Fix fuzzer error for FormatConvertFuzzer
The stride was not correct for the fuzzer.
And the FormatConvert have some restructions
on the width and height.
- YUYV
width and height must be even nmber
- YU12
width mush be divisible by 16
height must be even number
Bug: 202641239
Test: FormatConvertFuzzer_copyYV12toBGR32
Change-Id: I45ebea3e22854bdad037abb742fbdbe364b19ec5
diff --git a/automotive/evs/common/utils/default/test/fuzz/FormatConvertFuzzer.cpp b/automotive/evs/common/utils/default/test/fuzz/FormatConvertFuzzer.cpp
index 583a455..58423c8 100644
--- a/automotive/evs/common/utils/default/test/fuzz/FormatConvertFuzzer.cpp
+++ b/automotive/evs/common/utils/default/test/fuzz/FormatConvertFuzzer.cpp
@@ -14,6 +14,7 @@
* limitations under the License.
*/
+#include <fuzzer/FuzzedDataProvider.h>
#include <cmath>
#include <cstdlib>
#include <cstring>
@@ -21,36 +22,43 @@
#include "FormatConvert.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, std::size_t size) {
- if (size < 256) {
+ // 1 random value (4bytes) + min imagesize = 16*2 times bytes per pixel (worse case 2)
+ if (size < (4 + 16 * 2 * 2)) {
return 0;
}
+ FuzzedDataProvider fdp(data, size);
+ std::size_t image_pixel_size = size - 4;
+ image_pixel_size = (image_pixel_size & INT_MAX) / 2;
- std::srand(std::time(nullptr)); // use current time as seed for random generator
- int random_variable = std::rand() % 10;
- int width = (int)sqrt(size);
- int height = width * ((float)random_variable / 10.0);
+ // API have a requirement that width must be divied by 16 except yuyvtorgb
+ int min_height = 2;
+ int max_height = (image_pixel_size / 16) & ~(1); // must be even number
+ int height = fdp.ConsumeIntegralInRange<uint32_t>(min_height, max_height);
+ int width = (image_pixel_size / height) & ~(16); // must be divisible by 16
- uint8_t* src = (uint8_t*)malloc(sizeof(uint8_t) * size);
- memcpy(src, data, sizeof(uint8_t) * (size));
- uint32_t* tgt = (uint32_t*)malloc(sizeof(uint32_t) * size);
+ uint8_t* src = (uint8_t*)(data + 4);
+ uint32_t* tgt = (uint32_t*)malloc(sizeof(uint32_t) * image_pixel_size);
#ifdef COPY_NV21_TO_RGB32
- android::hardware::automotive::evs::common::Utils::copyNV21toRGB32(width, height, src, tgt, 0);
+ android::hardware::automotive::evs::common::Utils::copyNV21toRGB32(width, height, src, tgt,
+ width);
#elif COPY_NV21_TO_BGR32
- android::hardware::automotive::evs::common::Utils::copyNV21toBGR32(width, height, src, tgt, 0);
+ android::hardware::automotive::evs::common::Utils::copyNV21toBGR32(width, height, src, tgt,
+ width);
#elif COPY_YV12_TO_RGB32
- android::hardware::automotive::evs::common::Utils::copyYV12toRGB32(width, height, src, tgt, 0);
+ android::hardware::automotive::evs::common::Utils::copyYV12toRGB32(width, height, src, tgt,
+ width);
#elif COPY_YV12_TO_BGR32
- android::hardware::automotive::evs::common::Utils::copyYV12toBGR32(width, height, src, tgt, 0);
+ android::hardware::automotive::evs::common::Utils::copyYV12toBGR32(width, height, src, tgt,
+ width);
#elif COPY_YUYV_TO_RGB32
- android::hardware::automotive::evs::common::Utils::copyYUYVtoRGB32(width, height, src, 0, tgt,
- 0);
+ android::hardware::automotive::evs::common::Utils::copyYUYVtoRGB32(width, height, src, width,
+ tgt, width);
#elif COPY_YUYV_TO_BGR32
- android::hardware::automotive::evs::common::Utils::copyYUYVtoBGR32(width, height, src, 0, tgt,
- 0);
+ android::hardware::automotive::evs::common::Utils::copyYUYVtoBGR32(width, height, src, width,
+ tgt, width);
#endif
- free(src);
free(tgt);
return 0;