From 7ab6d1e1f6e769a4ccb171f464700fe95e8b0a0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9F=A6=E5=9B=BD=E5=BA=86?= Date: Sun, 22 Jun 2025 10:43:29 +0800 Subject: [PATCH 1/6] add FUZZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 韦国庆 --- ...kservicestopdistributedhardware_fuzzer.cpp | 73 ++++++++++++++ .../decodeonoutputbufferavailable_fuzzer.cpp | 50 ++++++++++ .../softbusadapter_fuzzer.cpp | 59 +++++++++++ .../BUILD.gn | 2 + .../sourceservicedcameranotify_fuzzer.cpp | 97 +++++++++++++++++++ 5 files changed, 281 insertions(+) diff --git a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp index e0a1b7c9..cf5565ad 100644 --- a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp @@ -37,6 +37,74 @@ void SinkServiceStopDistributedHardwareFuzzTest(const uint8_t* data, size_t size std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); sinkService->StopDistributedHardware(networkId); } + +void SinkServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + sinkService->OnStart(); +} + +void DistributedCameraSinkServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + sinkService->Init(); +} + +void DistributedCameraSinkServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + sinkService->OnStop(); +} + +void DistributedCameraSinkServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::vector args; + std::u16string arg(reinterpret_cast(data), size / sizeof(char16_t)); + args.push_back(arg); + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + int fd = STDOUT_FILENO; + + sinkService->Dump(fd, args); +} + +void DistributedCameraSinkServiceGetCamDumpInfoFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + CameraDumpInfo camDump; + + sinkService->GetCamDumpInfo(camDump); +} } } @@ -45,6 +113,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::SinkServiceStopDistributedHardwareFuzzTest(data, size); + OHOS::DistributedHardware::SinkServiceOnStartFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceInitFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceOnStopFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceDumpFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceGetCamDumpInfoFuzzTest(data, size); return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp index 676b71cd..6c8bc544 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp @@ -44,6 +44,54 @@ void DecodeOnOutputBufferAvailableFuzzTest(const uint8_t* data, size_t size) decodeVideoCallback->OnOutputBufferAvailable(index, info, flag, buffer); } + +void DecodeVideoCallbackOnErrorFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int32_t))) { + return; + } + + FuzzedDataProvider fdp(data, size); + MediaAVCodec::AVCodecErrorType errorType = + static_cast(fdp.ConsumeIntegral()); + int32_t errorCode = fdp.ConsumeIntegral(); + + std::shared_ptr runner = AppExecFwk::EventRunner::Create(true); + std::shared_ptr handler = std::make_shared(runner); + std::shared_ptr source = std::make_shared(); + + std::shared_ptr decodeDataProcess = + std::make_shared(handler, source); + std::shared_ptr decodeVideoCallback = + std::make_shared(decodeDataProcess); + + decodeVideoCallback->OnError(errorType, errorCode); +} + +void DecodeVideoCallbackOnOutputFormatChangedFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int32_t))) { + return; + } + + FuzzedDataProvider fdp(data, size); + Media::Format format; + format.PutIntValue("width", fdp.ConsumeIntegral()); + format.PutIntValue("height", fdp.ConsumeIntegral()); + format.PutStringValue("mime", fdp.ConsumeRandomLengthString(32)); + + + std::shared_ptr runner = AppExecFwk::EventRunner::Create(true); + std::shared_ptr handler = std::make_shared(runner); + std::shared_ptr source = std::make_shared(); + + std::shared_ptr decodeDataProcess = + std::make_shared(handler, source); + std::shared_ptr decodeVideoCallback = + std::make_shared(decodeDataProcess); + + decodeVideoCallback->OnOutputFormatChanged(format); +} } } @@ -52,6 +100,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::DecodeOnOutputBufferAvailableFuzzTest(data, size); + OHOS::DistributedHardware::DecodeVideoCallbackOnErrorFuzzTest(data, size); + OHOS::DistributedHardware::DecodeVideoCallbackOnOutputFormatChangedFuzzTest(data, size); return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp index dd17ad8e..c5aefbd4 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp @@ -13,11 +13,19 @@ * limitations under the License. */ +#include + #include "softbusadapter_fuzzer.h" #include "dcamera_softbus_adapter.h" namespace OHOS { +inline size_t GenerateBufferSize(FuzzedDataProvider& fuzzedData) +{ + constexpr size_t minBufferSize = 1; + constexpr size_t maxBufferSize = 1024; + return fuzzedData.ConsumeIntegralInRange(minBufferSize, maxBufferSize); +} namespace DistributedHardware { void SoftbusCreatSoftBusSinkSocketServerFuzzTest(const uint8_t* data, size_t size) { @@ -117,6 +125,53 @@ void SoftbusGetLocalNetworkIdFuzzTest(const uint8_t* data, size_t size) std::string devId = "bb536a637105409e904d4da83790a4a7"; DCameraSoftbusAdapter::GetInstance().GetLocalNetworkId(devId); } + +void FuzzReplaceSuffix(const uint8_t *data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int64_t))) { + return; + } + FuzzedDataProvider fuzzedData(data, size); + std::string mySessNmRep = fuzzedData.ConsumeRandomLengthString(64); + std::string suffix = fuzzedData.ConsumeRandomLengthString(16); + std::string replacement = fuzzedData.ConsumeRandomLengthString(16); + DCameraSoftbusAdapter::GetInstance().ReplaceSuffix(mySessNmRep, suffix, replacement); +} + +void FuzzSendSofbusBytes(const uint8_t *data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int64_t))) { + return; + } + FuzzedDataProvider fuzzedData(data, size); + int32_t socket = fuzzedData.ConsumeIntegral(); + size_t bufferSize = GenerateBufferSize(fuzzedData); + + std::shared_ptr buffer = std::make_shared(bufferSize); + fuzzedData.ConsumeData(buffer->Data(), bufferSize); + DCameraSoftbusAdapter::GetInstance().SendSofbusBytes(socket, buffer); +} + +void FuzzRecordSourceSocketSession(const uint8_t *data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int64_t))) { + return; + } + FuzzedDataProvider fuzzedData(data, size); + int32_t socket = fuzzedData.ConsumeIntegral(); + auto session = std::make_shared(); + DCameraSoftbusAdapter::GetInstance().RecordSourceSocketSession(socket, session); +} + +void FuzzCloseSessionWithNetWorkId(const uint8_t *data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int64_t))) { + return; + } + FuzzedDataProvider fuzzedData(data, size); + std::string networkId = fuzzedData.ConsumeRandomLengthString(64); + DCameraSoftbusAdapter::GetInstance().CloseSessionWithNetWorkId(networkId); +} } } @@ -130,5 +185,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) OHOS::DistributedHardware::SoftbusCloseSoftbusSessionFuzzTest(data, size); OHOS::DistributedHardware::SoftbusSendSofbusStreamFuzzTest(data, size); OHOS::DistributedHardware::SoftbusGetLocalNetworkIdFuzzTest(data, size); + OHOS::DistributedHardware::FuzzReplaceSuffix(data, size); + OHOS::DistributedHardware::FuzzSendSofbusBytes(data, size); + OHOS::DistributedHardware::FuzzRecordSourceSocketSession(data, size); + OHOS::DistributedHardware::FuzzCloseSessionWithNetWorkId(data, size); return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/BUILD.gn b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/BUILD.gn index a16df560..1597d131 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/BUILD.gn +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/BUILD.gn @@ -47,6 +47,8 @@ ohos_fuzztest("SourceServiceDCameraNotifyFuzzTest") { "-O0", "-Wno-unused-variable", "-fno-omit-frame-pointer", + "-Dprivate=public", + "-Dprotected=public", ] sources = [ "sourceservicedcameranotify_fuzzer.cpp" ] diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp index ac6a421e..1a4ef6d9 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp @@ -22,6 +22,10 @@ #include "iservice_registry.h" namespace OHOS { +inline std::string ExtractString(const uint8_t* data, size_t offset, size_t length) +{ + return std::string(reinterpret_cast(data + offset), length); +} namespace DistributedHardware { void SourceServiceDCameraNotifyFuzzTest(const uint8_t* data, size_t size) { @@ -38,6 +42,93 @@ void SourceServiceDCameraNotifyFuzzTest(const uint8_t* data, size_t size) sourceService->DCameraNotify(devId, dhId, events); } + +void SourceServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + sourceService->OnStart(); +} + +void SourceServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + sourceService->Init(); +} + +void SourceServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + sourceService->OnStop(); +} + +void SourceServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::vector args; + std::u16string arg(reinterpret_cast(data), size / sizeof(char16_t)); + if (arg.empty() || std::all_of(arg.begin(), arg.end(), [](char16_t c) { return c == 0; })) { + return; + } + args.push_back(arg); + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + int fd = STDOUT_FILENO; + + sourceService->Dump(fd, args); +} + +void SourceServiceGetDumpInfoFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + CameraDumpInfo camDump; + + sourceService->GetDumpInfo(camDump); +} + +void SourceServiceCamDevEraseFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(DCameraIndex))) { + return; + } + + DCameraIndex index; + index.devId_ = ExtractString(data, 0, size / 2); + index.dhId_ = ExtractString(data, size / 2, size / 2); + + std::shared_ptr sourceService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + + sourceService->CamDevErase(index); +} } } @@ -46,6 +137,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::SourceServiceDCameraNotifyFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceOnStartFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceInitFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceOnStopFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceDumpFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceGetDumpInfoFuzzTest(data, size); + OHOS::DistributedHardware::SourceServiceCamDevEraseFuzzTest(data, size); return 0; } -- Gitee From 6043cb4457ae49efe3138538757b20769a965bf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9F=A6=E5=9B=BD=E5=BA=86?= Date: Sun, 22 Jun 2025 11:21:24 +0800 Subject: [PATCH 2/6] add FUZZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 韦国庆 --- .../decodeonoutputbufferavailable_fuzzer.cpp | 4 ++-- .../sourceservicedcameranotify_fuzzer.cpp | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp index 6c8bc544..33f35e02 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp @@ -74,12 +74,12 @@ void DecodeVideoCallbackOnOutputFormatChangedFuzzTest(const uint8_t* data, size_ return; } + int32_t strLenTemp = 32; FuzzedDataProvider fdp(data, size); Media::Format format; format.PutIntValue("width", fdp.ConsumeIntegral()); format.PutIntValue("height", fdp.ConsumeIntegral()); - format.PutStringValue("mime", fdp.ConsumeRandomLengthString(32)); - + format.PutStringValue("mime", fdp.ConsumeRandomLengthString(strLenTemp)); std::shared_ptr runner = AppExecFwk::EventRunner::Create(true); std::shared_ptr handler = std::make_shared(runner); diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp index 1a4ef6d9..8676998d 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp @@ -120,9 +120,10 @@ void SourceServiceCamDevEraseFuzzTest(const uint8_t* data, size_t size) return; } + int32_t doubleNum = 2; DCameraIndex index; - index.devId_ = ExtractString(data, 0, size / 2); - index.dhId_ = ExtractString(data, size / 2, size / 2); + index.devId_ = ExtractString(data, 0, size / doubleNum); + index.dhId_ = ExtractString(data, size / doubleNum, size / doubleNum); std::shared_ptr sourceService = std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); -- Gitee From 2c12b5fb01865ae167933f0d5f0c5e59d8fd99ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9F=A6=E5=9B=BD=E5=BA=86?= Date: Mon, 23 Jun 2025 11:49:04 +0800 Subject: [PATCH 3/6] add FUZZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 韦国庆 --- ...kservicestopdistributedhardware_fuzzer.cpp | 28 +++++++++---------- .../decodeonoutputbufferavailable_fuzzer.cpp | 6 ++-- .../softbusadapter_fuzzer.cpp | 2 +- .../sourceservicedcameranotify_fuzzer.cpp | 2 +- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp index cf5565ad..334e8086 100644 --- a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2024 Huawei Device Co., Ltd. + * Copyright (c) 2024-2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -62,18 +62,6 @@ void DistributedCameraSinkServiceInitFuzzTest(const uint8_t* data, size_t size) sinkService->Init(); } -void DistributedCameraSinkServiceOnStopFuzzTest(const uint8_t* data, size_t size) -{ - if ((data == nullptr) || (size == 0)) { - return; - } - - std::shared_ptr sinkService = - std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); - - sinkService->OnStop(); -} - void DistributedCameraSinkServiceDumpFuzzTest(const uint8_t* data, size_t size) { if ((data == nullptr) || (size == 0)) { @@ -105,6 +93,18 @@ void DistributedCameraSinkServiceGetCamDumpInfoFuzzTest(const uint8_t* data, siz sinkService->GetCamDumpInfo(camDump); } + +void DistributedCameraSinkServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + sinkService->OnStop(); +} } } @@ -115,9 +115,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) OHOS::DistributedHardware::SinkServiceStopDistributedHardwareFuzzTest(data, size); OHOS::DistributedHardware::SinkServiceOnStartFuzzTest(data, size); OHOS::DistributedHardware::DistributedCameraSinkServiceInitFuzzTest(data, size); - OHOS::DistributedHardware::DistributedCameraSinkServiceOnStopFuzzTest(data, size); OHOS::DistributedHardware::DistributedCameraSinkServiceDumpFuzzTest(data, size); OHOS::DistributedHardware::DistributedCameraSinkServiceGetCamDumpInfoFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceOnStopFuzzTest(data, size); return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp index 33f35e02..5f55dcb1 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2023-2024 Huawei Device Co., Ltd. + * Copyright (c) 2023-2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -74,12 +74,12 @@ void DecodeVideoCallbackOnOutputFormatChangedFuzzTest(const uint8_t* data, size_ return; } - int32_t strLenTemp = 32; FuzzedDataProvider fdp(data, size); Media::Format format; format.PutIntValue("width", fdp.ConsumeIntegral()); format.PutIntValue("height", fdp.ConsumeIntegral()); - format.PutStringValue("mime", fdp.ConsumeRandomLengthString(strLenTemp)); + format.PutStringValue("mime", fdp.ConsumeRandomLengthString(32)); + std::shared_ptr runner = AppExecFwk::EventRunner::Create(true); std::shared_ptr handler = std::make_shared(runner); diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp index c5aefbd4..4aa1ee1d 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2023-2024 Huawei Device Co., Ltd. + * Copyright (c) 2023-2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp index 8676998d..4b2230bc 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2023 Huawei Device Co., Ltd. + * Copyright (c) 2023-2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at -- Gitee From 71b12ab73abcc0e6636566207ac697787d25fabf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9F=A6=E5=9B=BD=E5=BA=86?= Date: Mon, 23 Jun 2025 11:52:24 +0800 Subject: [PATCH 4/6] add FUZZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 韦国庆 --- .../softbusadapter_fuzzer/softbusadapter_fuzzer.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp index 4aa1ee1d..fe69bedb 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/softbusadapter_fuzzer/softbusadapter_fuzzer.cpp @@ -131,10 +131,12 @@ void FuzzReplaceSuffix(const uint8_t *data, size_t size) if ((data == nullptr) || (size < sizeof(int64_t))) { return; } + int32_t tempStrLen = 64; + int32_t tempShortStrLen = 16; FuzzedDataProvider fuzzedData(data, size); - std::string mySessNmRep = fuzzedData.ConsumeRandomLengthString(64); - std::string suffix = fuzzedData.ConsumeRandomLengthString(16); - std::string replacement = fuzzedData.ConsumeRandomLengthString(16); + std::string mySessNmRep = fuzzedData.ConsumeRandomLengthString(tempStrLen); + std::string suffix = fuzzedData.ConsumeRandomLengthString(tempShortStrLen); + std::string replacement = fuzzedData.ConsumeRandomLengthString(tempShortStrLen); DCameraSoftbusAdapter::GetInstance().ReplaceSuffix(mySessNmRep, suffix, replacement); } -- Gitee From 378ea96065e478e4ff2a71b54290f9417c5efa6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9F=A6=E5=9B=BD=E5=BA=86?= Date: Mon, 23 Jun 2025 12:35:14 +0800 Subject: [PATCH 5/6] add FUZZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 韦国庆 --- .../decodeonoutputbufferavailable_fuzzer.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp index 5f55dcb1..0663ac8e 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp @@ -75,11 +75,11 @@ void DecodeVideoCallbackOnOutputFormatChangedFuzzTest(const uint8_t* data, size_ } FuzzedDataProvider fdp(data, size); + int32_t tempStrLen = 32; Media::Format format; format.PutIntValue("width", fdp.ConsumeIntegral()); format.PutIntValue("height", fdp.ConsumeIntegral()); - format.PutStringValue("mime", fdp.ConsumeRandomLengthString(32)); - + format.PutStringValue("mime", fdp.ConsumeRandomLengthString(tempStrLen)); std::shared_ptr runner = AppExecFwk::EventRunner::Create(true); std::shared_ptr handler = std::make_shared(runner); -- Gitee From cd9e82dc80d747983f806fef615337b22f507646 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9F=A6=E5=9B=BD=E5=BA=86?= Date: Tue, 24 Jun 2025 12:34:58 +0800 Subject: [PATCH 6/6] add FUZZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 韦国庆 --- ...kservicestopdistributedhardware_fuzzer.cpp | 61 ++++++++++++++- .../decodeonoutputbufferavailable_fuzzer.cpp | 4 +- .../sourceservicedcameranotify_fuzzer.cpp | 74 ++++++++++++++++++- 3 files changed, 130 insertions(+), 9 deletions(-) diff --git a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp index 334e8086..e7b68add 100644 --- a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkservicestopdistributedhardware_fuzzer/sinkservicestopdistributedhardware_fuzzer.cpp @@ -25,6 +25,10 @@ namespace OHOS { namespace DistributedHardware { +std::shared_ptr sinkService_ = + std::make_shared( + DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + void SinkServiceStopDistributedHardwareFuzzTest(const uint8_t* data, size_t size) { if ((data == nullptr) || (size == 0)) { @@ -32,10 +36,59 @@ void SinkServiceStopDistributedHardwareFuzzTest(const uint8_t* data, size_t size } std::string networkId(reinterpret_cast(data), size); + sinkService_->StopDistributedHardware(networkId); +} - std::shared_ptr sinkService = - std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); - sinkService->StopDistributedHardware(networkId); +void SinkServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sinkService_->OnStart(); +} + +void DistributedCameraSinkServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sinkService_->Init(); +} + +void DistributedCameraSinkServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::vector args; + std::u16string arg(reinterpret_cast(data), size / sizeof(char16_t)); + args.push_back(arg); + int fd = STDOUT_FILENO; + + sinkService_->Dump(fd, args); +} + +void DistributedCameraSinkServiceGetCamDumpInfoFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + CameraDumpInfo camDump; + + sinkService_->GetCamDumpInfo(camDump); +} + +void DistributedCameraSinkServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sinkService_->OnStop(); } void SinkServiceOnStartFuzzTest(const uint8_t* data, size_t size) @@ -115,9 +168,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) OHOS::DistributedHardware::SinkServiceStopDistributedHardwareFuzzTest(data, size); OHOS::DistributedHardware::SinkServiceOnStartFuzzTest(data, size); OHOS::DistributedHardware::DistributedCameraSinkServiceInitFuzzTest(data, size); + OHOS::DistributedHardware::DistributedCameraSinkServiceOnStopFuzzTest(data, size); OHOS::DistributedHardware::DistributedCameraSinkServiceDumpFuzzTest(data, size); OHOS::DistributedHardware::DistributedCameraSinkServiceGetCamDumpInfoFuzzTest(data, size); - OHOS::DistributedHardware::DistributedCameraSinkServiceOnStopFuzzTest(data, size); return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp index 0663ac8e..5f55dcb1 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/decodeonoutputbufferavailable_fuzzer/decodeonoutputbufferavailable_fuzzer.cpp @@ -75,11 +75,11 @@ void DecodeVideoCallbackOnOutputFormatChangedFuzzTest(const uint8_t* data, size_ } FuzzedDataProvider fdp(data, size); - int32_t tempStrLen = 32; Media::Format format; format.PutIntValue("width", fdp.ConsumeIntegral()); format.PutIntValue("height", fdp.ConsumeIntegral()); - format.PutStringValue("mime", fdp.ConsumeRandomLengthString(tempStrLen)); + format.PutStringValue("mime", fdp.ConsumeRandomLengthString(32)); + std::shared_ptr runner = AppExecFwk::EventRunner::Create(true); std::shared_ptr handler = std::make_shared(runner); diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp index 4b2230bc..283d5e24 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceservicedcameranotify_fuzzer/sourceservicedcameranotify_fuzzer.cpp @@ -27,6 +27,8 @@ inline std::string ExtractString(const uint8_t* data, size_t offset, size_t leng return std::string(reinterpret_cast(data + offset), length); } namespace DistributedHardware { +std::shared_ptr sourceService_ = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); void SourceServiceDCameraNotifyFuzzTest(const uint8_t* data, size_t size) { if ((data == nullptr) || (size == 0)) { @@ -37,10 +39,76 @@ void SourceServiceDCameraNotifyFuzzTest(const uint8_t* data, size_t size) std::string devId(reinterpret_cast(data), size); std::string events(reinterpret_cast(data), size); - std::shared_ptr sourceService = - std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID, true); + sourceService_->DCameraNotify(devId, dhId, events); +} + +void SourceServiceOnStartFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sourceService_->OnStart(); +} + +void SourceServiceInitFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sourceService_->Init(); +} + +void SourceServiceOnStopFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + sourceService_->OnStop(); +} + +void SourceServiceDumpFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + std::vector args; + std::u16string arg(reinterpret_cast(data), size / sizeof(char16_t)); + if (arg.empty() || std::all_of(arg.begin(), arg.end(), [](char16_t c) { return c == 0; })) { + return; + } + args.push_back(arg); + + int fd = STDOUT_FILENO; + + sourceService_->Dump(fd, args); +} + +void SourceServiceGetDumpInfoFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + + CameraDumpInfo camDump; + + sourceService_->GetDumpInfo(camDump); +} + +void SourceServiceCamDevEraseFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(DCameraIndex))) { + return; + } + + DCameraIndex index; + index.devId_ = ExtractString(data, 0, size / 2); + index.dhId_ = ExtractString(data, size / 2, size / 2); - sourceService->DCameraNotify(devId, dhId, events); + sourceService_->CamDevErase(index); } void SourceServiceOnStartFuzzTest(const uint8_t* data, size_t size) -- Gitee