1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "common.h"
18
19 using ::android::hardware::automotive::evs::V1_0::DisplayDesc;
20 using ::android::hardware::camera::device::V3_2::Stream;
21 using IEvsCamera_1_1 = ::android::hardware::automotive::evs::V1_1::IEvsCamera;
22
LLVMFuzzerInitialize(int * argc,char *** argv)23 extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
24 UNUSED(argc);
25 UNUSED(argv);
26 pEnumerator = IEvsEnumerator::getService(kEnumeratorName);
27 sp<EvsDeathRecipient> dr = new EvsDeathRecipient();
28
29 pEnumerator->linkToDeath(dr, 0);
30
31 loadCameraList();
32 return 0;
33 }
34
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)35 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
36 FuzzedDataProvider fdp(data, size);
37
38 std::vector<sp<IEvsCamera_1_1>> camList;
39 Stream nullCfg = {};
40
41 while (fdp.remaining_bytes() > 4) {
42 switch (fdp.ConsumeIntegralInRange<uint32_t>(0, 3)) {
43 case 0: // open camera
44 {
45 uint32_t whichCam = fdp.ConsumeIntegralInRange<uint32_t>(0, cameraInfo.size() - 1);
46 sp<IEvsCamera_1_1> pCam =
47 IEvsCamera_1_1::castFrom(pEnumerator->openCamera_1_1(
48 cameraInfo[whichCam].v1.cameraId, nullCfg))
49 .withDefault(nullptr);
50 camList.emplace_back(pCam);
51 break;
52 }
53 case 1: // close camera
54 {
55 if (!camList.empty()) {
56 uint32_t whichCam = fdp.ConsumeIntegralInRange<uint32_t>(0, camList.size() - 1);
57 pEnumerator->closeCamera(camList[whichCam]);
58 }
59 break;
60 }
61 case 2: // get camera info
62 {
63 if (!camList.empty()) {
64 uint32_t whichCam = fdp.ConsumeIntegralInRange<uint32_t>(0, camList.size() - 1);
65 camList[whichCam]->getCameraInfo_1_1([](CameraDesc desc) { UNUSED(desc); });
66 }
67 break;
68 }
69 case 3: // setMaxFramesInFlight
70 {
71 if (!camList.empty()) {
72 uint32_t whichCam = fdp.ConsumeIntegralInRange<uint32_t>(0, camList.size() - 1);
73 int32_t numFrames = fdp.ConsumeIntegral<int32_t>();
74 camList[whichCam]->setMaxFramesInFlight(numFrames);
75 }
76 break;
77 }
78 default:
79 break;
80 }
81 }
82
83 return 0;
84 }
85