Refactored camera_c2OutputConfiguration_fuzzer
The following are updates to the fuzzer:
1. Randomized order of API calls.
2. Randomized parameter values.
exec/s: 1551
Test: ./camera_c2OutputConfiguration_fuzzer
Bug: 309571245
Change-Id: I45a449e5f3d44e34466ccbfbf74db545f3d0e6a6
diff --git a/camera/tests/fuzzer/camera_c2OutputConfiguration_fuzzer.cpp b/camera/tests/fuzzer/camera_c2OutputConfiguration_fuzzer.cpp
index 2fe9a94..7046075 100644
--- a/camera/tests/fuzzer/camera_c2OutputConfiguration_fuzzer.cpp
+++ b/camera/tests/fuzzer/camera_c2OutputConfiguration_fuzzer.cpp
@@ -26,85 +26,122 @@
using namespace android;
using namespace android::hardware::camera2::params;
+constexpr int8_t kMaxLoopIterations = 100;
constexpr int32_t kSizeMin = 0;
constexpr int32_t kSizeMax = 1000;
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
+class C2OutputConfigurationFuzzer {
+ public:
+ void process(const uint8_t* data, size_t size);
- OutputConfiguration* outputConfiguration = nullptr;
+ private:
+ void invokeC2OutputConfigFuzzer();
+ unique_ptr<OutputConfiguration> getC2OutputConfig();
+ sp<IGraphicBufferProducer> createIGraphicBufferProducer();
+ FuzzedDataProvider* mFDP = nullptr;
+};
- if (fdp.ConsumeBool()) {
- outputConfiguration = new OutputConfiguration();
+sp<IGraphicBufferProducer> C2OutputConfigurationFuzzer::createIGraphicBufferProducer() {
+ sp<SurfaceComposerClient> composerClient = new SurfaceComposerClient;
+ sp<SurfaceControl> surfaceControl = composerClient->createSurface(
+ static_cast<String8>(mFDP->ConsumeRandomLengthString(kMaxBytes).c_str()) /* name */,
+ mFDP->ConsumeIntegral<uint32_t>() /* width */,
+ mFDP->ConsumeIntegral<uint32_t>() /* height */,
+ mFDP->ConsumeIntegral<int32_t>() /* format */,
+ mFDP->ConsumeIntegral<int32_t>() /* flags */);
+ if (surfaceControl) {
+ sp<Surface> surface = surfaceControl->getSurface();
+ return surface->getIGraphicBufferProducer();
} else {
- int32_t rotation = fdp.ConsumeIntegral<int32_t>();
- string physicalCameraId = fdp.ConsumeRandomLengthString();
- int32_t surfaceSetID = fdp.ConsumeIntegral<int32_t>();
- bool isShared = fdp.ConsumeBool();
-
- if (fdp.ConsumeBool()) {
- sp<IGraphicBufferProducer> iGBP = nullptr;
- sp<SurfaceComposerClient> composerClient = new SurfaceComposerClient;
- sp<SurfaceControl> surfaceControl = composerClient->createSurface(
- static_cast<String8>(fdp.ConsumeRandomLengthString().c_str()) /* name */,
- fdp.ConsumeIntegral<uint32_t>() /* width */,
- fdp.ConsumeIntegral<uint32_t>() /* height */,
- fdp.ConsumeIntegral<int32_t>() /* format */,
- fdp.ConsumeIntegral<int32_t>() /* flags */);
- if (surfaceControl) {
- sp<Surface> surface = surfaceControl->getSurface();
- iGBP = surface->getIGraphicBufferProducer();
- }
- outputConfiguration = new OutputConfiguration(iGBP, rotation, physicalCameraId,
- surfaceSetID, isShared);
- iGBP.clear();
- composerClient.clear();
- surfaceControl.clear();
- } else {
- size_t iGBPSize = fdp.ConsumeIntegralInRange<size_t>(kSizeMin, kSizeMax);
- vector<sp<IGraphicBufferProducer>> iGBPs;
- for (size_t idx = 0; idx < iGBPSize; ++idx) {
- sp<IGraphicBufferProducer> iGBP = nullptr;
- sp<SurfaceComposerClient> composerClient = new SurfaceComposerClient;
- sp<SurfaceControl> surfaceControl = composerClient->createSurface(
- static_cast<String8>(fdp.ConsumeRandomLengthString().c_str()) /* name */,
- fdp.ConsumeIntegral<uint32_t>() /* width */,
- fdp.ConsumeIntegral<uint32_t>() /* height */,
- fdp.ConsumeIntegral<int32_t>() /* format */,
- fdp.ConsumeIntegral<int32_t>() /* flags */);
- if (surfaceControl) {
- sp<Surface> surface = surfaceControl->getSurface();
- iGBP = surface->getIGraphicBufferProducer();
- iGBPs.push_back(iGBP);
- }
- iGBP.clear();
- composerClient.clear();
- surfaceControl.clear();
- }
- outputConfiguration = new OutputConfiguration(iGBPs, rotation, physicalCameraId,
- surfaceSetID, isShared);
- }
+ sp<IGraphicBufferProducer> gbp;
+ return gbp;
}
+}
- outputConfiguration->getRotation();
- outputConfiguration->getSurfaceSetID();
- outputConfiguration->getSurfaceType();
- outputConfiguration->getWidth();
- outputConfiguration->getHeight();
- outputConfiguration->isDeferred();
- outputConfiguration->isShared();
- outputConfiguration->getPhysicalCameraId();
+unique_ptr<OutputConfiguration> C2OutputConfigurationFuzzer::getC2OutputConfig() {
+ unique_ptr<OutputConfiguration> outputConfiguration = nullptr;
+ auto selectOutputConfigurationConstructor =
+ mFDP->PickValueInArray<const std::function<void()>>({
+ [&]() { outputConfiguration = make_unique<OutputConfiguration>(); },
- OutputConfiguration outputConfiguration2;
- outputConfiguration->gbpsEqual(outputConfiguration2);
- outputConfiguration->sensorPixelModesUsedEqual(outputConfiguration2);
- outputConfiguration->gbpsLessThan(outputConfiguration2);
- outputConfiguration->sensorPixelModesUsedLessThan(outputConfiguration2);
- outputConfiguration->getGraphicBufferProducers();
- sp<IGraphicBufferProducer> gbp;
- outputConfiguration->addGraphicProducer(gbp);
- invokeReadWriteNullParcel<OutputConfiguration>(outputConfiguration);
- invokeReadWriteParcel<OutputConfiguration>(outputConfiguration);
- delete outputConfiguration;
+ [&]() {
+ int32_t rotation = mFDP->ConsumeIntegral<int32_t>();
+ string physicalCameraId = mFDP->ConsumeRandomLengthString(kMaxBytes);
+ int32_t surfaceSetID = mFDP->ConsumeIntegral<int32_t>();
+ bool isShared = mFDP->ConsumeBool();
+ sp<IGraphicBufferProducer> iGBP = createIGraphicBufferProducer();
+ outputConfiguration = make_unique<OutputConfiguration>(
+ iGBP, rotation, physicalCameraId, surfaceSetID, isShared);
+ },
+
+ [&]() {
+ int32_t rotation = mFDP->ConsumeIntegral<int32_t>();
+ string physicalCameraId = mFDP->ConsumeRandomLengthString(kMaxBytes);
+ int32_t surfaceSetID = mFDP->ConsumeIntegral<int32_t>();
+ bool isShared = mFDP->ConsumeBool();
+ size_t iGBPSize = mFDP->ConsumeIntegralInRange<size_t>(kSizeMin, kSizeMax);
+ vector<sp<IGraphicBufferProducer>> iGBPs;
+ for (size_t idx = 0; idx < iGBPSize; ++idx) {
+ sp<IGraphicBufferProducer> iGBP = createIGraphicBufferProducer();
+ iGBPs.push_back(iGBP);
+ }
+ outputConfiguration = make_unique<OutputConfiguration>(
+ iGBPs, rotation, physicalCameraId, surfaceSetID, isShared);
+ },
+ });
+ selectOutputConfigurationConstructor();
+ return outputConfiguration;
+}
+
+void C2OutputConfigurationFuzzer::invokeC2OutputConfigFuzzer() {
+ unique_ptr<OutputConfiguration> outputConfiguration = getC2OutputConfig();
+ int8_t count = kMaxLoopIterations;
+ while (--count > 0) {
+ unique_ptr<OutputConfiguration> outputConfiguration2 = getC2OutputConfig();
+ auto callC2OutputConfAPIs = mFDP->PickValueInArray<const std::function<void()>>({
+ [&]() { outputConfiguration->getRotation(); },
+ [&]() { outputConfiguration->getSurfaceSetID(); },
+ [&]() { outputConfiguration->getSurfaceType(); },
+ [&]() { outputConfiguration->getWidth(); },
+ [&]() { outputConfiguration->getHeight(); },
+ [&]() { outputConfiguration->isDeferred(); },
+ [&]() { outputConfiguration->isShared(); },
+ [&]() { outputConfiguration->getPhysicalCameraId(); },
+ [&]() { outputConfiguration->gbpsEqual(*outputConfiguration2); },
+ [&]() { outputConfiguration->sensorPixelModesUsedEqual(*outputConfiguration2); },
+ [&]() { outputConfiguration->gbpsLessThan(*outputConfiguration2); },
+ [&]() { outputConfiguration->sensorPixelModesUsedLessThan(*outputConfiguration2); },
+ [&]() { outputConfiguration->getGraphicBufferProducers(); },
+ [&]() {
+ sp<IGraphicBufferProducer> gbp = createIGraphicBufferProducer();
+ outputConfiguration->addGraphicProducer(gbp);
+ },
+ [&]() { outputConfiguration->isMultiResolution(); },
+ [&]() { outputConfiguration->getColorSpace(); },
+ [&]() { outputConfiguration->getStreamUseCase(); },
+ [&]() { outputConfiguration->getTimestampBase(); },
+ [&]() { outputConfiguration->getMirrorMode(); },
+ [&]() { outputConfiguration->useReadoutTimestamp(); },
+ });
+ callC2OutputConfAPIs();
+ }
+ // Not keeping invokeReadWrite() APIs in while loop to avoid possible OOM.
+ invokeReadWriteNullParcel<OutputConfiguration>(outputConfiguration.get());
+ if (mFDP->ConsumeBool()) {
+ invokeReadWriteParcel<OutputConfiguration>(outputConfiguration.get());
+ } else {
+ invokeNewReadWriteParcel<OutputConfiguration>(outputConfiguration.get(), *mFDP);
+ }
+}
+
+void C2OutputConfigurationFuzzer::process(const uint8_t* data, size_t size) {
+ mFDP = new FuzzedDataProvider(data, size);
+ invokeC2OutputConfigFuzzer();
+ delete mFDP;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ C2OutputConfigurationFuzzer c2OutputConfigurationFuzzer;
+ c2OutputConfigurationFuzzer.process(data, size);
return 0;
}