diff --git a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp index e0a1b7c9eab44951afffd44f4512eaa4e9f247f2..e7b68add215ed9f225de88ab861ef91039d7229c 100644 --- a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2024 Huawei Device Co., Ltd. + * Copyright (c) 2024-2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -25,6 +25,10 @@ namespace OHOS { namespace DistributedHardware { +std::shared_ptr sinkService_ = + std::make_shared( + DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + void SinkServiceStopDistributedHardwareFuzzTest(const uint8_t* data, size_t size) { if ((data == nullptr) || (size == 0)) { @@ -32,10 +36,127 @@ void SinkServiceStopDistributedHardwareFuzzTest(const uint8_t* data, size_t size } std::string networkId(reinterpret_cast(data), size); + sinkService_->StopDistributedHardware(networkId); +} + +void SinkServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sinkService_->OnStart(); +} + +void DistributedCameraSinkServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sinkService_->Init(); +} + +void DistributedCameraSinkServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::vector args; + std::u16string arg(reinterpret_cast(data), size / sizeof(char16_t)); + args.push_back(arg); + int fd = STDOUT_FILENO; + + sinkService_->Dump(fd, args); +} + +void DistributedCameraSinkServiceGetCamDumpInfoFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + CameraDumpInfo camDump; + + sinkService_->GetCamDumpInfo(camDump); +} + +void DistributedCameraSinkServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sinkService_->OnStop(); +} + +void SinkServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } std::shared_ptr sinkService = std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); - sinkService->StopDistributedHardware(networkId); + + sinkService->OnStart(); +} + +void DistributedCameraSinkServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + sinkService->Init(); +} + +void DistributedCameraSinkServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::vector args; + std::u16string arg(reinterpret_cast(data), size / sizeof(char16_t)); + args.push_back(arg); + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + int fd = STDOUT_FILENO; + + sinkService->Dump(fd, args); +} + +void DistributedCameraSinkServiceGetCamDumpInfoFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + CameraDumpInfo camDump; + + sinkService->GetCamDumpInfo(camDump); +} + +void DistributedCameraSinkServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + sinkService->OnStop(); } } } @@ -45,6 +166,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::SinkServiceStopDistributedHardwareFuzzTest(data, size); + OHOS::DistributedHardware::SinkServiceOnStartFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceInitFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceOnStopFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceDumpFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceGetCamDumpInfoFuzzTest(data, size); return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp index 676b71cddbacca186a56f3dcac3dde75f164cf8b..5f55dcb1cb81046b6e721c55719ceb2e76795236 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2023-2024 Huawei Device Co., Ltd. + * Copyright (c) 2023-2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -44,6 +44,54 @@ void DecodeOnOutputBufferAvailableFuzzTest(const uint8_t* data, size_t size) decodeVideoCallback->OnOutputBufferAvailable(index, info, flag, buffer); } + +void DecodeVideoCallbackOnErrorFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int32_t))) { + return; + } + + FuzzedDataProvider fdp(data, size); + MediaAVCodec::AVCodecErrorType errorType = + static_cast(fdp.ConsumeIntegral()); + int32_t errorCode = fdp.ConsumeIntegral(); + + std::shared_ptr runner = AppExecFwk::EventRunner::Create(true); + std::shared_ptr handler = std::make_shared(runner); + std::shared_ptr source = std::make_shared(); + + std::shared_ptr decodeDataProcess = + std::make_shared(handler, source); + std::shared_ptr decodeVideoCallback = + std::make_shared(decodeDataProcess); + + decodeVideoCallback->OnError(errorType, errorCode); +} + +void DecodeVideoCallbackOnOutputFormatChangedFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int32_t))) { + return; + } + + FuzzedDataProvider fdp(data, size); + Media::Format format; + format.PutIntValue("width", fdp.ConsumeIntegral()); + format.PutIntValue("height", fdp.ConsumeIntegral()); + format.PutStringValue("mime", fdp.ConsumeRandomLengthString(32)); + + + std::shared_ptr runner = AppExecFwk::EventRunner::Create(true); + std::shared_ptr handler = std::make_shared(runner); + std::shared_ptr source = std::make_shared(); + + std::shared_ptr decodeDataProcess = + std::make_shared(handler, source); + std::shared_ptr decodeVideoCallback = + std::make_shared(decodeDataProcess); + + decodeVideoCallback->OnOutputFormatChanged(format); +} } } @@ -52,6 +100,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::DecodeOnOutputBufferAvailableFuzzTest(data, size); + OHOS::DistributedHardware::DecodeVideoCallbackOnErrorFuzzTest(data, size); + OHOS::DistributedHardware::DecodeVideoCallbackOnOutputFormatChangedFuzzTest(data, size); return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp index dd17ad8eb69c6262117976443204e306b2527183..fe69bedba428b6e8ff7edaf415c7bd0569938279 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2023-2024 Huawei Device Co., Ltd. + * Copyright (c) 2023-2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -13,11 +13,19 @@ * limitations under the License. */ +#include + #include "softbusadapter_fuzzer.h" #include "dcamera_softbus_adapter.h" namespace OHOS { +inline size_t GenerateBufferSize(FuzzedDataProvider& fuzzedData) +{ + constexpr size_t minBufferSize = 1; + constexpr size_t maxBufferSize = 1024; + return fuzzedData.ConsumeIntegralInRange(minBufferSize, maxBufferSize); +} namespace DistributedHardware { void SoftbusCreatSoftBusSinkSocketServerFuzzTest(const uint8_t* data, size_t size) { @@ -117,6 +125,55 @@ void SoftbusGetLocalNetworkIdFuzzTest(const uint8_t* data, size_t size) std::string devId = "bb536a637105409e904d4da83790a4a7"; DCameraSoftbusAdapter::GetInstance().GetLocalNetworkId(devId); } + +void FuzzReplaceSuffix(const uint8_t *data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int64_t))) { + return; + } + int32_t tempStrLen = 64; + int32_t tempShortStrLen = 16; + FuzzedDataProvider fuzzedData(data, size); + std::string mySessNmRep = fuzzedData.ConsumeRandomLengthString(tempStrLen); + std::string suffix = fuzzedData.ConsumeRandomLengthString(tempShortStrLen); + std::string replacement = fuzzedData.ConsumeRandomLengthString(tempShortStrLen); + DCameraSoftbusAdapter::GetInstance().ReplaceSuffix(mySessNmRep, suffix, replacement); +} + +void FuzzSendSofbusBytes(const uint8_t *data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int64_t))) { + return; + } + FuzzedDataProvider fuzzedData(data, size); + int32_t socket = fuzzedData.ConsumeIntegral(); + size_t bufferSize = GenerateBufferSize(fuzzedData); + + std::shared_ptr buffer = std::make_shared(bufferSize); + fuzzedData.ConsumeData(buffer->Data(), bufferSize); + DCameraSoftbusAdapter::GetInstance().SendSofbusBytes(socket, buffer); +} + +void FuzzRecordSourceSocketSession(const uint8_t *data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int64_t))) { + return; + } + FuzzedDataProvider fuzzedData(data, size); + int32_t socket = fuzzedData.ConsumeIntegral(); + auto session = std::make_shared(); + DCameraSoftbusAdapter::GetInstance().RecordSourceSocketSession(socket, session); +} + +void FuzzCloseSessionWithNetWorkId(const uint8_t *data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int64_t))) { + return; + } + FuzzedDataProvider fuzzedData(data, size); + std::string networkId = fuzzedData.ConsumeRandomLengthString(64); + DCameraSoftbusAdapter::GetInstance().CloseSessionWithNetWorkId(networkId); +} } } @@ -130,5 +187,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) OHOS::DistributedHardware::SoftbusCloseSoftbusSessionFuzzTest(data, size); OHOS::DistributedHardware::SoftbusSendSofbusStreamFuzzTest(data, size); OHOS::DistributedHardware::SoftbusGetLocalNetworkIdFuzzTest(data, size); + OHOS::DistributedHardware::FuzzReplaceSuffix(data, size); + OHOS::DistributedHardware::FuzzSendSofbusBytes(data, size); + OHOS::DistributedHardware::FuzzRecordSourceSocketSession(data, size); + OHOS::DistributedHardware::FuzzCloseSessionWithNetWorkId(data, size); return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/BUILD.gn b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/BUILD.gn index a16df560aa870aea5d5fff76b2df2e855615bea2..1597d131d5cb3c48e4a82c02afd2caf977a60f7a 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/BUILD.gn +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/BUILD.gn @@ -47,6 +47,8 @@ ohos_fuzztest("SourceServiceDCameraNotifyFuzzTest") { "-O0", "-Wno-unused-variable", "-fno-omit-frame-pointer", + "-Dprivate=public", + "-Dprotected=public", ] sources = [ "sourceservicedcameranotify_fuzzer.cpp" ] diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp index ac6a421ef5ee2b77c349cfe26c86aee5baf1f657..283d5e24f26e82e8cea5f76ef33c62404c0817e0 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2023 Huawei Device Co., Ltd. + * Copyright (c) 2023-2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -22,7 +22,13 @@ #include "iservice_registry.h" namespace OHOS { +inline std::string ExtractString(const uint8_t* data, size_t offset, size_t length) +{ + return std::string(reinterpret_cast(data + offset), length); +} namespace DistributedHardware { +std::shared_ptr sourceService_ = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); void SourceServiceDCameraNotifyFuzzTest(const uint8_t* data, size_t size) { if ((data == nullptr) || (size == 0)) { @@ -33,10 +39,164 @@ void SourceServiceDCameraNotifyFuzzTest(const uint8_t* data, size_t size) std::string devId(reinterpret_cast(data), size); std::string events(reinterpret_cast(data), size); + sourceService_->DCameraNotify(devId, dhId, events); +} + +void SourceServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sourceService_->OnStart(); +} + +void SourceServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sourceService_->Init(); +} + +void SourceServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sourceService_->OnStop(); +} + +void SourceServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::vector args; + std::u16string arg(reinterpret_cast(data), size / sizeof(char16_t)); + if (arg.empty() || std::all_of(arg.begin(), arg.end(), [](char16_t c) { return c == 0; })) { + return; + } + args.push_back(arg); + + int fd = STDOUT_FILENO; + + sourceService_->Dump(fd, args); +} + +void SourceServiceGetDumpInfoFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + CameraDumpInfo camDump; + + sourceService_->GetDumpInfo(camDump); +} + +void SourceServiceCamDevEraseFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(DCameraIndex))) { + return; + } + + DCameraIndex index; + index.devId_ = ExtractString(data, 0, size / 2); + index.dhId_ = ExtractString(data, size / 2, size / 2); + + sourceService_->CamDevErase(index); +} + +void SourceServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + sourceService->OnStart(); +} + +void SourceServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + sourceService->Init(); +} + +void SourceServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + sourceService->OnStop(); +} + +void SourceServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::vector args; + std::u16string arg(reinterpret_cast(data), size / sizeof(char16_t)); + if (arg.empty() || std::all_of(arg.begin(), arg.end(), [](char16_t c) { return c == 0; })) { + return; + } + args.push_back(arg); + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + int fd = STDOUT_FILENO; + + sourceService->Dump(fd, args); +} + +void SourceServiceGetDumpInfoFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + CameraDumpInfo camDump; + + sourceService->GetDumpInfo(camDump); +} + +void SourceServiceCamDevEraseFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(DCameraIndex))) { + return; + } + + int32_t doubleNum = 2; + DCameraIndex index; + index.devId_ = ExtractString(data, 0, size / doubleNum); + index.dhId_ = ExtractString(data, size / doubleNum, size / doubleNum); + std::shared_ptr sourceService = std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); - sourceService->DCameraNotify(devId, dhId, events); + sourceService->CamDevErase(index); } } } @@ -46,6 +206,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::SourceServiceDCameraNotifyFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceOnStartFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceInitFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceOnStopFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceDumpFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceGetDumpInfoFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceCamDevEraseFuzzTest(data, size); return 0; }