Added fuzz targets for libcamera_client
This patch adds following fuzz
target: camera_fuzzer, camera_c2CaptureRequest_fuzzer,
camera_c2ConcurrentCamera_fuzzer,camera_c2SubmitInfo_fuzzer,
camera_c2SessionConfiguration_fuzzer,
camera_c2OutputConfiguration_fuzzer,
camera_vendorTagDescriptor_fuzzer,camera_Parameters_fuzzer,
camera_SessionStats_fuzzer and camera_captureResult_fuzzer.
Test: ./camera_fuzzer
Test: ./camera_c2CaptureRequest_fuzzer
Test: ./camera_c2ConcurrentCamera_fuzzer
Test: ./camera_c2SubmitInfo_fuzzer
Test: ./camera_c2SessionConfiguration_fuzzer
Test: ./camera_c2OutputConfiguration_fuzzer
Test: ./camera_vendorTagDescriptor_fuzzer
Test: ./camera_Parameters_fuzzer
Test: ./camera_SessionStats_fuzzer
Test: ./camera_captureResult_fuzzer
Bug: 193202080
Change-Id: I24326348f4aa30895fb823050416c7c67df473aa
(cherry picked from commit 3234500f45814a738db1cdf1a2c5e5856864c314)
diff --git a/camera/tests/fuzzer/Android.bp b/camera/tests/fuzzer/Android.bp
new file mode 100644
index 0000000..3e7c415
--- /dev/null
+++ b/camera/tests/fuzzer/Android.bp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+cc_defaults {
+ name: "camera_defaults",
+ static_libs: [
+ "libcamera_client",
+ ],
+ shared_libs: [
+ "libbase",
+ "libcutils",
+ "libutils",
+ "liblog",
+ "libbinder",
+ "libgui",
+ "libcamera_metadata",
+ "libnativewindow",
+ ],
+ fuzz_config: {
+ cc: [
+ "android-media-fuzzing-reports@google.com",
+ ],
+ componentid: 155276,
+ },
+}
+
+cc_fuzz {
+ name: "camera_fuzzer",
+ srcs: [
+ "camera_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+}
+
+cc_fuzz {
+ name: "camera_c2CaptureRequest_fuzzer",
+ srcs: [
+ "camera_c2CaptureRequest_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+}
+
+cc_fuzz {
+ name: "camera_c2ConcurrentCamera_fuzzer",
+ srcs: [
+ "camera_c2ConcurrentCamera_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+}
+
+cc_fuzz {
+ name: "camera_c2SubmitInfo_fuzzer",
+ srcs: [
+ "camera_c2SubmitInfo_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+}
+
+cc_fuzz {
+ name: "camera_c2SessionConfiguration_fuzzer",
+ srcs: [
+ "camera_c2SessionConfiguration_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+}
+
+cc_fuzz {
+ name: "camera_c2OutputConfiguration_fuzzer",
+ srcs: [
+ "camera_c2OutputConfiguration_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+}
+
+cc_fuzz {
+ name: "camera_vendorTagDescriptor_fuzzer",
+ srcs: [
+ "camera_vendorTagDescriptor_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+ include_dirs: [
+ "system/media/camera/tests",
+ "system/media/private/camera/include",
+ ],
+}
+
+cc_fuzz {
+ name: "camera_Parameters_fuzzer",
+ srcs: [
+ "camera_Parameters_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+}
+
+cc_fuzz {
+ name: "camera_SessionStats_fuzzer",
+ srcs: [
+ "camera_SessionStats_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+}
+
+cc_fuzz {
+ name: "camera_captureResult_fuzzer",
+ srcs: [
+ "camera_captureResult_fuzzer.cpp",
+ ],
+ defaults: [
+ "camera_defaults",
+ ],
+}
diff --git a/camera/tests/fuzzer/README.md b/camera/tests/fuzzer/README.md
new file mode 100644
index 0000000..c07ac04
--- /dev/null
+++ b/camera/tests/fuzzer/README.md
@@ -0,0 +1,74 @@
+# Fuzzers for libcamera_client
+
+## Plugin Design Considerations
+The fuzzer plugins for libcamera_client are designed based on the understanding of the
+source code and try to achieve the following:
+
+##### Maximize code coverage
+The configuration parameters are not hardcoded, but instead selected based on
+incoming data. This ensures more code paths are reached by the fuzzers.
+
+libcamera_client supports the following parameters:
+1. Command (parameter name: `cmd`)
+2. Video Buffer Mode (parameter name: `videoBufferMode`)
+3. Preview Callback Flag (parameter name: `previewCallbackFlag`)
+4. Facing (parameter name: `facing`)
+5. Orientation (parameter name: `orientation`)
+6. Format (parameter name: `format`)
+
+| Parameter| Valid Values| Configured Value|
+|------------- |-------------| ----- |
+| `cmd` | 0.`CAMERA_CMD_START_SMOOTH_ZOOM` 1.`CAMERA_CMD_STOP_SMOOTH_ZOOM` 3.`CAMERA_CMD_SET_DISPLAY_ORIENTATION` 4.`CAMERA_CMD_ENABLE_SHUTTER_SOUND` 5.`CAMERA_CMD_PLAY_RECORDING_SOUND` 6.`CAMERA_CMD_START_FACE_DETECTION` 7.`CAMERA_CMD_STOP_FACE_DETECTION` 8.`CAMERA_CMD_ENABLE_FOCUS_MOVE_MSG` 9.`CAMERA_CMD_PING` 10.`CAMERA_CMD_SET_VIDEO_BUFFER_COUNT` 11.`CAMERA_CMD_SET_VIDEO_FORMAT`| Value obtained from FuzzedDataProvider|
+| `videoBufferMode` |0. `ICamera::VIDEO_BUFFER_MODE_DATA_CALLBACK_YUV` 1.`ICamera::VIDEO_BUFFER_MODE_DATA_CALLBACK_METADATA` 2.`ICamera::VIDEO_BUFFER_MODE_BUFFER_QUEUE`| Value obtained from FuzzedDataProvider|
+| `previewCallbackFlag` | 0. `CAMERA_FRAME_CALLBACK_FLAG_ENABLE_MASK` 1.`CAMERA_FRAME_CALLBACK_FLAG_ONE_SHOT_MASK` 2.`CAMERA_FRAME_CALLBACK_FLAG_COPY_OUT_MASK` 3.`CAMERA_FRAME_CALLBACK_FLAG_NOOP` 4.`CAMERA_FRAME_CALLBACK_FLAG_CAMCORDER` 5.`CAMERA_FRAME_CALLBACK_FLAG_CAMERA` 6.`CAMERA_FRAME_CALLBACK_FLAG_BARCODE_SCANNER`| Value obtained from FuzzedDataProvider|
+| `facing` | 0.`android::hardware::CAMERA_FACING_BACK` 1.`android::hardware::CAMERA_FACING_FRONT`| Value obtained from FuzzedDataProvider|
+| `orientation` | 0.`0` 1.`90` 2.`180`3.`270`| Value obtained from FuzzedDataProvider|
+| `format` | 0.`CameraParameters::PIXEL_FORMAT_YUV422SP` 1.`CameraParameters::PIXEL_FORMAT_YUV420SP` 2.`CameraParameters::PIXEL_FORMAT_YUV422I` 3.`CameraParameters::PIXEL_FORMAT_YUV420P` 4.`CameraParameters::PIXEL_FORMAT_RGB565` 5.`CameraParameters::PIXEL_FORMAT_RGBA8888` 6.`CameraParameters::PIXEL_FORMAT_JPEG` 7.`CameraParameters::PIXEL_FORMAT_BAYER_RGGB` 8.`CameraParameters::PIXEL_FORMAT_ANDROID_OPAQUE`| Value obtained from FuzzedDataProvider|
+
+This also ensures that the plugins are always deterministic for any given input.
+
+##### Maximize utilization of input data
+The plugins feed the entire input data to the module.
+This ensures that the plugins tolerate any kind of input (empty, huge,
+malformed, etc) and dont `exit()` on any input and thereby increasing the
+chance of identifying vulnerabilities.
+
+## Build
+
+This describes steps to build camera_fuzzer, camera2CaptureRequest_fuzzer, camera2ConcurrentCamera_fuzzer, camera2SubmitInfo_fuzzer, camera2SessionConfiguration_fuzzer, camera2OutputConfiguration_fuzzer, vendorTagDescriptor_fuzzer, cameraParameters_fuzzer, cameraSessionStats_fuzzer and captureResult_fuzzer binaries
+
+### Android
+
+#### Steps to build
+Build the fuzzer
+```
+ $ mm -j$(nproc) camera_fuzzer
+ $ mm -j$(nproc) camera_c2CaptureRequest_fuzzer
+ $ mm -j$(nproc) camera_c2ConcurrentCamera_fuzzer
+ $ mm -j$(nproc) camera_c2SubmitInfo_fuzzer
+ $ mm -j$(nproc) camera_c2SessionConfiguration_fuzzer
+ $ mm -j$(nproc) camera_c2OutputConfiguration_fuzzer
+ $ mm -j$(nproc) camera_vendorTagDescriptor_fuzzer
+ $ mm -j$(nproc) camera_Parameters_fuzzer
+ $ mm -j$(nproc) camera_SessionStats_fuzzer
+ $ mm -j$(nproc) camera_captureResult_fuzzer
+```
+#### Steps to run
+To run on device
+```
+ $ adb sync data
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_fuzzer/camera_fuzzer
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2CaptureRequest_fuzzer/camera_c2CaptureRequest_fuzzer
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2ConcurrentCamera_fuzzer/camera_c2ConcurrentCamera_fuzzer
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2SubmitInfo_fuzzer/camera_c2SubmitInfo_fuzzer
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2SessionConfiguration_fuzzer/camera_c2SessionConfiguration_fuzzer
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_c2OutputConfiguration_fuzzer/camera_c2OutputConfiguration_fuzzer
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_vendorTagDescriptor_fuzzer/camera_vendorTagDescriptor_fuzzer
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_Parameters_fuzzer/camera_Parameters_fuzzer
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_SessionStats_fuzzer/camera_SessionStats_fuzzer
+ $ adb shell /data/fuzz/${TARGET_ARCH}/camera_captureResult_fuzzer/camera_captureResult_fuzzer
+```
+
+## References:
+ * http://llvm.org/docs/LibFuzzer.html
+ * https://github.com/google/oss-fuzz
diff --git a/camera/tests/fuzzer/camera2common.h b/camera/tests/fuzzer/camera2common.h
new file mode 100644
index 0000000..14a1b1b
--- /dev/null
+++ b/camera/tests/fuzzer/camera2common.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef CAMERA2COMMON_H
+#define CAMERA2COMMON_H
+
+#include <binder/Parcel.h>
+
+using namespace android;
+
+template <class type>
+void invokeReadWriteNullParcel(type* obj) {
+ Parcel* parcelNull = nullptr;
+ obj->writeToParcel(parcelNull);
+ obj->readFromParcel(parcelNull);
+}
+
+template <class type>
+void invokeReadWriteNullParcelsp(sp<type> obj) {
+ Parcel* parcelNull = nullptr;
+ obj->writeToParcel(parcelNull);
+ obj->readFromParcel(parcelNull);
+}
+
+template <class type>
+void invokeReadWriteParcel(type* obj) {
+ Parcel* parcel = new Parcel();
+ obj->writeToParcel(parcel);
+ parcel->setDataPosition(0);
+ obj->readFromParcel(parcel);
+ delete parcel;
+}
+
+template <class type>
+void invokeReadWriteParcelsp(sp<type> obj) {
+ Parcel* parcel = new Parcel();
+ obj->writeToParcel(parcel);
+ parcel->setDataPosition(0);
+ obj->readFromParcel(parcel);
+ delete parcel;
+}
+
+#endif // CAMERA2COMMON_H
diff --git a/camera/tests/fuzzer/camera_Parameters_fuzzer.cpp b/camera/tests/fuzzer/camera_Parameters_fuzzer.cpp
new file mode 100644
index 0000000..45b3526
--- /dev/null
+++ b/camera/tests/fuzzer/camera_Parameters_fuzzer.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <CameraParameters.h>
+#include <CameraParameters2.h>
+#include <fcntl.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <utils/String16.h>
+
+using namespace std;
+using namespace android;
+
+string kValidFormats[] = {
+ CameraParameters::PIXEL_FORMAT_YUV422SP, CameraParameters::PIXEL_FORMAT_YUV420SP,
+ CameraParameters::PIXEL_FORMAT_YUV422I, CameraParameters::PIXEL_FORMAT_YUV420P,
+ CameraParameters::PIXEL_FORMAT_RGB565, CameraParameters::PIXEL_FORMAT_RGBA8888,
+ CameraParameters::PIXEL_FORMAT_JPEG, CameraParameters::PIXEL_FORMAT_BAYER_RGGB,
+ CameraParameters::PIXEL_FORMAT_ANDROID_OPAQUE};
+
+class CameraParametersFuzzer {
+ public:
+ void process(const uint8_t* data, size_t size);
+ ~CameraParametersFuzzer() {
+ delete mCameraParameters;
+ delete mCameraParameters2;
+ }
+
+ private:
+ void invokeCameraParameters();
+ template <class type>
+ void initCameraParameters(type** obj);
+ template <class type>
+ void cameraParametersCommon(type* obj);
+ CameraParameters* mCameraParameters = nullptr;
+ CameraParameters2* mCameraParameters2 = nullptr;
+ FuzzedDataProvider* mFDP = nullptr;
+};
+
+template <class type>
+void CameraParametersFuzzer::initCameraParameters(type** obj) {
+ if (mFDP->ConsumeBool()) {
+ *obj = new type();
+ } else {
+ string params;
+ if (mFDP->ConsumeBool()) {
+ int32_t width = mFDP->ConsumeIntegral<int32_t>();
+ int32_t height = mFDP->ConsumeIntegral<int32_t>();
+ int32_t minFps = mFDP->ConsumeIntegral<int32_t>();
+ int32_t maxFps = mFDP->ConsumeIntegral<int32_t>();
+ params = CameraParameters::KEY_SUPPORTED_VIDEO_SIZES;
+ params += '=' + to_string(width) + 'x' + to_string(height) + ';';
+ if (mFDP->ConsumeBool()) {
+ params += CameraParameters::KEY_PREVIEW_FPS_RANGE;
+ params += '=' + to_string(minFps) + ',' + to_string(maxFps) + ';';
+ }
+ if (mFDP->ConsumeBool()) {
+ params += CameraParameters::KEY_SUPPORTED_PICTURE_SIZES;
+ params += '=' + to_string(width) + 'x' + to_string(height) + ';';
+ }
+ if (mFDP->ConsumeBool()) {
+ params += CameraParameters::KEY_SUPPORTED_PREVIEW_FORMATS;
+ params += '=' + mFDP->PickValueInArray(kValidFormats) + ';';
+ }
+ } else {
+ params = mFDP->ConsumeRandomLengthString();
+ }
+ *obj = new type(String8(params.c_str()));
+ }
+}
+
+template <class type>
+void CameraParametersFuzzer::cameraParametersCommon(type* obj) {
+ Vector<Size> supportedPreviewSizes;
+ obj->getSupportedPreviewSizes(supportedPreviewSizes);
+ int32_t previewWidth = mFDP->ConsumeIntegral<int32_t>();
+ int32_t previewHeight = mFDP->ConsumeIntegral<int32_t>();
+ obj->setPreviewSize(previewWidth, previewHeight);
+ obj->getPreviewSize(&previewWidth, &previewHeight);
+
+ Vector<Size> supportedVideoSizes;
+ obj->getSupportedVideoSizes(supportedVideoSizes);
+ if (supportedVideoSizes.size() != 0) {
+ int32_t videoWidth, videoHeight, preferredVideoWidth, preferredVideoHeight;
+ if (mFDP->ConsumeBool()) {
+ int32_t idx = mFDP->ConsumeIntegralInRange<int32_t>(0, supportedVideoSizes.size() - 1);
+ obj->setVideoSize(supportedVideoSizes[idx].width, supportedVideoSizes[idx].height);
+ } else {
+ videoWidth = mFDP->ConsumeIntegral<int32_t>();
+ videoHeight = mFDP->ConsumeIntegral<int32_t>();
+ obj->setVideoSize(videoWidth, videoHeight);
+ }
+ obj->getVideoSize(&videoWidth, &videoHeight);
+ obj->getPreferredPreviewSizeForVideo(&preferredVideoWidth, &preferredVideoHeight);
+ }
+
+ int32_t fps = mFDP->ConsumeIntegral<int32_t>();
+ obj->setPreviewFrameRate(fps);
+ obj->getPreviewFrameRate();
+ string previewFormat = mFDP->ConsumeBool() ? mFDP->PickValueInArray(kValidFormats)
+ : mFDP->ConsumeRandomLengthString();
+ obj->setPreviewFormat(previewFormat.c_str());
+
+ int32_t pictureWidth = mFDP->ConsumeIntegral<int32_t>();
+ int32_t pictureHeight = mFDP->ConsumeIntegral<int32_t>();
+ Vector<Size> supportedPictureSizes;
+ obj->setPictureSize(pictureWidth, pictureHeight);
+ obj->getPictureSize(&pictureWidth, &pictureHeight);
+ obj->getSupportedPictureSizes(supportedPictureSizes);
+ string pictureFormat = mFDP->ConsumeBool() ? mFDP->PickValueInArray(kValidFormats)
+ : mFDP->ConsumeRandomLengthString();
+ obj->setPictureFormat(pictureFormat.c_str());
+ obj->getPictureFormat();
+
+ if (mFDP->ConsumeBool()) {
+ obj->dump();
+ } else {
+ int32_t fd = open("/dev/null", O_CLOEXEC | O_RDWR | O_CREAT);
+ Vector<String16> args = {};
+ obj->dump(fd, args);
+ close(fd);
+ }
+}
+
+void CameraParametersFuzzer::invokeCameraParameters() {
+ initCameraParameters<CameraParameters>(&mCameraParameters);
+ cameraParametersCommon<CameraParameters>(mCameraParameters);
+ initCameraParameters<CameraParameters2>(&mCameraParameters2);
+ cameraParametersCommon<CameraParameters2>(mCameraParameters2);
+
+ int32_t minFPS, maxFPS;
+ mCameraParameters->getPreviewFpsRange(&minFPS, &maxFPS);
+ string format = mFDP->ConsumeBool() ? mFDP->PickValueInArray(kValidFormats)
+ : mFDP->ConsumeRandomLengthString();
+ mCameraParameters->previewFormatToEnum(format.c_str());
+ mCameraParameters->isEmpty();
+ Vector<int32_t> formats;
+ mCameraParameters->getSupportedPreviewFormats(formats);
+}
+
+void CameraParametersFuzzer::process(const uint8_t* data, size_t size) {
+ mFDP = new FuzzedDataProvider(data, size);
+ invokeCameraParameters();
+ delete mFDP;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ CameraParametersFuzzer cameraParametersFuzzer;
+ cameraParametersFuzzer.process(data, size);
+ return 0;
+}
diff --git a/camera/tests/fuzzer/camera_SessionStats_fuzzer.cpp b/camera/tests/fuzzer/camera_SessionStats_fuzzer.cpp
new file mode 100644
index 0000000..1e94d47
--- /dev/null
+++ b/camera/tests/fuzzer/camera_SessionStats_fuzzer.cpp
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <CameraSessionStats.h>
+#include <binder/Parcel.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include "camera2common.h"
+
+using namespace std;
+using namespace android;
+using namespace android::hardware;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
+ CameraStreamStats* cameraStreamStats = nullptr;
+ Parcel parcelCamStreamStats;
+
+ if (fdp.ConsumeBool()) {
+ cameraStreamStats = new CameraStreamStats();
+ } else {
+ int32_t width = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt32(width);
+ }
+ int32_t height = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt32(height);
+ }
+ int32_t format = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt32(format);
+ }
+ float maxPreviewFps = fdp.ConsumeFloatingPoint<float>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeFloat(maxPreviewFps);
+ }
+ int32_t dataSpace = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt32(dataSpace);
+ }
+ int64_t usage = fdp.ConsumeIntegral<int64_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt64(usage);
+ }
+ int64_t requestCount = fdp.ConsumeIntegral<int64_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt64(requestCount);
+ }
+ int64_t errorCount = fdp.ConsumeIntegral<int64_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt64(errorCount);
+ }
+ int32_t maxHalBuffers = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt32(maxHalBuffers);
+ }
+ int32_t maxAppBuffers = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt32(maxAppBuffers);
+ }
+ int32_t dynamicRangeProfile = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt32(dynamicRangeProfile);
+ }
+ int32_t streamUseCase = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamStreamStats.writeInt32(streamUseCase);
+ }
+
+ cameraStreamStats = new CameraStreamStats(width, height, format, maxPreviewFps, dataSpace,
+ usage, maxHalBuffers, maxAppBuffers,
+ dynamicRangeProfile, streamUseCase);
+ }
+
+ parcelCamStreamStats.setDataPosition(0);
+ cameraStreamStats->readFromParcel(&parcelCamStreamStats);
+ invokeReadWriteNullParcel<CameraStreamStats>(cameraStreamStats);
+ invokeReadWriteParcel<CameraStreamStats>(cameraStreamStats);
+
+ CameraSessionStats* cameraSessionStats = nullptr;
+ Parcel parcelCamSessionStats;
+
+ if (fdp.ConsumeBool()) {
+ cameraSessionStats = new CameraSessionStats();
+ } else {
+ string camId = fdp.ConsumeRandomLengthString();
+ String16 cameraId(camId.c_str());
+ if (fdp.ConsumeBool()) {
+ parcelCamSessionStats.writeString16(cameraId);
+ }
+ int32_t facing = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamSessionStats.writeInt32(facing);
+ }
+ int32_t newCameraState = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamSessionStats.writeInt32(newCameraState);
+ }
+ string name = fdp.ConsumeRandomLengthString();
+ String16 clientName(name.c_str());
+ if (fdp.ConsumeBool()) {
+ parcelCamSessionStats.writeString16(clientName);
+ }
+ int32_t apiLevel = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamSessionStats.writeInt32(apiLevel);
+ }
+ bool isNdk = fdp.ConsumeBool();
+ if (fdp.ConsumeBool()) {
+ parcelCamSessionStats.writeBool(isNdk);
+ }
+ int32_t latencyMs = fdp.ConsumeIntegral<int32_t>();
+ if (fdp.ConsumeBool()) {
+ parcelCamSessionStats.writeInt32(latencyMs);
+ }
+
+ cameraSessionStats = new CameraSessionStats(cameraId, facing, newCameraState, clientName,
+ apiLevel, isNdk, latencyMs);
+ }
+
+ if (fdp.ConsumeBool()) {
+ int32_t internalReconfigure = fdp.ConsumeIntegral<int32_t>();
+ parcelCamSessionStats.writeInt32(internalReconfigure);
+ }
+
+ if (fdp.ConsumeBool()) {
+ int64_t requestCount = fdp.ConsumeIntegral<int64_t>();
+ parcelCamSessionStats.writeInt64(requestCount);
+ }
+
+ if (fdp.ConsumeBool()) {
+ int64_t resultErrorCount = fdp.ConsumeIntegral<int64_t>();
+ parcelCamSessionStats.writeInt64(resultErrorCount);
+ }
+
+ if (fdp.ConsumeBool()) {
+ bool deviceError = fdp.ConsumeBool();
+ parcelCamSessionStats.writeBool(deviceError);
+ }
+
+ parcelCamSessionStats.setDataPosition(0);
+ cameraSessionStats->readFromParcel(&parcelCamSessionStats);
+ invokeReadWriteNullParcel<CameraSessionStats>(cameraSessionStats);
+ invokeReadWriteParcel<CameraSessionStats>(cameraSessionStats);
+
+ delete cameraStreamStats;
+ delete cameraSessionStats;
+ return 0;
+}
diff --git a/camera/tests/fuzzer/camera_c2CaptureRequest_fuzzer.cpp b/camera/tests/fuzzer/camera_c2CaptureRequest_fuzzer.cpp
new file mode 100644
index 0000000..06215a5
--- /dev/null
+++ b/camera/tests/fuzzer/camera_c2CaptureRequest_fuzzer.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <CameraMetadata.h>
+#include <camera2/CaptureRequest.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gui/Surface.h>
+#include <gui/SurfaceComposerClient.h>
+#include <gui/view/Surface.h>
+#include "camera2common.h"
+
+using namespace std;
+using namespace android;
+
+constexpr int32_t kNonZeroRangeMin = 0;
+constexpr int32_t kRangeMax = 1000;
+constexpr int32_t kSizeMin = 1;
+constexpr int32_t kSizeMax = 1000;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
+
+ sp<CaptureRequest> captureRequest = new CaptureRequest();
+ Parcel parcelCamCaptureReq;
+
+ size_t physicalCameraSettingsSize =
+ fdp.ConsumeIntegralInRange<size_t>(kNonZeroRangeMin, kRangeMax);
+ if (fdp.ConsumeBool()) {
+ parcelCamCaptureReq.writeInt32(physicalCameraSettingsSize);
+ }
+
+ for (size_t idx = 0; idx < physicalCameraSettingsSize; ++idx) {
+ string id = fdp.ConsumeRandomLengthString();
+ if (fdp.ConsumeBool()) {
+ parcelCamCaptureReq.writeString16(String16(id.c_str()));
+ }
+ CameraMetadata cameraMetadata;
+ if (fdp.ConsumeBool()) {
+ cameraMetadata = CameraMetadata();
+ } else {
+ size_t entryCapacity = fdp.ConsumeIntegralInRange<size_t>(kNonZeroRangeMin, kRangeMax);
+ size_t dataCapacity = fdp.ConsumeIntegralInRange<size_t>(kNonZeroRangeMin, kRangeMax);
+ cameraMetadata = CameraMetadata(entryCapacity, dataCapacity);
+ }
+ captureRequest->mPhysicalCameraSettings.push_back({id, cameraMetadata});
+ if (fdp.ConsumeBool()) {
+ cameraMetadata.writeToParcel(&parcelCamCaptureReq);
+ }
+ }
+
+ captureRequest->mIsReprocess = fdp.ConsumeBool();
+ if (fdp.ConsumeBool()) {
+ parcelCamCaptureReq.writeInt32(captureRequest->mIsReprocess);
+ }
+
+ captureRequest->mSurfaceConverted = fdp.ConsumeBool();
+ if (fdp.ConsumeBool() && captureRequest->mSurfaceConverted) {
+ // 0-sized array
+ parcelCamCaptureReq.writeInt32(0);
+ }
+
+ if (!captureRequest->mSurfaceConverted) {
+ size_t surfaceListSize = fdp.ConsumeIntegralInRange<size_t>(kSizeMin, kSizeMax);
+ if (fdp.ConsumeBool()) {
+ parcelCamCaptureReq.writeInt32(surfaceListSize);
+ }
+ for (size_t idx = 0; idx < surfaceListSize; ++idx) {
+ sp<SurfaceComposerClient> composerClient = new SurfaceComposerClient;
+ sp<SurfaceControl> surfaceControl = composerClient->createSurface(
+ static_cast<String8>(fdp.ConsumeRandomLengthString().c_str()) /* name */,
+ fdp.ConsumeIntegral<uint32_t>() /* width */,
+ fdp.ConsumeIntegral<uint32_t>() /* height */,
+ fdp.ConsumeIntegral<int32_t>() /* format */,
+ fdp.ConsumeIntegral<int32_t>() /* flags */);
+ if (surfaceControl) {
+ sp<Surface> surface = surfaceControl->getSurface();
+ captureRequest->mSurfaceList.push_back(surface);
+ if (fdp.ConsumeBool()) {
+ view::Surface surfaceShim;
+ surfaceShim.name = String16((fdp.ConsumeRandomLengthString()).c_str());
+ surfaceShim.graphicBufferProducer = surface->getIGraphicBufferProducer();
+ surfaceShim.writeToParcel(&parcelCamCaptureReq);
+ }
+ surface.clear();
+ }
+ composerClient.clear();
+ surfaceControl.clear();
+ }
+ }
+
+ size_t indexListSize = fdp.ConsumeIntegralInRange<size_t>(kSizeMin, kSizeMax);
+ if (fdp.ConsumeBool()) {
+ parcelCamCaptureReq.writeInt32(indexListSize);
+ }
+
+ for (size_t idx = 0; idx < indexListSize; ++idx) {
+ int32_t streamIdx = fdp.ConsumeIntegral<int32_t>();
+ int32_t surfaceIdx = fdp.ConsumeIntegral<int32_t>();
+ captureRequest->mStreamIdxList.push_back(streamIdx);
+ captureRequest->mSurfaceIdxList.push_back(surfaceIdx);
+ if (fdp.ConsumeBool()) {
+ parcelCamCaptureReq.writeInt32(streamIdx);
+ }
+ if (fdp.ConsumeBool()) {
+ parcelCamCaptureReq.writeInt32(surfaceIdx);
+ }
+ }
+
+ invokeReadWriteParcelsp<CaptureRequest>(captureRequest);
+ invokeReadWriteNullParcelsp<CaptureRequest>(captureRequest);
+ parcelCamCaptureReq.setDataPosition(0);
+ captureRequest->readFromParcel(&parcelCamCaptureReq);
+ captureRequest.clear();
+ return 0;
+}
diff --git a/camera/tests/fuzzer/camera_c2ConcurrentCamera_fuzzer.cpp b/camera/tests/fuzzer/camera_c2ConcurrentCamera_fuzzer.cpp
new file mode 100644
index 0000000..12b5bc3
--- /dev/null
+++ b/camera/tests/fuzzer/camera_c2ConcurrentCamera_fuzzer.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <camera2/ConcurrentCamera.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include "camera2common.h"
+
+using namespace std;
+using namespace android;
+using namespace android::hardware::camera2::utils;
+
+constexpr int32_t kRangeMin = 0;
+constexpr int32_t kRangeMax = 1000;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
+ ConcurrentCameraIdCombination camIdCombination;
+
+ if (fdp.ConsumeBool()) {
+ size_t concurrentCameraIdSize = fdp.ConsumeIntegralInRange<size_t>(kRangeMin, kRangeMax);
+ for (size_t idx = 0; idx < concurrentCameraIdSize; ++idx) {
+ string concurrentCameraId = fdp.ConsumeRandomLengthString();
+ camIdCombination.mConcurrentCameraIds.push_back(concurrentCameraId);
+ }
+ }
+
+ invokeReadWriteNullParcel<ConcurrentCameraIdCombination>(&camIdCombination);
+ invokeReadWriteParcel<ConcurrentCameraIdCombination>(&camIdCombination);
+
+ CameraIdAndSessionConfiguration camIdAndSessionConfig;
+
+ if (fdp.ConsumeBool()) {
+ camIdAndSessionConfig.mCameraId = fdp.ConsumeRandomLengthString();
+ if (fdp.ConsumeBool()) {
+ camIdAndSessionConfig.mSessionConfiguration = SessionConfiguration();
+ } else {
+ int32_t inputWidth = fdp.ConsumeIntegral<int32_t>();
+ int32_t inputHeight = fdp.ConsumeIntegral<int32_t>();
+ int32_t inputFormat = fdp.ConsumeIntegral<int32_t>();
+ int32_t operatingMode = fdp.ConsumeIntegral<int32_t>();
+ camIdAndSessionConfig.mSessionConfiguration =
+ SessionConfiguration(inputWidth, inputHeight, inputFormat, operatingMode);
+ }
+ }
+
+ invokeReadWriteNullParcel<CameraIdAndSessionConfiguration>(&camIdAndSessionConfig);
+ invokeReadWriteParcel<CameraIdAndSessionConfiguration>(&camIdAndSessionConfig);
+ return 0;
+}
diff --git a/camera/tests/fuzzer/camera_c2OutputConfiguration_fuzzer.cpp b/camera/tests/fuzzer/camera_c2OutputConfiguration_fuzzer.cpp
new file mode 100644
index 0000000..51ac4e8
--- /dev/null
+++ b/camera/tests/fuzzer/camera_c2OutputConfiguration_fuzzer.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <camera2/OutputConfiguration.h>
+#include <camera2/SessionConfiguration.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gui/IGraphicBufferProducer.h>
+#include <gui/Surface.h>
+#include <gui/SurfaceComposerClient.h>
+#include "camera2common.h"
+
+using namespace std;
+using namespace android;
+using namespace android::hardware::camera2::params;
+
+constexpr int32_t kSizeMin = 0;
+constexpr int32_t kSizeMax = 1000;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
+
+ OutputConfiguration* outputConfiguration = nullptr;
+
+ if (fdp.ConsumeBool()) {
+ outputConfiguration = new OutputConfiguration();
+ } else {
+ int32_t rotation = fdp.ConsumeIntegral<int32_t>();
+ string phyCameraId = fdp.ConsumeRandomLengthString();
+ String16 physicalCameraId(phyCameraId.c_str());
+ int32_t surfaceSetID = fdp.ConsumeIntegral<int32_t>();
+ bool isShared = fdp.ConsumeBool();
+
+ if (fdp.ConsumeBool()) {
+ sp<IGraphicBufferProducer> iGBP = nullptr;
+ sp<SurfaceComposerClient> composerClient = new SurfaceComposerClient;
+ sp<SurfaceControl> surfaceControl = composerClient->createSurface(
+ static_cast<String8>(fdp.ConsumeRandomLengthString().c_str()) /* name */,
+ fdp.ConsumeIntegral<uint32_t>() /* width */,
+ fdp.ConsumeIntegral<uint32_t>() /* height */,
+ fdp.ConsumeIntegral<int32_t>() /* format */,
+ fdp.ConsumeIntegral<int32_t>() /* flags */);
+ if (surfaceControl) {
+ sp<Surface> surface = surfaceControl->getSurface();
+ iGBP = surface->getIGraphicBufferProducer();
+ }
+ outputConfiguration = new OutputConfiguration(iGBP, rotation, physicalCameraId,
+ surfaceSetID, isShared);
+ iGBP.clear();
+ composerClient.clear();
+ surfaceControl.clear();
+ } else {
+ size_t iGBPSize = fdp.ConsumeIntegralInRange<size_t>(kSizeMin, kSizeMax);
+ vector<sp<IGraphicBufferProducer>> iGBPs;
+ for (size_t idx = 0; idx < iGBPSize; ++idx) {
+ sp<IGraphicBufferProducer> iGBP = nullptr;
+ sp<SurfaceComposerClient> composerClient = new SurfaceComposerClient;
+ sp<SurfaceControl> surfaceControl = composerClient->createSurface(
+ static_cast<String8>(fdp.ConsumeRandomLengthString().c_str()) /* name */,
+ fdp.ConsumeIntegral<uint32_t>() /* width */,
+ fdp.ConsumeIntegral<uint32_t>() /* height */,
+ fdp.ConsumeIntegral<int32_t>() /* format */,
+ fdp.ConsumeIntegral<int32_t>() /* flags */);
+ if (surfaceControl) {
+ sp<Surface> surface = surfaceControl->getSurface();
+ iGBP = surface->getIGraphicBufferProducer();
+ iGBPs.push_back(iGBP);
+ }
+ iGBP.clear();
+ composerClient.clear();
+ surfaceControl.clear();
+ }
+ outputConfiguration = new OutputConfiguration(iGBPs, rotation, physicalCameraId,
+ surfaceSetID, isShared);
+ }
+ }
+
+ outputConfiguration->getRotation();
+ outputConfiguration->getSurfaceSetID();
+ outputConfiguration->getSurfaceType();
+ outputConfiguration->getWidth();
+ outputConfiguration->getHeight();
+ outputConfiguration->isDeferred();
+ outputConfiguration->isShared();
+ outputConfiguration->getPhysicalCameraId();
+
+ OutputConfiguration outputConfiguration2;
+ outputConfiguration->gbpsEqual(outputConfiguration2);
+ outputConfiguration->sensorPixelModesUsedEqual(outputConfiguration2);
+ outputConfiguration->gbpsLessThan(outputConfiguration2);
+ outputConfiguration->sensorPixelModesUsedLessThan(outputConfiguration2);
+ outputConfiguration->getGraphicBufferProducers();
+ sp<IGraphicBufferProducer> gbp;
+ outputConfiguration->addGraphicProducer(gbp);
+ invokeReadWriteNullParcel<OutputConfiguration>(outputConfiguration);
+ invokeReadWriteParcel<OutputConfiguration>(outputConfiguration);
+ delete outputConfiguration;
+ return 0;
+}
diff --git a/camera/tests/fuzzer/camera_c2SessionConfiguration_fuzzer.cpp b/camera/tests/fuzzer/camera_c2SessionConfiguration_fuzzer.cpp
new file mode 100644
index 0000000..b2de95d
--- /dev/null
+++ b/camera/tests/fuzzer/camera_c2SessionConfiguration_fuzzer.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <camera2/OutputConfiguration.h>
+#include <camera2/SessionConfiguration.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gui/IGraphicBufferProducer.h>
+#include <gui/Surface.h>
+#include <gui/SurfaceComposerClient.h>
+#include "camera2common.h"
+
+using namespace std;
+using namespace android;
+using namespace android::hardware::camera2::params;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
+
+ SessionConfiguration* sessionConfiguration = nullptr;
+
+ if (fdp.ConsumeBool()) {
+ sessionConfiguration = new SessionConfiguration();
+ } else {
+ int32_t inputWidth = fdp.ConsumeIntegral<int32_t>();
+ int32_t inputHeight = fdp.ConsumeIntegral<int32_t>();
+ int32_t inputFormat = fdp.ConsumeIntegral<int32_t>();
+ int32_t operatingMode = fdp.ConsumeIntegral<int32_t>();
+ sessionConfiguration =
+ new SessionConfiguration(inputWidth, inputHeight, inputFormat, operatingMode);
+ }
+
+ sessionConfiguration->getInputWidth();
+ sessionConfiguration->getInputHeight();
+ sessionConfiguration->getInputFormat();
+ sessionConfiguration->getOperatingMode();
+
+ OutputConfiguration* outputConfiguration = nullptr;
+
+ if (fdp.ConsumeBool()) {
+ outputConfiguration = new OutputConfiguration();
+ sessionConfiguration->addOutputConfiguration(*outputConfiguration);
+ } else {
+ sp<IGraphicBufferProducer> iGBP = nullptr;
+ sp<SurfaceComposerClient> composerClient = new SurfaceComposerClient;
+ sp<SurfaceControl> surfaceControl = composerClient->createSurface(
+ static_cast<String8>(fdp.ConsumeRandomLengthString().c_str()),
+ fdp.ConsumeIntegral<uint32_t>(), fdp.ConsumeIntegral<uint32_t>(),
+ fdp.ConsumeIntegral<int32_t>(), fdp.ConsumeIntegral<int32_t>());
+ if (surfaceControl) {
+ sp<Surface> surface = surfaceControl->getSurface();
+ iGBP = surface->getIGraphicBufferProducer();
+ surface.clear();
+ }
+ int32_t rotation = fdp.ConsumeIntegral<int32_t>();
+ string phyCameraId = fdp.ConsumeRandomLengthString();
+ String16 physicalCameraId(phyCameraId.c_str());
+ int32_t surfaceSetID = fdp.ConsumeIntegral<int32_t>();
+ bool isShared = fdp.ConsumeBool();
+ outputConfiguration =
+ new OutputConfiguration(iGBP, rotation, physicalCameraId, surfaceSetID, isShared);
+ sessionConfiguration->addOutputConfiguration(*outputConfiguration);
+ }
+
+ sessionConfiguration->getOutputConfigurations();
+ SessionConfiguration sessionConfiguration2;
+ sessionConfiguration->outputsEqual(sessionConfiguration2);
+ sessionConfiguration->outputsLessThan(sessionConfiguration2);
+ sessionConfiguration->inputIsMultiResolution();
+
+ invokeReadWriteNullParcel<SessionConfiguration>(sessionConfiguration);
+ invokeReadWriteParcel<SessionConfiguration>(sessionConfiguration);
+
+ delete sessionConfiguration;
+ delete outputConfiguration;
+ return 0;
+}
diff --git a/camera/tests/fuzzer/camera_c2SubmitInfo_fuzzer.cpp b/camera/tests/fuzzer/camera_c2SubmitInfo_fuzzer.cpp
new file mode 100644
index 0000000..dc40b0f
--- /dev/null
+++ b/camera/tests/fuzzer/camera_c2SubmitInfo_fuzzer.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <camera2/SubmitInfo.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include "camera2common.h"
+
+using namespace std;
+using namespace android;
+using namespace android::hardware::camera2::utils;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
+ SubmitInfo submitInfo;
+ submitInfo.mRequestId = fdp.ConsumeIntegral<int32_t>();
+ submitInfo.mLastFrameNumber = fdp.ConsumeIntegral<int64_t>();
+ invokeReadWriteParcel<SubmitInfo>(&submitInfo);
+ return 0;
+}
diff --git a/camera/tests/fuzzer/camera_captureResult_fuzzer.cpp b/camera/tests/fuzzer/camera_captureResult_fuzzer.cpp
new file mode 100644
index 0000000..03cf9c4
--- /dev/null
+++ b/camera/tests/fuzzer/camera_captureResult_fuzzer.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <CaptureResult.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include "camera2common.h"
+
+using namespace std;
+using namespace android;
+using namespace android::hardware::camera2::impl;
+
+constexpr int32_t kSizeMin = 0;
+constexpr int32_t kSizeMax = 1000;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
+ PhysicalCaptureResultInfo* physicalCaptureResultInfo = nullptr;
+
+ if (fdp.ConsumeBool()) {
+ physicalCaptureResultInfo = new PhysicalCaptureResultInfo();
+ } else {
+ string camId = fdp.ConsumeRandomLengthString();
+ String16 cameraId(camId.c_str());
+ CameraMetadata cameraMetadata = CameraMetadata();
+ physicalCaptureResultInfo = new PhysicalCaptureResultInfo(cameraId, cameraMetadata);
+ }
+
+ invokeReadWriteParcel<PhysicalCaptureResultInfo>(physicalCaptureResultInfo);
+
+ CaptureResult* captureResult = new CaptureResult();
+
+ if (fdp.ConsumeBool()) {
+ captureResult->mMetadata = CameraMetadata();
+ }
+ if (fdp.ConsumeBool()) {
+ captureResult->mResultExtras = CaptureResultExtras();
+ string errCamId = fdp.ConsumeRandomLengthString();
+ String16 errCameraId(errCamId.c_str());
+ captureResult->mResultExtras.errorPhysicalCameraId = errCameraId;
+ captureResult->mResultExtras.isValid();
+ invokeReadWriteNullParcel<CaptureResultExtras>(&(captureResult->mResultExtras));
+ }
+ if (fdp.ConsumeBool()) {
+ size_t physicalMetadatasSize = fdp.ConsumeIntegralInRange<size_t>(kSizeMin, kSizeMax);
+ for (size_t idx = 0; idx < physicalMetadatasSize; ++idx) {
+ captureResult->mPhysicalMetadatas.push_back(PhysicalCaptureResultInfo());
+ }
+ }
+
+ invokeReadWriteNullParcel<CaptureResult>(captureResult);
+ invokeReadWriteParcel<CaptureResult>(captureResult);
+ CaptureResult captureResult2(*captureResult);
+ CaptureResult captureResult3(move(captureResult2));
+
+ delete captureResult;
+ delete physicalCaptureResultInfo;
+ return 0;
+}
diff --git a/camera/tests/fuzzer/camera_fuzzer.cpp b/camera/tests/fuzzer/camera_fuzzer.cpp
new file mode 100644
index 0000000..f45500e
--- /dev/null
+++ b/camera/tests/fuzzer/camera_fuzzer.cpp
@@ -0,0 +1,404 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <Camera.h>
+#include <CameraBase.h>
+#include <CameraMetadata.h>
+#include <CameraParameters.h>
+#include <CameraUtils.h>
+#include <VendorTagDescriptor.h>
+#include <binder/IMemory.h>
+#include <binder/MemoryDealer.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gui/IGraphicBufferProducer.h>
+#include <gui/Surface.h>
+#include <gui/SurfaceComposerClient.h>
+#include <utils/Log.h>
+#include "camera2common.h"
+#include <android/hardware/ICameraService.h>
+
+using namespace std;
+using namespace android;
+using namespace android::hardware;
+
+constexpr int32_t kFrameRateMin = 1;
+constexpr int32_t kFrameRateMax = 120;
+constexpr int32_t kCamIdMin = 0;
+constexpr int32_t kCamIdMax = 1;
+constexpr int32_t kNumMin = 0;
+constexpr int32_t kNumMax = 1024;
+constexpr int32_t kMemoryDealerSize = 1000;
+constexpr int32_t kRangeMin = 0;
+constexpr int32_t kRangeMax = 1000;
+constexpr int32_t kSizeMin = 0;
+constexpr int32_t kSizeMax = 1000;
+
+constexpr int32_t kValidCMD[] = {CAMERA_CMD_START_SMOOTH_ZOOM,
+ CAMERA_CMD_STOP_SMOOTH_ZOOM,
+ CAMERA_CMD_SET_DISPLAY_ORIENTATION,
+ CAMERA_CMD_ENABLE_SHUTTER_SOUND,
+ CAMERA_CMD_PLAY_RECORDING_SOUND,
+ CAMERA_CMD_START_FACE_DETECTION,
+ CAMERA_CMD_STOP_FACE_DETECTION,
+ CAMERA_CMD_ENABLE_FOCUS_MOVE_MSG,
+ CAMERA_CMD_PING,
+ CAMERA_CMD_SET_VIDEO_BUFFER_COUNT,
+ CAMERA_CMD_SET_VIDEO_FORMAT};
+
+constexpr int32_t kValidVideoBufferMode[] = {ICamera::VIDEO_BUFFER_MODE_DATA_CALLBACK_YUV,
+ ICamera::VIDEO_BUFFER_MODE_DATA_CALLBACK_METADATA,
+ ICamera::VIDEO_BUFFER_MODE_BUFFER_QUEUE};
+
+constexpr int32_t kValidPreviewCallbackFlag[] = {
+ CAMERA_FRAME_CALLBACK_FLAG_ENABLE_MASK, CAMERA_FRAME_CALLBACK_FLAG_ONE_SHOT_MASK,
+ CAMERA_FRAME_CALLBACK_FLAG_COPY_OUT_MASK, CAMERA_FRAME_CALLBACK_FLAG_NOOP,
+ CAMERA_FRAME_CALLBACK_FLAG_CAMCORDER, CAMERA_FRAME_CALLBACK_FLAG_CAMERA,
+ CAMERA_FRAME_CALLBACK_FLAG_BARCODE_SCANNER};
+
+constexpr int32_t kValidFacing[] = {android::hardware::CAMERA_FACING_BACK,
+ android::hardware::CAMERA_FACING_FRONT};
+
+constexpr int32_t kValidOrientation[] = {0, 90, 180, 270};
+
+class TestCameraListener : public CameraListener {
+ public:
+ virtual ~TestCameraListener() = default;
+
+ void notify(int32_t /*msgType*/, int32_t /*ext1*/, int32_t /*ext2*/) override { return; };
+ void postData(int32_t /*msgType*/, const sp<IMemory>& /*dataPtr*/,
+ camera_frame_metadata_t* /*metadata*/) override {
+ return;
+ };
+ void postDataTimestamp(nsecs_t /*timestamp*/, int32_t /*msgType*/,
+ const sp<IMemory>& /*dataPtr*/) override {
+ return;
+ };
+ void postRecordingFrameHandleTimestamp(nsecs_t /*timestamp*/,
+ native_handle_t* /*handle*/) override {
+ return;
+ };
+ void postRecordingFrameHandleTimestampBatch(
+ const std::vector<nsecs_t>& /*timestamps*/,
+ const std::vector<native_handle_t*>& /*handles*/) override {
+ return;
+ };
+};
+
+class CameraFuzzer : public ::android::hardware::BnCameraClient {
+ public:
+ void process(const uint8_t* data, size_t size);
+ ~CameraFuzzer() {
+ delete mCameraMetadata;
+ mComposerClient.clear();
+ mSurfaceControl.clear();
+ mSurface.clear();
+ mCamera.clear();
+ mMemoryDealer.clear();
+ mIMem.clear();
+ mCameraListener.clear();
+ mCameraService.clear();
+ }
+
+ private:
+ bool initCamera();
+ void initCameraMetadata();
+ void invokeCamera();
+ void invokeCameraUtils();
+ void invokeCameraBase();
+ void invokeCameraMetadata();
+ void invokeSetParameters();
+ sp<Camera> mCamera = nullptr;
+ CameraMetadata* mCameraMetadata = nullptr;
+ sp<SurfaceComposerClient> mComposerClient = nullptr;
+ sp<SurfaceControl> mSurfaceControl = nullptr;
+ sp<Surface> mSurface = nullptr;
+ sp<MemoryDealer> mMemoryDealer = nullptr;
+ sp<IMemory> mIMem = nullptr;
+ sp<TestCameraListener> mCameraListener = nullptr;
+ sp<ICameraService> mCameraService = nullptr;
+ sp<ICamera> cameraDevice = nullptr;
+ FuzzedDataProvider* mFDP = nullptr;
+
+ // CameraClient interface
+ void notifyCallback(int32_t, int32_t, int32_t) override { return; };
+ void dataCallback(int32_t, const sp<IMemory>&, camera_frame_metadata_t*) override { return; };
+ void dataCallbackTimestamp(nsecs_t, int32_t, const sp<IMemory>&) override { return; };
+ void recordingFrameHandleCallbackTimestamp(nsecs_t, native_handle_t*) override { return; };
+ void recordingFrameHandleCallbackTimestampBatch(const std::vector<nsecs_t>&,
+ const std::vector<native_handle_t*>&) override {
+ return;
+ };
+};
+
+bool CameraFuzzer::initCamera() {
+ ProcessState::self()->startThreadPool();
+ sp<IServiceManager> sm = defaultServiceManager();
+ sp<IBinder> binder = sm->getService(String16("media.camera"));
+ mCameraService = interface_cast<ICameraService>(binder);
+ mCameraService->connect(this, mFDP->ConsumeIntegral<int32_t>() /* cameraId */,
+ String16("CAMERAFUZZ"), hardware::ICameraService::USE_CALLING_UID,
+ hardware::ICameraService::USE_CALLING_PID,
+ /*targetSdkVersion*/ __ANDROID_API_FUTURE__, &cameraDevice);
+ mCamera = Camera::create(cameraDevice);
+ if (!mCamera) {
+ return false;
+ }
+ return true;
+}
+
+void CameraFuzzer::invokeSetParameters() {
+ String8 s = mCamera->getParameters();
+ CameraParameters params(s);
+ int32_t width = mFDP->ConsumeIntegral<int32_t>();
+ int32_t height = mFDP->ConsumeIntegral<int32_t>();
+ params.setVideoSize(width, height);
+ int32_t frameRate = mFDP->ConsumeIntegralInRange<int32_t>(kFrameRateMin, kFrameRateMax);
+ params.setPreviewFrameRate(frameRate);
+ mCamera->setParameters(params.flatten());
+}
+
+void CameraFuzzer::invokeCamera() {
+ if (!initCamera()) {
+ return;
+ }
+
+ int32_t cameraId = mFDP->ConsumeIntegralInRange<int32_t>(kCamIdMin, kCamIdMax);
+ Camera::getNumberOfCameras();
+ CameraInfo cameraInfo;
+ cameraInfo.facing = mFDP->ConsumeBool() ? mFDP->PickValueInArray(kValidFacing)
+ : mFDP->ConsumeIntegral<int>();
+ cameraInfo.orientation = mFDP->ConsumeBool() ? mFDP->PickValueInArray(kValidOrientation)
+ : mFDP->ConsumeIntegral<int>();
+ Camera::getCameraInfo(cameraId, &cameraInfo);
+ mCamera->reconnect();
+
+ mComposerClient = new SurfaceComposerClient;
+ mSurfaceControl = mComposerClient->createSurface(
+ static_cast<String8>(mFDP->ConsumeRandomLengthString().c_str()) /* name */,
+ mFDP->ConsumeIntegral<uint32_t>() /* width */,
+ mFDP->ConsumeIntegral<uint32_t>() /* height */,
+ mFDP->ConsumeIntegral<int32_t>() /* format */,
+ mFDP->ConsumeIntegral<int32_t>() /* flags */);
+ if (mSurfaceControl) {
+ mSurface = mSurfaceControl->getSurface();
+ mCamera->setPreviewTarget(mSurface->getIGraphicBufferProducer());
+ mCamera->startPreview();
+ mCamera->stopPreview();
+ mCamera->previewEnabled();
+ mCamera->startRecording();
+ mCamera->stopRecording();
+ }
+
+ mCamera->lock();
+ mCamera->unlock();
+ mCamera->autoFocus();
+ mCamera->cancelAutoFocus();
+
+ int32_t msgType = mFDP->ConsumeIntegral<int32_t>();
+ mCamera->takePicture(msgType);
+ invokeSetParameters();
+ int32_t cmd;
+ if (mFDP->ConsumeBool()) {
+ cmd = mFDP->PickValueInArray(kValidCMD);
+ } else {
+ cmd = mFDP->ConsumeIntegral<int32_t>();
+ }
+ int32_t arg1 = mFDP->ConsumeIntegral<int32_t>();
+ int32_t arg2 = mFDP->ConsumeIntegral<int32_t>();
+ mCamera->sendCommand(cmd, arg1, arg2);
+
+ int32_t videoBufferMode = mFDP->PickValueInArray(kValidVideoBufferMode);
+ mCamera->setVideoBufferMode(videoBufferMode);
+ if (mSurfaceControl) {
+ mSurface = mSurfaceControl->getSurface();
+ mCamera->setVideoTarget(mSurface->getIGraphicBufferProducer());
+ }
+ mCameraListener = sp<TestCameraListener>::make();
+ mCamera->setListener(mCameraListener);
+ int32_t previewCallbackFlag;
+ if (mFDP->ConsumeBool()) {
+ previewCallbackFlag = mFDP->PickValueInArray(kValidPreviewCallbackFlag);
+ } else {
+ previewCallbackFlag = mFDP->ConsumeIntegral<int32_t>();
+ }
+ mCamera->setPreviewCallbackFlags(previewCallbackFlag);
+ if (mSurfaceControl) {
+ mSurface = mSurfaceControl->getSurface();
+ mCamera->setPreviewCallbackTarget(mSurface->getIGraphicBufferProducer());
+ }
+
+ mCamera->getRecordingProxy();
+ int32_t mode = mFDP->ConsumeIntegral<int32_t>();
+ mCamera->setAudioRestriction(mode);
+ mCamera->getGlobalAudioRestriction();
+ mCamera->recordingEnabled();
+
+ mMemoryDealer = new MemoryDealer(kMemoryDealerSize);
+ mIMem = mMemoryDealer->allocate(kMemoryDealerSize);
+ mCamera->releaseRecordingFrame(mIMem);
+
+ int32_t numFds = mFDP->ConsumeIntegralInRange<int32_t>(kNumMin, kNumMax);
+ int32_t numInts = mFDP->ConsumeIntegralInRange<int32_t>(kNumMin, kNumMax);
+ native_handle_t* handle = native_handle_create(numFds, numInts);
+ mCamera->releaseRecordingFrameHandle(handle);
+
+ int32_t msgTypeNC = mFDP->ConsumeIntegral<int32_t>();
+ int32_t ext = mFDP->ConsumeIntegral<int32_t>();
+ int32_t ext2 = mFDP->ConsumeIntegral<int32_t>();
+ mCamera->notifyCallback(msgTypeNC, ext, ext2);
+
+ int64_t timestamp = mFDP->ConsumeIntegral<int64_t>();
+ mCamera->dataCallbackTimestamp(timestamp, msgTypeNC, mIMem);
+ mCamera->recordingFrameHandleCallbackTimestamp(timestamp, handle);
+}
+
+void CameraFuzzer::invokeCameraUtils() {
+ CameraMetadata staticMetadata;
+ int32_t orientVal = mFDP->ConsumeBool() ? mFDP->PickValueInArray(kValidOrientation)
+ : mFDP->ConsumeIntegral<int32_t>();
+ uint8_t facingVal = mFDP->ConsumeBool() ? mFDP->PickValueInArray(kValidFacing)
+ : mFDP->ConsumeIntegral<uint8_t>();
+ staticMetadata.update(ANDROID_SENSOR_ORIENTATION, &orientVal, 1);
+ staticMetadata.update(ANDROID_LENS_FACING, &facingVal, 1);
+ int32_t transform = 0;
+ CameraUtils::getRotationTransform(
+ staticMetadata, mFDP->ConsumeIntegral<int32_t>() /* mirrorMode */, &transform /*out*/);
+ CameraUtils::isCameraServiceDisabled();
+}
+
+void CameraFuzzer::invokeCameraBase() {
+ CameraInfo cameraInfo;
+ cameraInfo.facing = mFDP->ConsumeBool() ? mFDP->PickValueInArray(kValidFacing)
+ : mFDP->ConsumeIntegral<int>();
+ cameraInfo.orientation = mFDP->ConsumeBool() ? mFDP->PickValueInArray(kValidOrientation)
+ : mFDP->ConsumeIntegral<int>();
+ invokeReadWriteParcel<CameraInfo>(&cameraInfo);
+
+ CameraStatus* cameraStatus = nullptr;
+
+ if (mFDP->ConsumeBool()) {
+ cameraStatus = new CameraStatus();
+ } else {
+ string cid = mFDP->ConsumeRandomLengthString();
+ String8 id(cid.c_str());
+ int32_t status = mFDP->ConsumeIntegral<int32_t>();
+ size_t unavailSubIdsSize = mFDP->ConsumeIntegralInRange<size_t>(kSizeMin, kSizeMax);
+ vector<String8> unavailSubIds;
+ for (size_t idx = 0; idx < unavailSubIdsSize; ++idx) {
+ string subId = mFDP->ConsumeRandomLengthString();
+ String8 unavailSubId(subId.c_str());
+ unavailSubIds.push_back(unavailSubId);
+ }
+ string clientPkg = mFDP->ConsumeRandomLengthString();
+ String8 clientPackage(clientPkg.c_str());
+ cameraStatus = new CameraStatus(id, status, unavailSubIds, clientPackage);
+ }
+
+ invokeReadWriteParcel<CameraStatus>(cameraStatus);
+ delete cameraStatus;
+}
+
+void CameraFuzzer::initCameraMetadata() {
+ if (mFDP->ConsumeBool()) {
+ mCameraMetadata = new CameraMetadata();
+ } else {
+ size_t entryCapacity = mFDP->ConsumeIntegralInRange<size_t>(kSizeMin, kSizeMax);
+ size_t dataCapacity = mFDP->ConsumeIntegralInRange<size_t>(kSizeMin, kSizeMax);
+ mCameraMetadata = new CameraMetadata(entryCapacity, dataCapacity);
+ }
+}
+
+void CameraFuzzer::invokeCameraMetadata() {
+ initCameraMetadata();
+
+ const camera_metadata_t* metadataBuffer = nullptr;
+ if (mFDP->ConsumeBool()) {
+ metadataBuffer = mCameraMetadata->getAndLock();
+ }
+
+ mCameraMetadata->entryCount();
+ mCameraMetadata->isEmpty();
+ mCameraMetadata->bufferSize();
+ mCameraMetadata->sort();
+
+ uint32_t tag = mFDP->ConsumeIntegral<uint32_t>();
+ uint8_t dataUint8 = mFDP->ConsumeIntegral<uint8_t>();
+ int32_t dataInt32 = mFDP->ConsumeIntegral<int32_t>();
+ int64_t dataInt64 = mFDP->ConsumeIntegral<int64_t>();
+ float dataFloat = mFDP->ConsumeFloatingPoint<float>();
+ double dataDouble = mFDP->ConsumeFloatingPoint<double>();
+ camera_metadata_rational dataRational;
+ dataRational.numerator = mFDP->ConsumeIntegral<int32_t>();
+ dataRational.denominator = mFDP->ConsumeIntegral<int32_t>();
+ string dataStr = mFDP->ConsumeRandomLengthString();
+ String8 dataString(dataStr.c_str());
+ size_t data_count = 1;
+ mCameraMetadata->update(tag, &dataUint8, data_count);
+ mCameraMetadata->update(tag, &dataInt32, data_count);
+ mCameraMetadata->update(tag, &dataFloat, data_count);
+ mCameraMetadata->update(tag, &dataInt64, data_count);
+ mCameraMetadata->update(tag, &dataRational, data_count);
+ mCameraMetadata->update(tag, &dataDouble, data_count);
+ mCameraMetadata->update(tag, dataString);
+
+ uint32_t tagExists = mFDP->ConsumeBool() ? tag : mFDP->ConsumeIntegral<uint32_t>();
+ mCameraMetadata->exists(tagExists);
+
+ uint32_t tagFind = mFDP->ConsumeBool() ? tag : mFDP->ConsumeIntegral<uint32_t>();
+ mCameraMetadata->find(tagFind);
+
+ uint32_t tagErase = mFDP->ConsumeBool() ? tag : mFDP->ConsumeIntegral<uint32_t>();
+ mCameraMetadata->erase(tagErase);
+
+ mCameraMetadata->unlock(metadataBuffer);
+ std::vector<int32_t> tagsRemoved;
+ uint64_t vendorId = mFDP->ConsumeIntegral<uint64_t>();
+ mCameraMetadata->removePermissionEntries(vendorId, &tagsRemoved);
+
+ string name = mFDP->ConsumeRandomLengthString();
+ VendorTagDescriptor vTags;
+ uint32_t tagName = mFDP->ConsumeIntegral<uint32_t>();
+ mCameraMetadata->getTagFromName(name.c_str(), &vTags, &tagName);
+
+ invokeReadWriteNullParcel<CameraMetadata>(mCameraMetadata);
+ invokeReadWriteParcel<CameraMetadata>(mCameraMetadata);
+
+ int32_t fd = open("/dev/null", O_CLOEXEC | O_RDWR | O_CREAT);
+ int32_t verbosity = mFDP->ConsumeIntegralInRange<int32_t>(kRangeMin, kRangeMax);
+ int32_t indentation = mFDP->ConsumeIntegralInRange<int32_t>(kRangeMin, kRangeMax);
+ mCameraMetadata->dump(fd, verbosity, indentation);
+
+ CameraMetadata metadataCopy(mCameraMetadata->release());
+ CameraMetadata otherCameraMetadata;
+ mCameraMetadata->swap(otherCameraMetadata);
+ close(fd);
+}
+
+void CameraFuzzer::process(const uint8_t* data, size_t size) {
+ mFDP = new FuzzedDataProvider(data, size);
+ invokeCamera();
+ invokeCameraUtils();
+ invokeCameraBase();
+ invokeCameraMetadata();
+ delete mFDP;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ sp<CameraFuzzer> cameraFuzzer = new CameraFuzzer();
+ cameraFuzzer->process(data, size);
+ cameraFuzzer.clear();
+ return 0;
+}
diff --git a/camera/tests/fuzzer/camera_vendorTagDescriptor_fuzzer.cpp b/camera/tests/fuzzer/camera_vendorTagDescriptor_fuzzer.cpp
new file mode 100644
index 0000000..e14d9ce
--- /dev/null
+++ b/camera/tests/fuzzer/camera_vendorTagDescriptor_fuzzer.cpp
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <VendorTagDescriptor.h>
+#include <binder/Parcel.h>
+#include <camera_metadata_tests_fake_vendor.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <system/camera_vendor_tags.h>
+
+#include <camera_metadata_hidden.h>
+#include "camera2common.h"
+
+using namespace std;
+using namespace android;
+
+constexpr int32_t kRangeMin = 0;
+constexpr int32_t kRangeMax = 1000;
+constexpr int32_t kVendorTagDescriptorId = -1;
+
+extern "C" {
+
+static int zero_get_tag_count(const vendor_tag_ops_t*) {
+ return 0;
+}
+
+static int default_get_tag_count(const vendor_tag_ops_t*) {
+ return VENDOR_TAG_COUNT_ERR;
+}
+
+static void default_get_all_tags(const vendor_tag_ops_t*, uint32_t*) {}
+
+static const char* default_get_section_name(const vendor_tag_ops_t*, uint32_t) {
+ return VENDOR_SECTION_NAME_ERR;
+}
+
+static const char* default_get_tag_name(const vendor_tag_ops_t*, uint32_t) {
+ return VENDOR_TAG_NAME_ERR;
+}
+
+static int default_get_tag_type(const vendor_tag_ops_t*, uint32_t) {
+ return VENDOR_TAG_TYPE_ERR;
+}
+
+} /*extern "C"*/
+
+static void FillWithDefaults(vendor_tag_ops_t* vOps) {
+ vOps->get_tag_count = default_get_tag_count;
+ vOps->get_all_tags = default_get_all_tags;
+ vOps->get_section_name = default_get_section_name;
+ vOps->get_tag_name = default_get_tag_name;
+ vOps->get_tag_type = default_get_tag_type;
+}
+
+class VendorTagDescriptorFuzzer {
+ public:
+ void process(const uint8_t* data, size_t size);
+ ~VendorTagDescriptorFuzzer() {
+ mVendorTagDescriptor.clear();
+ mVendorTagDescriptorCache.clear();
+ }
+
+ private:
+ void initVendorTagDescriptor();
+ void invokeVendorTagDescriptor();
+ void invokeVendorTagDescriptorCache();
+ void invokeVendorTagErrorConditions();
+ sp<VendorTagDescriptor> mVendorTagDescriptor = nullptr;
+ sp<VendorTagDescriptorCache> mVendorTagDescriptorCache = nullptr;
+ FuzzedDataProvider* mFDP = nullptr;
+};
+
+void VendorTagDescriptorFuzzer::initVendorTagDescriptor() {
+ if (mFDP->ConsumeBool()) {
+ mVendorTagDescriptor = new VendorTagDescriptor();
+ } else {
+ const vendor_tag_ops_t* vOps = &fakevendor_ops;
+ VendorTagDescriptor::createDescriptorFromOps(vOps, mVendorTagDescriptor);
+ }
+}
+
+void VendorTagDescriptorFuzzer::invokeVendorTagDescriptor() {
+ initVendorTagDescriptor();
+
+ sp<VendorTagDescriptor> vdesc = new VendorTagDescriptor();
+ vdesc->copyFrom(*mVendorTagDescriptor);
+ VendorTagDescriptor::setAsGlobalVendorTagDescriptor(mVendorTagDescriptor);
+ VendorTagDescriptor::getGlobalVendorTagDescriptor();
+
+ int32_t tagCount = mVendorTagDescriptor->getTagCount();
+ if (tagCount > 0) {
+ uint32_t tagArray[tagCount];
+ mVendorTagDescriptor->getTagArray(tagArray);
+ uint32_t tag;
+ for (int32_t i = 0; i < tagCount; ++i) {
+ tag = tagArray[i];
+ get_local_camera_metadata_section_name_vendor_id(tag, kVendorTagDescriptorId);
+ get_local_camera_metadata_tag_name_vendor_id(tag, kVendorTagDescriptorId);
+ get_local_camera_metadata_tag_type_vendor_id(tag, kVendorTagDescriptorId);
+ mVendorTagDescriptor->getSectionIndex(tag);
+ }
+ mVendorTagDescriptor->getAllSectionNames();
+ }
+
+ String8 name((mFDP->ConsumeRandomLengthString()).c_str());
+ String8 section((mFDP->ConsumeRandomLengthString()).c_str());
+ uint32_t lookupTag;
+ mVendorTagDescriptor->lookupTag(name, section, &lookupTag);
+
+ int32_t fd = open("/dev/null", O_CLOEXEC | O_RDWR | O_CREAT);
+ int32_t verbosity = mFDP->ConsumeIntegralInRange<int32_t>(kRangeMin, kRangeMax);
+ int32_t indentation = mFDP->ConsumeIntegralInRange<int32_t>(kRangeMin, kRangeMax);
+ mVendorTagDescriptor->dump(fd, verbosity, indentation);
+
+ invokeReadWriteParcelsp<VendorTagDescriptor>(mVendorTagDescriptor);
+ VendorTagDescriptor::clearGlobalVendorTagDescriptor();
+ vdesc.clear();
+ close(fd);
+}
+
+void VendorTagDescriptorFuzzer::invokeVendorTagDescriptorCache() {
+ mVendorTagDescriptorCache = new VendorTagDescriptorCache();
+ uint64_t id = mFDP->ConsumeIntegral<uint64_t>();
+ initVendorTagDescriptor();
+
+ mVendorTagDescriptorCache->addVendorDescriptor(id, mVendorTagDescriptor);
+ VendorTagDescriptorCache::setAsGlobalVendorTagCache(mVendorTagDescriptorCache);
+ VendorTagDescriptorCache::getGlobalVendorTagCache();
+ sp<VendorTagDescriptor> tagDesc;
+ mVendorTagDescriptorCache->getVendorTagDescriptor(id, &tagDesc);
+
+ int32_t tagCount = mVendorTagDescriptorCache->getTagCount(id);
+ if (tagCount > 0) {
+ uint32_t tagArray[tagCount];
+ mVendorTagDescriptorCache->getTagArray(tagArray, id);
+ uint32_t tag;
+ for (int32_t i = 0; i < tagCount; ++i) {
+ tag = tagArray[i];
+ get_local_camera_metadata_section_name_vendor_id(tag, id);
+ get_local_camera_metadata_tag_name_vendor_id(tag, id);
+ get_local_camera_metadata_tag_type_vendor_id(tag, id);
+ }
+ }
+
+ int32_t fd = open("/dev/null", O_CLOEXEC | O_RDWR | O_CREAT);
+ int32_t verbosity = mFDP->ConsumeIntegralInRange<int>(kRangeMin, kRangeMax);
+ int32_t indentation = mFDP->ConsumeIntegralInRange<int>(kRangeMin, kRangeMax);
+ mVendorTagDescriptorCache->dump(fd, verbosity, indentation);
+
+ invokeReadWriteParcelsp<VendorTagDescriptorCache>(mVendorTagDescriptorCache);
+ VendorTagDescriptorCache::isVendorCachePresent(id);
+ mVendorTagDescriptorCache->getVendorIdsAndTagDescriptors();
+ mVendorTagDescriptorCache->clearGlobalVendorTagCache();
+ tagDesc.clear();
+ close(fd);
+}
+
+void VendorTagDescriptorFuzzer::invokeVendorTagErrorConditions() {
+ sp<VendorTagDescriptor> vDesc;
+ vendor_tag_ops_t vOps;
+ FillWithDefaults(&vOps);
+ vOps.get_tag_count = zero_get_tag_count;
+
+ if (mFDP->ConsumeBool()) {
+ VendorTagDescriptor::createDescriptorFromOps(/*vOps*/ NULL, vDesc);
+ } else {
+ VendorTagDescriptor::createDescriptorFromOps(&vOps, vDesc);
+ int32_t tagCount = vDesc->getTagCount();
+ uint32_t badTag = mFDP->ConsumeIntegral<uint32_t>();
+ uint32_t badTagArray[tagCount + 1];
+ vDesc->getTagArray(badTagArray);
+ vDesc->getSectionName(badTag);
+ vDesc->getTagName(badTag);
+ vDesc->getTagType(badTag);
+ VendorTagDescriptor::clearGlobalVendorTagDescriptor();
+ VendorTagDescriptor::getGlobalVendorTagDescriptor();
+ VendorTagDescriptor::setAsGlobalVendorTagDescriptor(vDesc);
+ invokeReadWriteNullParcelsp<VendorTagDescriptor>(vDesc);
+ vDesc.clear();
+ }
+}
+
+void VendorTagDescriptorFuzzer::process(const uint8_t* data, size_t size) {
+ mFDP = new FuzzedDataProvider(data, size);
+ invokeVendorTagDescriptor();
+ invokeVendorTagDescriptorCache();
+ invokeVendorTagErrorConditions();
+ delete mFDP;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ VendorTagDescriptorFuzzer vendorTagDescriptorFuzzer;
+ vendorTagDescriptorFuzzer.process(data, size);
+ return 0;
+}