1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "photo_output_fuzzer.h"
17 #include "camera_device.h"
18 #include "camera_log.h"
19 #include "camera_output_capability.h"
20 #include "capture_scene_const.h"
21 #include "input/camera_manager.h"
22 #include "message_parcel.h"
23 #include <cstdint>
24 #include <memory>
25 #include "token_setproc.h"
26 #include "nativetoken_kit.h"
27 #include "accesstoken_kit.h"
28
29 namespace OHOS {
30 namespace CameraStandard {
31 namespace PhotoOutputFuzzer {
32 const int32_t LIMITSIZE = 4;
33 const int32_t NUM_2 = 2;
34 bool g_isCameraDevicePermission = false;
35
GetPermission()36 void GetPermission()
37 {
38 uint64_t tokenId;
39 const char* perms[2];
40 perms[0] = "ohos.permission.DISTRIBUTED_DATASYNC";
41 perms[1] = "ohos.permission.CAMERA";
42 NativeTokenInfoParams infoInstance = {
43 .dcapsNum = 0,
44 .permsNum = 2,
45 .aclsNum = 0,
46 .dcaps = NULL,
47 .perms = perms,
48 .acls = NULL,
49 .processName = "native_camera_tdd",
50 .aplStr = "system_basic",
51 };
52 tokenId = GetAccessTokenId(&infoInstance);
53 SetSelfTokenID(tokenId);
54 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
55 }
56
Test(uint8_t * rawData,size_t size)57 void Test(uint8_t *rawData, size_t size)
58 {
59 if (rawData == nullptr || size < LIMITSIZE) {
60 return;
61 }
62 GetPermission();
63 auto manager = CameraManager::GetInstance();
64 CHECK_AND_RETURN_LOG(manager, "PhotoOutputFuzzer: Get CameraManager instance Error");
65 auto cameras = manager->GetSupportedCameras();
66 CHECK_AND_RETURN_LOG(cameras.size() >= NUM_2, "PhotoOutputFuzzer: GetSupportedCameras Error");
67 MessageParcel data;
68 data.WriteRawData(rawData, size);
69 auto camera = cameras[data.ReadUint32() % cameras.size()];
70 CHECK_AND_RETURN_LOG(camera, "PhotoOutputFuzzer: camera is null");
71 int32_t mode = data.ReadInt32() % (SceneMode::APERTURE_VIDEO + NUM_2);
72 auto capability = manager->GetSupportedOutputCapability(camera, mode);
73 CHECK_AND_RETURN_LOG(capability, "PhotoOutputFuzzer: GetSupportedOutputCapability Error");
74 auto profiles = capability->GetPhotoProfiles();
75 CHECK_AND_RETURN_LOG(!profiles.empty(), "PhotoOutputFuzzer: GetPhotoProfiles empty");
76 Profile profile = profiles[data.ReadUint32() % profiles.size()];
77 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
78 CHECK_AND_RETURN_LOG(photoSurface, "PhotoOutputFuzzer: create photoSurface Error");
79 sptr<IBufferProducer> producer = photoSurface->GetProducer();
80 CHECK_AND_RETURN_LOG(producer, "PhotoOutputFuzzer: GetProducer Error");
81 auto output = manager->CreatePhotoOutput(profile, producer);
82 CHECK_AND_RETURN_LOG(output, "PhotoOutputFuzzer: CreatePhotoOutput Error");
83 TestOutput(output, rawData, size);
84 }
85
TestOutput(sptr<PhotoOutput> output,uint8_t * rawData,size_t size)86 void TestOutput(sptr<PhotoOutput> output, uint8_t *rawData, size_t size)
87 {
88 MEDIA_INFO_LOG("PhotoOutputFuzzer: ENTER");
89 MessageParcel data;
90 data.WriteRawData(rawData, size);
91 output->SetCallback(make_shared<PhotoStateCallbackMock>());
92 sptr<IBufferConsumerListener> listener = new IBufferConsumerListenerMock();
93 output->SetThumbnailListener(listener);
94 data.RewindRead(0);
95 output->SetThumbnail(data.ReadBool());
96 sptr<IConsumerSurface> photoSurface = IConsumerSurface::Create();
97 CHECK_AND_RETURN_LOG(photoSurface, "PhotoOutputFuzzer: Create photoSurface Error");
98 sptr<IBufferProducer> producer = photoSurface->GetProducer();
99 CHECK_AND_RETURN_LOG(producer, "PhotoOutputFuzzer: GetProducer Error");
100 sptr<Surface> sf = Surface::CreateSurfaceAsProducer(producer);
101 output->SetRawPhotoInfo(sf);
102 output->Capture(make_shared<PhotoCaptureSetting>());
103 output->Capture();
104 output->CancelCapture();
105 output->ConfirmCapture();
106 output->CreateStream();
107 output->GetApplicationCallback();
108 output->IsMirrorSupported();
109 output->IsQuickThumbnailSupported();
110 data.RewindRead(0);
111 int32_t type = data.ReadInt32() % (DeferredDeliveryImageType::DELIVERY_VIDEO + 1 + 1);
112 output->DeferImageDeliveryFor(static_cast<DeferredDeliveryImageType>(type));
113 output->IsDeferredImageDeliverySupported(static_cast<DeferredDeliveryImageType>(type));
114 output->IsDeferredImageDeliveryEnabled(static_cast<DeferredDeliveryImageType>(type));
115 data.RewindRead(0);
116 output->SetCallbackFlag(data.ReadUint8());
117 data.RewindRead(0);
118 output->SetNativeSurface(data.ReadBool());
119 data.RewindRead(0);
120 output->ProcessSnapshotDurationUpdates(data.ReadInt32());
121 int32_t isAutoHighQualityPhotoSupported;
122 output->IsAutoHighQualityPhotoSupported(isAutoHighQualityPhotoSupported);
123 data.RewindRead(0);
124 output->EnableAutoHighQualityPhoto(data.ReadBool());
125 output->IsEnableDeferred();
126 output->GetDefaultCaptureSetting();
127 output->Release();
128 }
129
130 } // namespace StreamRepeatStubFuzzer
131 } // namespace CameraStandard
132 } // namespace OHOS
133
134 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)135 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
136 {
137 /* Run your code on data */
138 OHOS::CameraStandard::PhotoOutputFuzzer::Test(data, size);
139 return 0;
140 }