rawData, size);
83     TestExposure(session, rawData, size);
84     TestFocus(session, rawData, size);
85     TestZoom(session, rawData, size);
86     TestStabilization(session, rawData, size);
87     TestCreateMediaLibrary(session, rawData, size);
88     TestProcess(session, rawData, size);
89     TestAperture(session, rawData, size);
90     TestBeauty(session, rawData, size);
91     TestOther(session, rawData, size);
92     session->Release();
93     session->Stop();
94 }
95 
GetCameraInput(uint8_t * rawData,size_t size)96 sptr<CaptureInput> GetCameraInput(uint8_t *rawData, size_t size)
97 {
98     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
99     auto manager = CameraManager::GetInstance();
100     auto cameras = manager->GetSupportedCameras();
101     CHECK_AND_RETURN_RET_LOG(cameras.size() >= NUM_2, nullptr, "CaptureSessionFuzzer: GetSupportedCameras Error");
102     MessageParcel data;
103     data.WriteRawData(rawData, size);
104     camera = cameras[data.ReadUint32() % cameras.size()];
105     CHECK_AND_RETURN_RET_LOG(camera, nullptr, "CaptureSessionFuzzer: Camera is null Error");
106     return manager->CreateCameraInput(camera);
107 }
108 
GetCaptureOutput(uint8_t * rawData,size_t size)109 sptr<PhotoOutput> GetCaptureOutput(uint8_t *rawData, size_t size)
110 {
111     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
112     auto manager = CameraManager::GetInstance();
113     CHECK_AND_RETURN_RET_LOG(manager, nullptr, "CaptureSessionFuzzer: CameraManager::GetInstance Error");
114     MessageParcel data;
115     data.WriteRawData(rawData, size);
116     CHECK_AND_RETURN_RET_LOG(camera, nullptr, "CaptureSessionFuzzer: Camera is null Error");
117     auto capability = manager->GetSupportedOutputCapability(camera, g_sceneMode);
118     CHECK_AND_RETURN_RET_LOG(capability, nullptr, "CaptureSessionFuzzer: GetSupportedOutputCapability Error");
119     auto profiles = capability->GetPhotoProfiles();
120     CHECK_AND_RETURN_RET_LOG(!profiles.empty(), nullptr, "CaptureSessionFuzzer: GetPhotoProfiles empty");
121     profile = profiles[data.ReadUint32() % profiles.size()];
122     sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
123     CHECK_AND_RETURN_RET_LOG(photoSurface, nullptr, "CaptureSessionFuzzer: create photoSurface Error");
124     surface = photoSurface->GetProducer();
125     CHECK_AND_RETURN_RET_LOG(surface, nullptr, "CaptureSessionFuzzer: surface GetProducer Error");
126     return manager->CreatePhotoOutput(profile, surface);
127 }
128 
TestWhiteBalance(sptr<CaptureSession> session,uint8_t * rawData,size_t size)129 void TestWhiteBalance(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
130 {
131     MessageParcel data;
132     data.WriteRawData(rawData, size);
133 }
134 
TestExposure(sptr<CaptureSession> session,uint8_t * rawData,size_t size)135 void TestExposure(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
136 {
137     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
138     MessageParcel data;
139     data.WriteRawData(rawData, size);
140     session->GetSupportedExposureModes();
141     vector<ExposureMode> exposureModes;
142     session->GetSupportedExposureModes(exposureModes);
143     ExposureMode exposureMode = static_cast<ExposureMode>(
144         data.ReadInt32() % (ExposureMode::EXPOSURE_MODE_CONTINUOUS_AUTO + NUM_2));
145     session->IsExposureModeSupported(exposureMode);
146     session->IsExposureModeSupported(exposureMode, g_isSupported);
147     session->GetExposureMode();
148     session->GetExposureMode(exposureMode);
149     session->GetMeteringPoint();
150     Point exposurePoint;
151     session->GetMeteringPoint(exposurePoint);
152     session->GetExposureBiasRange();
153     vector<float> exposureBiasRange;
154     session->GetExposureBiasRange(exposureBiasRange);
155     session->GetExposureValue();
156     float exposure;
157     session->GetExposureValue(exposure);
158 
159     session->LockForControl();
160     session->SetExposureMode(exposureMode);
161     session->SetMeteringPoint(exposurePoint);
162     float exposureBias = data.ReadFloat();
163     session->SetExposureBias(exposureBias);
164     vector<uint32_t> sensorExposureTimeRange;
165     session->GetSensorExposureTimeRange(sensorExposureTimeRange);
166     session->SetSensorExposureTime(data.ReadUint32());
167     uint32_t sensorExposureTime;
168     session->GetSensorExposureTime(sensorExposureTime);
169     session->UnlockForControl();
170 }
171 
TestFocus(sptr<CaptureSession> session,uint8_t * rawData,size_t size)172 void TestFocus(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
173 {
174     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
175     MessageParcel data;
176     data.WriteRawData(rawData, size);
177     session->GetSupportedFocusModes();
178     vector<FocusMode> focusModes;
179     session->GetSupportedFocusModes(focusModes);
180     FocusMode focusMode = static_cast<FocusMode>(
181         data.ReadInt32() % (FocusMode::FOCUS_MODE_LOCKED + NUM_2));
182     session->IsFocusModeSupported(focusMode);
183     session->IsFocusModeSupported(focusMode, g_isSupported);
184     session->GetFocusMode();
185     session->GetFocusMode(focusMode);
186     session->GetFocusPoint();
187     Point focusPoint;
188     session->GetFocusPoint(focusPoint);
189     session->GetFocalLength();
190     float focalLength;
191     session->GetFocalLength(focalLength);
192     float distance;
193     session->GetFocusDistance(distance);
194     session->GetMinimumFocusDistance();
195 
196     session->LockForControl();
197     session->SetFocusMode(focusMode);
198     session->SetFocusPoint(focusPoint);
199     session->UnlockForControl();
200 }
201 
TestZoom(sptr<CaptureSession> session,uint8_t * rawData,size_t size)202 void TestZoom(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
203 {
204     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
205     MessageParcel data;
206     data.WriteRawData(rawData, size);
207     session->GetZoomRatioRange();
208     vector<float> zoomRatioRange;
209     session->GetZoomRatioRange(zoomRatioRange);
210     session->GetZoomRatio();
211     float zoomRatio;
212     session->GetZoomRatio(zoomRatio);
213     vector<ZoomPointInfo> zoomPointInfoList;
214     session->GetZoomPointInfos(zoomPointInfoList);
215 
216     session->LockForControl();
217     session->SetZoomRatio(zoomRatio);
218     session->PrepareZoom();
219     session->UnPrepareZoom();
220     float targetZoomRatio = data.ReadFloat();
221     uint32_t smoothZoomType = data.ReadUint32();
222     session->SetSmoothZoom(targetZoomRatio, smoothZoomType);
223     session->UnlockForControl();
224 }
225 
TestCallback(sptr<CaptureSession> session,uint8_t * rawData,size_t size)226 void TestCallback(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
227 {
228     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
229     MessageParcel data;
230     data.WriteRawData(rawData, size);
231     session->SetCallback(make_shared<SessionCallbackMock>());
232     session->SetExposureCallback(make_shared<ExposureCallbackMock>());
233     session->SetFocusCallback(make_shared<FocusCallbackMock>());
234     session->SetSmoothZoomCallback(make_shared<SmoothZoomCallbackMock>());
235     session->SetMacroStatusCallback(make_shared<MacroStatusCallbackMock>());
236     session->SetMoonCaptureBoostStatusCallback(make_shared<MoonCaptureBoostStatusCallbackMock>());
237     auto fdsCallback = make_shared<FeatureDetectionStatusCallbackMock>(data.ReadInt32() % 1);
238     session->SetFeatureDetectionStatusCallback(fdsCallback);
239     session->SetEffectSuggestionCallback(make_shared<EffectSuggestionCallbackMock>());
240     session->SetARCallback(make_shared<ARCallbackMock>());
241     session->SetAbilityCallback(make_shared<AbilityCallbackMock>());
242 
243     session->GetApplicationCallback();
244     session->GetExposureCallback();
245     session->GetFocusCallback();
246     session->GetMacroStatusCallback();
247     session->GetMoonCaptureBoostStatusCallback();
248     session->GetFeatureDetectionStatusCallback();
249     session->GetSmoothZoomCallback();
250     session->GetARCallback();
251 }
252 
TestStabilization(sptr<CaptureSession> session,uint8_t * rawData,size_t size)253 void TestStabilization(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
254 {
255     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
256     MessageParcel data;
257     data.WriteRawData(rawData, size);
258     session->GetSupportedStabilizationMode();
259     vector<VideoStabilizationMode> modes;
260     session->GetSupportedStabilizationMode(modes);
261     data.RewindRead(0);
262     VideoStabilizationMode stabilizationMode = static_cast<VideoStabilizationMode>(
263         data.ReadInt32() % (VideoStabilizationMode::AUTO + NUM_2));
264     session->IsVideoStabilizationModeSupported(stabilizationMode);
265     session->IsVideoStabilizationModeSupported(stabilizationMode, g_isSupported);
266     VideoStabilizationMode mode;
267     session->GetActiveVideoStabilizationMode();
268     session->GetActiveVideoStabilizationMode(mode);
269 
270     session->SetVideoStabilizationMode(stabilizationMode);
271 }
272 
TestFlash(sptr<CaptureSession> session,uint8_t * rawData,size_t size)273 void TestFlash(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
274 {
275     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
276     // 执行这段测试会卡死
277     MessageParcel data;
278     data.WriteRawData(rawData, size);
279     session->GetSupportedFlashModes();
280     vector<FlashMode> flashModes;
281     session->GetSupportedFlashModes(flashModes);
282     session->HasFlash();
283     bool hasFlash;
284     session->HasFlash(hasFlash);
285     FlashMode flashMode = static_cast<FlashMode>(
286         data.ReadInt32() % (FlashMode::FLASH_MODE_ALWAYS_OPEN + NUM_2));
287     session->IsFlashModeSupported(flashMode);
288     session->IsFlashModeSupported(flashMode, g_isSupported);
289     session->GetFlashMode();
290     session->GetFlashMode(flashMode);
291     session->LockForControl();
292     session->SetFlashMode(flashMode);
293     session->LockForControl();
294 }
295 
TestCreateMediaLibrary(sptr<CaptureSession> session,uint8_t * rawData,size_t size)296 void TestCreateMediaLibrary(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
297 {
298     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
299     MessageParcel data;
300     data.WriteRawData(rawData, size);
301     sptr<CameraPhotoProxy> photoProxy{new CameraPhotoProxy()};
302     std::string uri;
303     int32_t cameraShotType;
304     std::string burstKey;
305     int64_t timestamp = data.ReadInt64();
306     session->CreateMediaLibrary(photoProxy, uri, cameraShotType, burstKey, timestamp);
307 }
308 
TestProcess(sptr<CaptureSession> session,uint8_t * rawData,size_t size)309 void TestProcess(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
310 {
311     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
312     MessageParcel data;
313     data.WriteRawData(rawData, size);
314     static const size_t ITEM_CAP = 10;
315     static const size_t DATA_CAP = 100;
316     shared_ptr<OHOS::Camera::CameraMetadata> result = make_shared<OHOS::Camera::CameraMetadata>(ITEM_CAP, DATA_CAP);
317     int32_t idata = data.ReadInt32();
318     result->addEntry(OHOS_CONTROL_EXPOSURE_MODE, &idata, 1);
319     result->addEntry(OHOS_CONTROL_FOCUS_MODE, &idata, 1);
320     camera_rational_t cr = {data.ReadInt32(), data.ReadInt32()};
321     result->addEntry(OHOS_STATUS_SENSOR_EXPOSURE_TIME, &cr, 1);
322     result->addEntry(CAMERA_POSITION_FRONT, &idata, 1);
323     result->addEntry(OHOS_CAMERA_CUSTOM_SNAPSHOT_DURATION, &idata, 1);
324     result->addEntry(OHOS_CAMERA_MACRO_STATUS, &idata, 1);
325     result->addEntry(OHOS_STATUS_MOON_CAPTURE_DETECTION, &idata, 1);
326     result->addEntry(OHOS_CAMERA_EFFECT_SUGGESTION_TYPE, &idata, 1);
327     session->ProcessAutoExposureUpdates(result);
328     session->ProcessAutoFocusUpdates(result);
329     session->ProcessAREngineUpdates(data.ReadUint64(), result);
330     session->ProcessSnapshotDurationUpdates(data.ReadUint64(), result);
331     session->ProcessMacroStatusChange(result);
332     session->ProcessMoonCaptureBoostStatusChange(result);
333     session->ProcessEffectSuggestionTypeUpdates(result);
334 }
335 
TestAperture(sptr<CaptureSession> session,uint8_t * rawData,size_t size)336 void TestAperture(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
337 {
338     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
339     MessageParcel data;
340     data.WriteRawData(rawData, size);
341     uint32_t moduleType;
342     session->GetModuleType(moduleType);
343     session->IsEffectSuggestionSupported();
344     session->GetSupportedEffectSuggestionInfo();
345     session->GetSupportedEffectSuggestionType();
346 
347     session->LockForControl();
348     session->SetARMode(data.ReadBool());
349     session->EnableEffectSuggestion(data.ReadBool());
350     vector<EffectSuggestionStatus> effectSuggestionStatusList;
351     size_t max = EffectSuggestionType::EFFECT_SUGGESTION_SUNRISE_SUNSET + NUM_2;
352     for (size_t i = 0; i < data.ReadInt32() % max; i++) {
353         EffectSuggestionStatus status = {
354             static_cast<EffectSuggestionType>(data.ReadInt32() % max),
355             data.ReadBool(),
356         };
357         effectSuggestionStatusList.push_back(status);
358     }
359     session->SetEffectSuggestionStatus(effectSuggestionStatusList);
360     EffectSuggestionType effectSuggestionType = static_cast<EffectSuggestionType>(data.ReadInt32() % max);
361     session->UpdateEffectSuggestion(effectSuggestionType, data.ReadBool());
362     session->UnlockForControl();
363 }
364 
TestBeauty(sptr<CaptureSession> session,uint8_t * rawData,size_t size)365 void TestBeauty(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
366 {
367     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
368     MessageParcel data;
369     data.WriteRawData(rawData, size);
370     session->GetSupportedFilters();
371     session->GetSupportedBeautyTypes();
372     BeautyType type = static_cast<BeautyType>(
373         data.ReadInt32() % (BeautyType::SKIN_TONE + NUM_2));
374     session->GetSupportedBeautyRange(type);
375     session->GetBeauty(type);
376     session->GetSupportedColorSpaces();
377     ColorSpace colorSpace;
378     session->GetActiveColorSpace(colorSpace);
379     session->GetSupportedColorEffects();
380     session->GetColorEffect();
381 
382     session->GetFilter();
383     FilterType filter = static_cast<FilterType>(
384         data.ReadInt32() % (FilterType::PINK + NUM_2));
385     session->LockForControl();
386     session->SetFilter(filter);
387     session->SetColorSpace(colorSpace);
388     ColorEffect colorEffect = static_cast<ColorEffect>(
389         data.ReadInt32() % (ColorEffect::COLOR_EFFECT_BLACK_WHITE + NUM_2));
390     session->SetColorEffect(colorEffect);
391     BeautyType beautyType = static_cast<BeautyType>(
392         data.ReadInt32() % (BeautyType::SKIN_TONE + NUM_2));
393     session->SetBeautyValue(beautyType, data.ReadInt32());
394     session->SetBeauty(type, data.ReadInt32());
395     session->UnlockForControl();
396 }
397 
TestOther(sptr<CaptureSession> session,uint8_t * rawData,size_t size)398 void TestOther(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
399 {
400     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
401     MessageParcel data;
402     data.WriteRawData(rawData, size);
403     session->IsMacroSupported();
404     session->IsMovingPhotoSupported();
405     session->IsMoonCaptureBoostSupported();
406     SceneFeature feature = static_cast<SceneFeature>(
407         data.ReadInt32() % (SceneFeature::FEATURE_ENUM_MAX + NUM_2));
408     session->IsFeatureSupported(feature);
409     vector<int32_t> sensitivityRange;
410     session->GetSensorSensitivityRange(sensitivityRange);
411     session->GetFeaturesMode();
412     session->GetSubFeatureMods();
413     session->IsSetEnableMacro();
414     session->GetMetaOutput();
415     session->GetMetadata();
416     session->IsMovingPhotoEnabled();
417     session->IsImageDeferred();
418     session->CanSetFrameRateRange(data.ReadInt32(), data.ReadInt32(), curOutput);
419     session->CanSetFrameRateRangeForOutput(data.ReadInt32(), data.ReadInt32(), curOutput);
420 
421     session->ExecuteAbilityChangeCallback();
422 
423     session->EnableFeature(feature, data.ReadBool());
424     vector<int32_t> frameRateRange{data.ReadInt32(), data.ReadInt32()};
425     session->SetFrameRateRange(frameRateRange);
426     DeferredDeliveryImageType deferredType = static_cast<DeferredDeliveryImageType>(
427         data.ReadInt32() % (DeferredDeliveryImageType::DELIVERY_VIDEO + NUM_2));
428     session->EnableDeferredType(deferredType, data.ReadBool());
429     session->SetUserId();
430     session->EnableAutoHighQualityPhoto(data.ReadBool());
431 }
432 
TestOther2(sptr<CaptureSession> session,uint8_t * rawData,size_t size)433 void TestOther2(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
434 {
435     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
436     // 执行这段测试会卡死
437     MessageParcel data;
438     data.WriteRawData(rawData, size);
439     session->LockForControl();
440     camera_face_detect_mode_t t = static_cast<camera_face_detect_mode_t>(
441         data.ReadInt32() % (camera_face_detect_mode_t::OHOS_CAMERA_FACE_DETECT_MODE_SIMPLE + NUM_2));
442     set<camera_face_detect_mode_t> metadataObjectTypes;
443     metadataObjectTypes.insert(t);
444     session->SetCaptureMetadataObjectTypes(metadataObjectTypes);
445     uint32_t ability = data.ReadUint32();
446     session->VerifyAbility(ability);
447     session->SetFocusDistance(data.ReadFloat());
448     session->EnableMacro(data.ReadBool());
449     session->EnableMovingPhoto(data.ReadBool());
450     session->EnableMovingPhotoMirror(data.ReadBool(), data.ReadBool());
451     session->EnableMoonCaptureBoost(data.ReadBool());
452     session->SetSensorSensitivity(data.ReadUint32());
453     session->UnlockForControl();
454 }
455 
TestSession(sptr<CaptureSession> session,uint8_t * rawData,size_t size)456 void TestSession(sptr<CaptureSession> session, uint8_t *rawData, size_t size)
457 {
458     MEDIA_INFO_LOG("CaptureSessionFuzzer: ENTER");
459     sptr<CaptureInput> input = GetCameraInput(rawData, size);
460     sptr<CaptureOutput> output = GetCaptureOutput(rawData, size);
461     CHECK_AND_RETURN_LOG(input && output && session, "CaptureSessionFuzzer: input/output/session is null");
462     MessageParcel data;
463     data.WriteRawData(rawData, size);
464     session->SetMode(g_sceneMode);
465     session->GetMode();
466     PreconfigType preconfigType = static_cast<PreconfigType>(
467         data.ReadInt32() % (PreconfigType::PRECONFIG_HIGH_QUALITY + NUM_2));
468     ProfileSizeRatio preconfigRatio = static_cast<ProfileSizeRatio>(
469         data.ReadInt32() % (ProfileSizeRatio::RATIO_16_9 + NUM_2));
470     session->CanPreconfig(preconfigType, preconfigRatio);
471     session->Preconfig(preconfigType, preconfigRatio);
472     session->BeginConfig();
473     session->CanAddInput(input);
474     session->AddInput(input);
475     session->CanAddOutput(output);
476     session->AddOutput(output);
477     session->RemoveInput(input);
478     session->RemoveOutput(output);
479     session->AddInput(input);
480     session->AddOutput(output);
481     session->AddSecureOutput(output);
482     input->Open();
483     session->CommitConfig();
484     session->Start();
485     curOutput = output.GetRefPtr();
486     CaptureOutputType outputType = static_cast<CaptureOutputType>(
487         data.ReadInt32() % (CaptureOutputType::CAPTURE_OUTPUT_TYPE_MAX + NUM_2));
488     session->ValidateOutputProfile(profile, outputType);
489 }
490 
491 } // namespace StreamRepeatStubFuzzer
492 } // namespace CameraStandard
493 } // namespace OHOS
494 
495 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)496 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
497 {
498     /* Run your code on data */
499     OHOS::CameraStandard::CaptureSessionFuzzer::Test(data, size);
500     return 0;
501 }