285 lines
12 KiB
C++
285 lines
12 KiB
C++
|
/*
|
||
|
|
* Copyright 2020 The Android Open Source Project
|
||
|
|
*
|
||
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||
|
|
* you may not use this file except in compliance with the License.
|
||
|
|
* You may obtain a copy of the License at
|
||
|
|
*
|
||
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||
|
|
*
|
||
|
|
* Unless required by applicable law or agreed to in writing, software
|
||
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
|
|
* See the License for the specific language governing permissions and
|
||
|
|
* limitations under the License.
|
||
|
|
*/
|
||
|
|
|
||
|
|
#include "Common.h"
|
||
|
|
#include "Enumerator.h"
|
||
|
|
#include "MockHWCamera.h"
|
||
|
|
#include "VirtualCamera.h"
|
||
|
|
|
||
|
|
#include <fuzzer/FuzzedDataProvider.h>
|
||
|
|
|
||
|
|
#include <iostream>
|
||
|
|
|
||
|
|
namespace android::automotive::evs::V1_1::implementation {
|
||
|
|
namespace {
|
||
|
|
|
||
|
|
using CameraDesc_1_0 = ::android::hardware::automotive::evs::V1_0::CameraDesc;
|
||
|
|
|
||
|
|
enum EvsFuzzFuncs {
|
||
|
|
EVS_FUZZ_GET_ALLOWED_BUFFERS, // verify getAllowedBuffers
|
||
|
|
EVS_FUZZ_IS_STREAMING, // verify isStreaming
|
||
|
|
EVS_FUZZ_GET_VERSION, // verify getVersion
|
||
|
|
EVS_FUZZ_SET_DESCRIPTOR, // verify setDescriptor
|
||
|
|
EVS_FUZZ_GET_CAMERA_INFO, // verify getCameraInfo
|
||
|
|
EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT, // verify setMaxFramesInFlight
|
||
|
|
EVS_FUZZ_START_VIDEO_STREAM, // verify startVideoStream
|
||
|
|
EVS_FUZZ_STOP_VIDEO_STREAM, // verify stopVideoStream
|
||
|
|
EVS_FUZZ_GET_EXTENDED_INFO, // verify getExtendedInfo
|
||
|
|
EVS_FUZZ_SET_EXTENDED_INFO, // verify setExtendedInfo
|
||
|
|
EVS_FUZZ_GET_CAMERA_INFO_1_1, // verify getCameraInfo_1_1
|
||
|
|
EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO, // verify getPhysicalCameraInfo
|
||
|
|
EVS_FUZZ_PAUSE_VIDEO_STREAM, // verify pauseVideoStream
|
||
|
|
EVS_FUZZ_RESUME_VIDEO_STREAM, // verify resumeVideoStream
|
||
|
|
EVS_FUZZ_GET_PARAMETER_LIST, // verify getParameterList
|
||
|
|
EVS_FUZZ_GET_INT_PARAMETER_RANGE, // verify getIntParameterRange
|
||
|
|
EVS_FUZZ_SET_EXTENDED_INFO_1_1, // verify setExtendedInfo_1_1
|
||
|
|
EVS_FUZZ_GET_EXTENDED_INFO_1_1, // verify getExtendedInfo_1_1
|
||
|
|
EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS, // verify importExternalBuffers
|
||
|
|
EVS_FUZZ_BASE_ENUM // verify common functions
|
||
|
|
};
|
||
|
|
|
||
|
|
const int kMaxFuzzerConsumedBytes = 12;
|
||
|
|
|
||
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||
|
|
FuzzedDataProvider fdp(data, size);
|
||
|
|
sp<IEvsCamera_1_1> mockHWCamera = new MockHWCamera();
|
||
|
|
sp<HalCamera> halCamera = new HalCamera(mockHWCamera);
|
||
|
|
sp<VirtualCamera> virtualCamera = halCamera->makeVirtualCamera();
|
||
|
|
|
||
|
|
std::vector<BufferDesc_1_0> vBufferDesc_1_0;
|
||
|
|
std::vector<BufferDesc_1_1> vBufferDesc_1_1;
|
||
|
|
|
||
|
|
bool videoStarted = false;
|
||
|
|
|
||
|
|
while (fdp.remaining_bytes() > kMaxFuzzerConsumedBytes) {
|
||
|
|
switch (fdp.ConsumeIntegralInRange<uint32_t>(0, EVS_FUZZ_API_SUM)) {
|
||
|
|
case EVS_FUZZ_GET_ALLOWED_BUFFERS: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_ALLOWED_BUFFERS";
|
||
|
|
virtualCamera->getAllowedBuffers();
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_IS_STREAMING: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_IS_STREAMING";
|
||
|
|
virtualCamera->isStreaming();
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_VERSION: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_VERSION";
|
||
|
|
virtualCamera->getVersion();
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_HW_CAMERA: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_HW_CAMERA";
|
||
|
|
virtualCamera->getHalCameras();
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_SET_DESCRIPTOR: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_SET_DESCRIPTOR";
|
||
|
|
CameraDesc* desc = new CameraDesc();
|
||
|
|
virtualCamera->setDescriptor(desc);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_NOTIFY: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_NOTIFY";
|
||
|
|
if (videoStarted) {
|
||
|
|
EvsEventDesc event;
|
||
|
|
uint32_t type = fdp.ConsumeIntegralInRange<
|
||
|
|
uint32_t>(0, static_cast<uint32_t>(EvsEventType::STREAM_ERROR));
|
||
|
|
event.aType = static_cast<EvsEventType>(type);
|
||
|
|
virtualCamera->notify(event);
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_DELIVER_FRAME: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_DELIVER_FRAME";
|
||
|
|
BufferDesc buffer;
|
||
|
|
buffer.bufferId = fdp.ConsumeIntegral<int32_t>();
|
||
|
|
virtualCamera->deliverFrame(buffer);
|
||
|
|
vBufferDesc_1_1.emplace_back(buffer);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_CAMERA_INFO: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_CAMERA_INFO";
|
||
|
|
virtualCamera->getCameraInfo([](CameraDesc_1_0 desc) {});
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_SETMAX_FRAMES_IN_FLIGHT";
|
||
|
|
uint32_t delta = fdp.ConsumeIntegral<uint32_t>();
|
||
|
|
virtualCamera->setMaxFramesInFlight(delta);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_START_VIDEO_STREAM: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_START_VIDEO_STREAM";
|
||
|
|
if (!videoStarted) {
|
||
|
|
sp<IEvsCamera_1_1> mockHWCamera1 = new MockHWCamera();
|
||
|
|
sp<HalCamera> halCamera1 = new HalCamera(mockHWCamera1);
|
||
|
|
virtualCamera->startVideoStream(halCamera1);
|
||
|
|
videoStarted = true;
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_DONE_WITH_FRAME_1_0: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_DONE_WITH_FRAME_1_0";
|
||
|
|
if (!vBufferDesc_1_0.empty()) {
|
||
|
|
uint32_t whichBuffer =
|
||
|
|
fdp.ConsumeIntegralInRange<uint32_t>(0, vBufferDesc_1_0.size() - 1);
|
||
|
|
virtualCamera->doneWithFrame(vBufferDesc_1_0[whichBuffer]);
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_STOP_VIDEO_STREAM: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_STOP_VIDEO_STREAM";
|
||
|
|
virtualCamera->stopVideoStream();
|
||
|
|
videoStarted = false;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_EXTENDED_INFO: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_EXTENDED_INFO";
|
||
|
|
uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
|
||
|
|
virtualCamera->getExtendedInfo(opaqueIdentifier);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_SET_EXTENDED_INFO: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_SET_EXTENDED_INFO";
|
||
|
|
uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
|
||
|
|
int32_t opaqueValue = fdp.ConsumeIntegral<int32_t>();
|
||
|
|
virtualCamera->setExtendedInfo(opaqueIdentifier, opaqueValue);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_CAMERA_INFO_1_1: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_CAMERA_INFO_1_1";
|
||
|
|
virtualCamera->getCameraInfo_1_1([](CameraDesc desc) {});
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_PHYSICAL_CAMERA_INFO";
|
||
|
|
hidl_string deviceId("");
|
||
|
|
virtualCamera->getPhysicalCameraInfo(deviceId, [](const CameraDesc& info) {});
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_DONE_WITH_FRAME_1_1: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_DONE_WITH_FRAME_1_1";
|
||
|
|
if (!vBufferDesc_1_1.empty()) {
|
||
|
|
hidl_vec<BufferDesc_1_1> buffers(vBufferDesc_1_1);
|
||
|
|
virtualCamera->doneWithFrame_1_1(buffers);
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_PAUSE_VIDEO_STREAM: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_PAUSE_VIDEO_STREAM";
|
||
|
|
virtualCamera->pauseVideoStream();
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_RESUME_VIDEO_STREAM: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_RESUME_VIDEO_STREAM";
|
||
|
|
virtualCamera->resumeVideoStream();
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_SET_PRIMARY: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_SET_PRIMARY";
|
||
|
|
virtualCamera->setMaster();
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_FORCE_PRIMARY: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_FORCE_PRIMARY";
|
||
|
|
// TODO(161388489) skip this until we finished fuzzing evs display
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_UNSET_PRIMARY: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_UNSET_PRIMARY";
|
||
|
|
virtualCamera->unsetMaster();
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_PARAMETER_LIST: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_PARAMETER_LIST";
|
||
|
|
virtualCamera->getParameterList([](hidl_vec<CameraParam> cmdList) {});
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_INT_PARAMETER_RANGE: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_INT_PARAMETER_RANGE";
|
||
|
|
uint32_t whichParam =
|
||
|
|
fdp.ConsumeIntegralInRange<uint32_t>(0,
|
||
|
|
static_cast<uint32_t>(
|
||
|
|
CameraParam::ABSOLUTE_ZOOM));
|
||
|
|
virtualCamera->getIntParameterRange(static_cast<CameraParam>(whichParam),
|
||
|
|
[](int32_t val0, int32_t val1, int32_t val2) {
|
||
|
|
});
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_SET_PARAMETER: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_SET_PARAMETER";
|
||
|
|
uint32_t whichParam =
|
||
|
|
fdp.ConsumeIntegralInRange<uint32_t>(0,
|
||
|
|
static_cast<uint32_t>(
|
||
|
|
CameraParam::ABSOLUTE_ZOOM));
|
||
|
|
int32_t val = fdp.ConsumeIntegral<int32_t>();
|
||
|
|
virtualCamera->setIntParameter(static_cast<CameraParam>(whichParam), val,
|
||
|
|
[](auto status, auto effectiveValues) {});
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_PARAMETER: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_PARAMETER";
|
||
|
|
uint32_t whichParam =
|
||
|
|
fdp.ConsumeIntegralInRange<uint32_t>(0,
|
||
|
|
static_cast<uint32_t>(
|
||
|
|
CameraParam::ABSOLUTE_ZOOM));
|
||
|
|
virtualCamera->getIntParameter(static_cast<CameraParam>(whichParam),
|
||
|
|
[](auto status, auto effectiveValues) {});
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_SET_EXTENDED_INFO_1_1: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_SET_EXTENDED_INFO_1_1";
|
||
|
|
uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
|
||
|
|
uint8_t opaqueValue = fdp.ConsumeIntegral<uint8_t>();
|
||
|
|
std::vector<uint8_t> v;
|
||
|
|
v.push_back(opaqueValue);
|
||
|
|
hidl_vec<uint8_t> vec(v);
|
||
|
|
virtualCamera->setExtendedInfo_1_1(opaqueIdentifier, vec);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_GET_EXTENDED_INFO_1_1: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_GET_EXTENDED_INFO_1_1";
|
||
|
|
uint32_t opaqueIdentifier = fdp.ConsumeIntegral<uint32_t>();
|
||
|
|
virtualCamera->getExtendedInfo_1_1(opaqueIdentifier,
|
||
|
|
[](const auto& result, const auto& data) {});
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
case EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS: {
|
||
|
|
LOG(DEBUG) << "EVS_FUZZ_IMPORT_EXTERNAL_BUFFERS";
|
||
|
|
if (!vBufferDesc_1_1.empty()) {
|
||
|
|
hidl_vec<BufferDesc_1_1> buffers(vBufferDesc_1_1);
|
||
|
|
virtualCamera->importExternalBuffers(buffers, [](auto _result, auto _delta) {});
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
default:
|
||
|
|
LOG(ERROR) << "Unexpected option, aborting...";
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if (videoStarted) {
|
||
|
|
// TODO(b/161762538) if we do not stop video stream manually here,
|
||
|
|
// there will be crash at VirtualCamera.cpp::pHwCamera->unsetMaster(this);
|
||
|
|
virtualCamera->stopVideoStream();
|
||
|
|
}
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
} // namespace
|
||
|
|
} // namespace android::automotive::evs::V1_1::implementation
|