From 07b6cdae2b23ce8658088430d9a2eca2cb5ca88a Mon Sep 17 00:00:00 2001 From: liyang9 Date: Thu, 3 Jul 2025 14:56:18 +0800 Subject: [PATCH] fuzz rectification Signed-off-by: liyang9 Change-Id: I664c937b81bc22df3009588306ff39ef04824f97 --- .../innerkitsimpl/test/fuzztest/BUILD.gn | 6 + .../common/include/common_fuzztest_function.h | 152 +++++++ .../common/src/common_fuzztest_function.cpp | 57 +++ .../fuzztest/imageaccessor2_fuzzer/BUILD.gn | 44 ++ .../imageaccessor2_fuzzer/corpus/init | 16 + .../include/image_accessor_fuzzer.h | 19 + .../imageaccessor2_fuzzer/project.xml | 25 ++ .../src/image_accessor2_fuzzer.cpp | 249 +++++++++++ .../BUILD.gn | 44 ++ .../corpus/init | 14 + ...image_fwk_convert_p010yuv2rgb_ext_fuzzer.h | 20 + .../project.xml | 25 ++ .../image_fwk_convert_pixelformat_fuzzer.cpp | 93 ++++ .../imagefwkimagesource2_fuzzer/BUILD.gn | 43 ++ .../imagefwkimagesource2_fuzzer/corpus/init | 16 + .../include/image_fwk_image_source_fuzzer.h | 19 + .../imagefwkimagesource2_fuzzer/project.xml | 25 ++ .../src/image_fwk_image_source2_fuzzer.cpp | 413 ++++++++++++++++++ .../fuzztest/imagepixelYuv2_fuzzer/BUILD.gn | 38 ++ .../imagepixelYuv2_fuzzer/corpus/init | 14 + .../include/image_pixelyuv_fuzzer.h | 20 + .../imagepixelYuv2_fuzzer/project.xml | 25 ++ .../src/image_pixelyuv_fuzzer.cpp | 78 ++++ .../fuzztest/imageplugin2_fuzzer/BUILD.gn | 63 +++ .../fuzztest/imageplugin2_fuzzer/corpus/init | 16 + .../include/image_plugin_fuzz.h | 19 + .../fuzztest/imageplugin2_fuzzer/project.xml | 25 ++ .../src/image_plugin_fuzz.cpp | 338 ++++++++++++++ .../fuzztest/imagepngplugin2_fuzzer/BUILD.gn | 45 ++ .../imagepngplugin2_fuzzer/corpus/init | 16 + .../include/image_png_plugin_fuzz.h | 19 + .../imagepngplugin2_fuzzer/project.xml | 25 ++ .../src/image_png_plugin_fuzz.cpp | 166 +++++++ .../src/image_png_plugin_fuzz.cpp | 2 + test/resource/image/ohos_test.xml | 25 ++ 35 files changed, 2214 insertions(+) create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/BUILD.gn create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/corpus/init create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/include/image_accessor_fuzzer.h create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/src/image_accessor2_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/BUILD.gn create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/corpus/init create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/include/image_fwk_convert_p010yuv2rgb_ext_fuzzer.h create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/src/image_fwk_convert_pixelformat_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/BUILD.gn create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/corpus/init create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/include/image_fwk_image_source_fuzzer.h create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/src/image_fwk_image_source2_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/BUILD.gn create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/corpus/init create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/include/image_pixelyuv_fuzzer.h create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/src/image_pixelyuv_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/BUILD.gn create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/corpus/init create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/include/image_plugin_fuzz.h create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/src/image_plugin_fuzz.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/BUILD.gn create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/corpus/init create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/include/image_png_plugin_fuzz.h create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/src/image_png_plugin_fuzz.cpp diff --git a/frameworks/innerkitsimpl/test/fuzztest/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/BUILD.gn index 292c82337..99336baf3 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/BUILD.gn +++ b/frameworks/innerkitsimpl/test/fuzztest/BUILD.gn @@ -15,14 +15,18 @@ group("fuzztest") { testonly = true deps = [ "imageaccessor_fuzzer:ImageAccessorFuzzTest", + "imageaccessor2_fuzzer:ImageAccessor2FuzzTest", "imagefwkconvertastc2rgb_fuzzer:ImageFwkConvertAstc2RgbFuzzTest", "imagefwkconvertp010yuv2rgbext_fuzzer:ImageFwkConvertP010Yuv2RgbExtFuzzTest", + "imagefwkconvertpixelfotmat_fuzzer:ImageFwkConvertPixelFormatFuzzTest", "imagefwkdecodepicture_fuzzer:ImageFwkDecodePictureFuzzTest", "imagefwkimagesource_fuzzer:ImageFwkImageSourceFuzzTest", + "imagefwkimagesource2_fuzzer:ImageFwkImageSource2FuzzTest", "imagegifencoder_fuzzer:ImageGifEnCoderFuzzTest", "imageheifimpl_fuzzer:ImageHeifImplFuzzTest", "imageinterfacepixelmap_fuzzer:ImageInterfacePixelmapFuzzTest", "imagepixelYuv_fuzzer:ImagePixelYuvFuzzTest", + "imagepixelYuv2_fuzzer:ImagePixelYuv2FuzzTest", "imagepixelmapBase_fuzzer:ImagePixelmapBaseFuzzTest", "imagepixelmapGetColorARGB_fuzzer:ImagePixelmapGetColorARGBFuzzTest", "imagepixelmapHdr_fuzzer:ImagePixelmapHdrFuzzTest", @@ -35,7 +39,9 @@ group("fuzztest") { "imagepixelmapsetalpha_fuzzer:ImagePixelmapSetAlphaFuzzTest", "imagepixelmapsetalpha2_fuzzer:ImagePixelmapsetalpha2FuzzTest", "imageplugin_fuzzer:ImagePluginFuzzTest", + "imageplugin2_fuzzer:ImagePlugin2FuzzTest", "imagepngplugin_fuzzer:ImagePngPluginFuzzTest", + "imagepngplugin2_fuzzer:ImagePngPlugin2FuzzTest", "imagetextureencode_fuzzer:ImageTextureEncodeFuzzTest", ] } diff --git a/frameworks/innerkitsimpl/test/fuzztest/common/include/common_fuzztest_function.h b/frameworks/innerkitsimpl/test/fuzztest/common/include/common_fuzztest_function.h index 49d88c8d8..197dd670f 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/common/include/common_fuzztest_function.h +++ b/frameworks/innerkitsimpl/test/fuzztest/common/include/common_fuzztest_function.h @@ -18,11 +18,160 @@ #include #include #include +#include namespace OHOS { namespace Media { class PixelMap; + struct DecodeOptions; } +namespace ImagePlugin { + struct PixelDecodeOptions; } +} + +const static std::vector>> KEY_VALUE_MAPS = { + {"BitsPerSample", {"9, 7, 8", "8, 8, 8"}}, + {"Orientation", {"Top-right", "Unknown value 0"}}, + {"ImageLength", {"1000", "4000"}}, + {"ImageWidth", {"500", "3000"}}, + {"GPSLatitude", {"39, 54, 20", ""}}, + {"GPSLongitude", {"120, 52, 26", ""}}, + {"GPSLatitudeRef", {"N", ""}}, + {"GPSLongitudeRef", {"E", ""}}, + {"DateTimeOriginal", {"2024,01,25 05,51,34", "2024,01,11 09,39,58", "2023,01,19 10,39,58"}}, + {"ExposureTime", {"1/34 sec.", "1/590 sec."}}, + {"SceneType", {"Directly photographed"}}, + {"ISOSpeedRatings", {"160"}}, + {"FNumber", {"f/3.0", "f/2.0"}}, + {"DateTime", {""}}, + {"GPSTimeStamp", {"11,37,58.00", "01,39,58.00"}}, + {"GPSDateStamp", {"2025,01,11", "2024,01,11"}}, + {"ImageDescription", {"_cuva"}}, + {"Make", {""}}, + {"Model", {"TNY-AL00", "", "xx", "xxx"}}, + {"SensitivityType", {"Standard output sensitivity (SOS) and ISO speed", ""}}, + {"StandardOutputSensitivity", {"5", ""}}, + {"RecommendedExposureIndex", {"241", ""}}, + {"ApertureValue", {"4.00 EV (f/4.0)", "2.00 EV (f/2.0)"}}, + {"ExposureBiasValue", {"23.00 EV", "0.00 EV"}}, + {"MeteringMode", {"Pattern"}}, + {"LightSource", {"Fluorescent", "Daylight"}}, + {"Flash", {"Strobe return light not detected", "Flash did not fire"}}, + {"FocalLength", {"31.0 mm", "6.3 mm"}}, + {"UserComment", {"comm", ""}}, + {"PixelXDimension", {"1000", "4000"}}, + {"PixelYDimension", {"2000", "3000"}}, + {"WhiteBalance", {"Manual white balance", "Auto white balance"}}, + {"FocalLengthIn35mmFilm", {"26", "27"}}, + {"JPEGProc", {"252", ""}}, + {"MaxApertureValue", {"0.08 EV (f/1.0)"}}, + {"Artist", {"Joseph.Xu"}}, + {"NewSubfileType", {"1"}}, + {"OECF", {"1 bytes undefined data"}}, + {"PlanarConfiguration", {"Chunky format"}}, + {"PrimaryChromaticities", {"124"}}, + {"ReferenceBlackWhite", {"221"}}, + {"ResolutionUnit", {"Inch"}}, + {"SamplesPerPixel", {"23"}}, + {"Compression", {"JPEG compression"}}, + {"Software", {"MNA-AL00 4.0.0.120(C00E116R3P7)"}}, + {"Copyright", {"xxxxxx (Photographer) - {None} (Editor)"}}, + {"SpectralSensitivity", {"sensitivity"}}, + {"DNGVersion", {"0x01, 0x01, 0x02, 0x03"}}, + {"SubjectDistance", {""}}, + {"DefaultCropSize", {"12, 1"}}, + {"SubjectLocation", {"3"}}, + {"TransferFunction", {"2"}}, + {"WhitePoint", {"124.2"}}, + {"XResolution", {"72"}}, + {"YCbCrCoefficients", {"0.299, 0.587, 0.114"}}, + {"YCbCrPositioning", {"Centered"}}, + {"YCbCrSubSampling", {"3, 2"}}, + {"YResolution", {"72"}}, + {"Gamma", {"1.5"}}, + {"ISOSpeed", {"200"}}, + {"ISOSpeedLatitudeyyy", {"3"}}, + {"ISOSpeedLatitudezzz", {"3"}}, + {"ImageUniqueID", {"FXIC012"}}, + {"JPEGInterchangeFormat", {""}}, + {"JPEGInterchangeFormatLength", {""}}, + {"GPSAltitude", {"0.00"}}, + {"GPSAltitudeRef", {"Sea level reference"}}, + {"GPSAreaInformation", {"23...15...57"}}, + {"GPSDOP", {"182"}}, + {"GPSDestBearing", {"2.6"}}, + {"GPSDestBearingRef", {"T"}}, + {"GPSDestDistance", {"10"}}, + {"GPSDestDistanceRef", {"N"}}, + {"GPSDestLatitude", {"33, 22, 11"}}, + {"GPSDestLatitudeRef", {"N"}}, + {"GPSDestLongitude", {"33, 22, 11"}}, + {"GPSDestLongitudeRef", {"E"}}, + {"GPSDifferential", {"1"}}, + {"GPSImgDirection", {"2.23214"}}, + {"GPSImgDirectionRef", {"M"}}, + {"GPSMapDatum", {"xxxx"}}, + {"GPSMeasureMode", {"2"}}, + {"GPSProcessingMethod", {"CELLID"}}, + {"GPSSatellites", {"xxx"}}, + {"GPSSpeed", {"150"}}, + {"GPSSpeedRef", {"K"}}, + {"GPSStatus", {"V"}}, + {"GPSTrack", {"56"}}, + {"GPSTrackRef", {"T"}}, + {"GPSVersionID", {"2.2.0.0"}}, + {"GPSHPositioningError", {" 3"}}, + {"LensMake", {"xxx"}}, + {"LensModel", {"xxx"}}, + {"LensSerialNumber", {"xxx"}}, + {"LensSpecification", {" 1, 1.5, 1, 2"}}, + {"GainControl", {"Normal"}}, + {"OffsetTime", {"xx"}}, + {"OffsetTimeDigitized", {"xx"}}, + {"OffsetTimeOriginal", {"xx"}}, + {"PhotometricInterpretation", {""}}, + {"RelatedSoundFile", {"/usr/home/sound/sea.wav"}}, + {"RowsPerStrip", {""}}, + {"Saturation", {"Normal"}}, + {"SceneCaptureType", {"Standard"}}, + {"SensingMethod", {"Two-chip color area sensor"}}, + {"Sharpness", {"Normal"}}, + {"ShutterSpeedValue", {"13.00 EV (1/8192 sec.)"}}, + {"SourceExposureTimesOfCompositeImage", {"."}}, + {"SourceImageNumberOfCompositeImage", {"1234"}}, + {"SpatialFrequencyResponse", {"."}}, + {"StripByteCounts", {""}}, + {"StripOffsets", {""}}, + {"SubsecTime", {"427000"}}, + {"SubsecTimeDigitized", {"427000"}}, + {"SubsecTimeOriginal", {"427000"}}, + {"SubfileType", {""}}, + {"SubjectArea", {"Within rectangle (width 183, height 259) around (x,y) = (10,20)"}}, + {"SubjectDistanceRange", {"Unknown"}}, + {"BodySerialNumber", {"xx"}}, + {"BrightnessValue", {"2.50 EV (19.38 cd/m^2)"}}, + {"CFAPattern", {"1 bytes undefined data"}}, + {"CameraOwnerName", {"xx"}}, + {"ColorSpace", {"Adobe RGB"}}, + {"ComponentsConfiguration", {""}}, + {"CompositeImage", {"1"}}, + {"CompressedBitsPerPixel", {"1.5"}}, + {"Contrast", {"Normal"}}, + {"CustomRendered", {"Custom process"}}, + {"DateTimeDigitized", {"2023,01,19 10,39,58"}}, + {"DeviceSettingDescription", {"."}}, + {"DigitalZoomRatio", {"321"}}, + {"ExifVersion", {""}}, + {"ExposureIndex", {"1.5"}}, + {"ExposureMode", {"Auto exposure"}}, + {"ExposureProgram", {"Normal program"}}, + {"FileSource", {"DSC"}}, + {"FlashEnergy", {"832"}}, + {"FlashpixVersion", {""}}, + {"FocalPlaneResolutionUnit", {"Centimeter"}}, + {"FocalPlaneXResolution", {"1080"}}, + {"FocalPlaneYResolution", {"880"}} +}; // create pixelMap by data, and encode to the file descriptor int ConvertDataToFd(const uint8_t* data, size_t size, std::string encodeFormat = "image/jpeg"); @@ -39,4 +188,7 @@ void PixelYuvTest001(OHOS::Media::PixelMap* pixelMap); void PixelYuvTest002(OHOS::Media::PixelMap* pixelMap); +void SetFDPDecodeOptions(FuzzedDataProvider* FDP, OHOS::Media::DecodeOptions &decodeOpts); + +void SetFDPPixelDecodeOptions(FuzzedDataProvider* FDP, OHOS::ImagePlugin::PixelDecodeOptions &plOpts); #endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp b/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp index a8da7b2dc..a3e2a9f38 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp +++ b/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp @@ -28,6 +28,8 @@ #include "image_packer.h" #include "media_errors.h" #include "image_log.h" +#include "abs_image_decoder.h" +#include "image_type.h" #undef LOG_DOMAIN #define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE @@ -37,6 +39,11 @@ static const int FOUR_BYTES_PER_PIXEL = 4; static const int NUM_TWO = 2; +static constexpr uint32_t PIXELFORMAT_MODULO = 105; +static constexpr uint32_t ALPHATYPE_MODULO = 4; +static constexpr uint32_t COLORSPACE_MODULO = 17; +static constexpr uint32_t DYNAMICRANGE_MODULO = 3; +static constexpr uint32_t RESOLUTION_MODULO = 4; using namespace OHOS::Media; int ConvertDataToFd(const uint8_t* data, size_t size, std::string encodeFormat) @@ -264,3 +271,53 @@ void PixelYuvTest002(PixelMap* pixelMap) pixelYuv->WritePixel(pos, dstPixel); IMAGE_LOGI("%{public}s SUCCESS", __func__); } + +void SetFDPDecodeOptions(FuzzedDataProvider* FDP, OHOS::Media::DecodeOptions &decodeOpts) +{ + decodeOpts.fitDensity = FDP->ConsumeIntegral(); + decodeOpts.CropRect.left = FDP->ConsumeIntegral(); + decodeOpts.CropRect.top = FDP->ConsumeIntegral(); + decodeOpts.CropRect.width = FDP->ConsumeIntegral(); + decodeOpts.CropRect.height = FDP->ConsumeIntegral(); + decodeOpts.desiredSize.width = FDP->ConsumeIntegralInRange(0, 0xfff); + decodeOpts.desiredSize.height = FDP->ConsumeIntegralInRange(0, 0xfff); + decodeOpts.desiredRegion.left = FDP->ConsumeIntegral(); + decodeOpts.desiredRegion.top = FDP->ConsumeIntegral(); + decodeOpts.desiredRegion.width = FDP->ConsumeIntegral(); + decodeOpts.desiredRegion.height = FDP->ConsumeIntegral(); + decodeOpts.rotateDegrees = FDP->ConsumeFloatingPoint(); + decodeOpts.rotateNewDegrees = FDP->ConsumeIntegral(); + decodeOpts.sampleSize = FDP->ConsumeIntegral(); + decodeOpts.desiredPixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + decodeOpts.photoDesiredPixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + decodeOpts.desiredColorSpace = static_cast(FDP->ConsumeIntegral() % COLORSPACE_MODULO); + decodeOpts.allowPartialImage = FDP->ConsumeBool(); + decodeOpts.editable = FDP->ConsumeBool(); + decodeOpts.preference = static_cast(FDP->ConsumeBool()); + decodeOpts.fastAstc = FDP->ConsumeBool(); + decodeOpts.invokeType = FDP->ConsumeIntegral(); + decodeOpts.desiredDynamicRange = + static_cast(FDP->ConsumeIntegral() % DYNAMICRANGE_MODULO); + decodeOpts.resolutionQuality = static_cast(FDP->ConsumeIntegral() % RESOLUTION_MODULO); + decodeOpts.isAisr = FDP->ConsumeBool(); + decodeOpts.isAppUseAllocator = FDP->ConsumeBool(); +} + +void SetFDPPixelDecodeOptions(FuzzedDataProvider* FDP, OHOS::ImagePlugin::PixelDecodeOptions &plOpts) +{ + plOpts.CropRect.left = FDP->ConsumeIntegral(); + plOpts.CropRect.top = FDP->ConsumeIntegral(); + plOpts.CropRect.width = FDP->ConsumeIntegral(); + plOpts.CropRect.height = FDP->ConsumeIntegral(); + plOpts.desiredSize.width = FDP->ConsumeIntegralInRange(0, 0xfff); + plOpts.desiredSize.height = FDP->ConsumeIntegralInRange(0, 0xfff); + plOpts.rotateDegrees = FDP->ConsumeFloatingPoint(); + plOpts.sampleSize = FDP->ConsumeIntegral(); + plOpts.desiredPixelFormat = + static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + plOpts.desiredColorSpace = + static_cast(FDP->ConsumeIntegral() % COLORSPACE_MODULO); + plOpts.desireAlphaType = static_cast(FDP->ConsumeIntegral() % ALPHATYPE_MODULO); + plOpts.allowPartialImage = FDP->ConsumeBool(); + plOpts.editable = FDP->ConsumeBool(); +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/BUILD.gn new file mode 100644 index 000000000..759826978 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/BUILD.gn @@ -0,0 +1,44 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("ImageAccessor2FuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer" + resource_config_file = "$image_subsystem/test/resource/image/ohos_test.xml" + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_accessor2_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/plugins/common/libs/image/libextplugin:extplugin", + ] + + external_deps = [ + "c_utils:utils", + "graphic_2d:color_manager", + "hilog:libhilog", + "libexif:libexif", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/corpus/init b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/corpus/init new file mode 100644 index 000000000..8920b50aa --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/include/image_accessor_fuzzer.h b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/include/image_accessor_fuzzer.h new file mode 100644 index 000000000..72b66567b --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/include/image_accessor_fuzzer.h @@ -0,0 +1,19 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef FRAMEWORKS_INNERKITSIMPL_TEST_FUZZTEST_IMAGEFRAMEWORK_FUZZER_IMAGEACCESSOR_FUZZER_H +#define FRAMEWORKS_INNERKITSIMPL_TEST_FUZZTEST_IMAGEFRAMEWORK_FUZZER_IMAGEACCESSOR_FUZZER_H + +#define FUZZ_PROJECT_NAME "image_accessor2_fuzzer" +#endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/project.xml new file mode 100644 index 000000000..732603b22 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/src/image_accessor2_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/src/image_accessor2_fuzzer.cpp new file mode 100644 index 000000000..f72178eb0 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageaccessor2_fuzzer/src/image_accessor2_fuzzer.cpp @@ -0,0 +1,249 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include "image_accessor_fuzzer.h" +#define private public + +#include +#include +#include +#include +#include +#include "securec.h" + +#include "common_fuzztest_function.h" +#include "metadata_accessor_factory.h" +#include "dng_exif_metadata_accessor.h" +#include "heif_exif_metadata_accessor.h" +#include "jpeg_exif_metadata_accessor.h" +#include "png_exif_metadata_accessor.h" +#include "webp_exif_metadata_accessor.h" +#include "file_metadata_stream.h" +#include "image_log.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "IMAGE_ACCESSOR_FUZZ" + +namespace OHOS { +namespace Media { +FuzzedDataProvider* FDP; +using namespace std; + +void AccessMetadata(std::shared_ptr exifMetadata, const std::string &key, const std::string &value) +{ + if (exifMetadata == nullptr) { + IMAGE_LOGI("%{public}s failed, exifMetadata is null", __func__); + return; + } + exifMetadata->SetValue(key, value); + std::string res = ""; + exifMetadata->GetValue(key, res); + exifMetadata->RemoveEntry(key); +} + +void MetadataAccessorFuncTest(std::shared_ptr &metadataAccessor) +{ + if (metadataAccessor == nullptr) { + return; + } + metadataAccessor->Read(); + auto exifMetadata = metadataAccessor->Get(); + if (exifMetadata == nullptr) { + return; + } + uint32_t index = FDP->ConsumeIntegral() % KEY_VALUE_MAPS.size(); + auto key = KEY_VALUE_MAPS[index].first; + for (const auto &v : KEY_VALUE_MAPS[index].second) { + AccessMetadata(exifMetadata, key, v); + } + metadataAccessor->Write(); + metadataAccessor->Set(exifMetadata); + DataBuf inputBuf; + metadataAccessor->ReadBlob(inputBuf); + metadataAccessor->WriteBlob(inputBuf); +} + +void JpegAccessorTest(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + auto metadataAccessor = MetadataAccessorFactory::Create(pathName); + if (metadataAccessor == nullptr) { + IMAGE_LOGI("%{public}s failed", __func__); + return; + } + MetadataAccessorFuncTest(metadataAccessor); + auto jpegMetadataAccessor = reinterpret_cast(metadataAccessor.get()); + jpegMetadataAccessor->Read(); + jpegMetadataAccessor->Write(); + DataBuf inputBuf; + jpegMetadataAccessor->WriteBlob(inputBuf); + int marker = jpegMetadataAccessor->FindNextMarker(); + jpegMetadataAccessor->ReadSegmentLength(static_cast(marker)); + jpegMetadataAccessor->ReadNextSegment(static_cast(marker)); + jpegMetadataAccessor->GetInsertPosAndMarkerAPP1(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void PngAccessorTest(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + auto metadataAccessor = MetadataAccessorFactory::Create(pathName); + if (metadataAccessor == nullptr) { + IMAGE_LOGI("%{public}s failed", __func__); + return; + } + MetadataAccessorFuncTest(metadataAccessor); + auto pngMetadataAccessor = reinterpret_cast(metadataAccessor.get()); + pngMetadataAccessor->IsPngType(); + pngMetadataAccessor->Read(); + pngMetadataAccessor->Write(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void WebpAccessorTest(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + auto metadataAccessor = MetadataAccessorFactory::Create(pathName); + if (metadataAccessor == nullptr) { + IMAGE_LOGI("%{public}s failed", __func__); + return; + } + MetadataAccessorFuncTest(metadataAccessor); + auto webpMetadataAccessor = reinterpret_cast(metadataAccessor.get()); + webpMetadataAccessor->Read(); + webpMetadataAccessor->Write(); + Vp8xAndExifInfo exifFlag = Vp8xAndExifInfo::UNKNOWN; + webpMetadataAccessor->CheckChunkVp8x(exifFlag); + webpMetadataAccessor->GetImageWidthAndHeight(); + std::string strChunkId = "000"; + DataBuf chunkData = {}; + webpMetadataAccessor->GetWidthAndHeightFormChunk(strChunkId, chunkData); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void HeifAccessorTest(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + auto metadataAccessor = MetadataAccessorFactory::Create(pathName); + if (metadataAccessor == nullptr) { + IMAGE_LOGI("%{public}s failed", __func__); + return; + } + MetadataAccessorFuncTest(metadataAccessor); + auto heifMetadataAccessor = reinterpret_cast(metadataAccessor.get()); + heifMetadataAccessor->Read(); + heifMetadataAccessor->Write(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void DngAccessorTest(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + auto metadataAccessor = MetadataAccessorFactory::Create(pathName); + if (metadataAccessor == nullptr) { + IMAGE_LOGI("%{public}s failed", __func__); + return; + } + MetadataAccessorFuncTest(metadataAccessor); + auto dngMetadataAccessor = reinterpret_cast(metadataAccessor.get()); + dngMetadataAccessor->Read(); + dngMetadataAccessor->Write(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void DataBufTest(const uint8_t *data, size_t size) +{ + if (size == 0) { + return; + } + DataBuf dataBuf(data, size); + dataBuf.ReadUInt8(0); + dataBuf.Resize(size); + dataBuf.WriteUInt8(0, 0); + dataBuf.Reset(); +} + +void AccessorTest001(const uint8_t *data, size_t size) +{ + static const std::string JPEG_EXIF_PATH = "/data/local/tmp/test_exif.jpg"; + static const std::string PNG_EXIF_PATH = "/data/local/tmp/test_exif.png"; + static const std::string WEBP_EXIF_PATH = "/data/local/tmp/test_exif.webp"; + static const std::string HEIF_EXIF_PATH = "/data/local/tmp/test_exif.heic"; + static const std::string DNG_EXIF_PATH = "/data/local/tmp/test_exif.dng"; + static std::vector EXIF_PATHS = { + JPEG_EXIF_PATH, PNG_EXIF_PATH, WEBP_EXIF_PATH, HEIF_EXIF_PATH, DNG_EXIF_PATH}; + uint8_t action = FDP->ConsumeIntegral() % 5; + std::string path = EXIF_PATHS[action]; + WriteDataToFile(data, size, path); + switch (action) { + case 0: + JpegAccessorTest(path); + break; + case 1: + PngAccessorTest(path); + break; + case 2: + WebpAccessorTest(path); + break; + case 3: + HeifAccessorTest(path); + break; + default: + DngAccessorTest(path); + break; + } +} + +void AccessorTest002(const uint8_t *data, size_t size) +{ + std::string filename = "/data/local/tmp/test_parse_exif.jpg"; + if (!WriteDataToFile(data, size, filename)) { + IMAGE_LOGE("WriteDataToFile failed"); + return; + } + BufferMetadataStream::MemoryMode mode = BufferMetadataStream::MemoryMode::Dynamic; + std::shared_ptr metadataAccessor1 = + MetadataAccessorFactory::Create(const_cast(data), size, mode); + MetadataAccessorFuncTest(metadataAccessor1); + std::shared_ptr metadataAccessor2 = MetadataAccessorFactory::Create(filename); + MetadataAccessorFuncTest(metadataAccessor2); +} +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + FuzzedDataProvider fdp(data, size); + OHOS::Media::FDP = &fdp; + uint8_t action = fdp.ConsumeIntegral() % 3; + switch (action) { + case 0: + OHOS::Media::DataBufTest(data, size); + break; + case 1: + OHOS::Media::AccessorTest001(data, size); + break; + default: + OHOS::Media::AccessorTest002(data, size); + break; + } + + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/BUILD.gn new file mode 100644 index 000000000..f9a819e43 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/BUILD.gn @@ -0,0 +1,44 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("ImageFwkConvertPixelFormatFuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer" + resource_config_file = "$image_subsystem/test/resource/image/ohos_test.xml" + + include_dirs = [ + "./include", + "$image_subsystem/frameworks/innerkitsimpl/converter/include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_fwk_convert_pixelformat_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/frameworks/innerkitsimpl/utils:image_utils", + "$image_subsystem/interfaces/innerkits:image_native", + ] + + external_deps = [ + "c_utils:utils", + "hilog:libhilog", + "ipc:ipc_core", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/corpus/init b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/corpus/init new file mode 100644 index 000000000..64d7767e6 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/corpus/init @@ -0,0 +1,14 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +FUZZ \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/include/image_fwk_convert_p010yuv2rgb_ext_fuzzer.h b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/include/image_fwk_convert_p010yuv2rgb_ext_fuzzer.h new file mode 100644 index 000000000..9dc5def9e --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/include/image_fwk_convert_p010yuv2rgb_ext_fuzzer.h @@ -0,0 +1,20 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef IMAGE_FWK_CONVERT_P010YUV2RGB_EXT_FUZZER_H +#define IMAGE_FWK_CONVERT_P010YUV2RGB_EXT_FUZZER_H + +#define FUZZ_PROJECT_NAME "image_fwk_convert_p010yuv2rgb_ext_fuzzer" +#endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/project.xml new file mode 100644 index 000000000..b42e6fd00 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/src/image_fwk_convert_pixelformat_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/src/image_fwk_convert_pixelformat_fuzzer.cpp new file mode 100644 index 000000000..6174ab64a --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkconvertpixelfotmat_fuzzer/src/image_fwk_convert_pixelformat_fuzzer.cpp @@ -0,0 +1,93 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include "image_fwk_convert_p010yuv2rgb_ext_fuzzer.h" + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "common_fuzztest_function.h" +#include "buffer_packer_stream.h" +#include "image_format_convert.h" +#include "image_format_convert_utils.h" +#include "image_log.h" +#include "image_source.h" +#include "image_type.h" +#include "image_utils.h" +#include "media_errors.h" +#include "pixel_map.h" +#include "message_parcel.h" + +namespace OHOS { +namespace Media { +FuzzedDataProvider* FDP; + +constexpr uint32_t OPT_SIZE = 40; +constexpr uint32_t SOURCEOPTIONS_MIMETYPE_MODULO = 3; +constexpr uint32_t PIXELFORMAT_MODULO = 105; + +void ConvertPixelFormatFuzzTest001(std::string pathName) +{ + PixelFormat destFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + + Media::SourceOptions opts; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + uint32_t errorCode; + std::shared_ptr imageSource = ImageSource::CreateImageSource(pathName, opts, errorCode); + if (imageSource == nullptr) { + IMAGE_LOGE("%{public}s failed, imageSource is nullptr.", __func__); + return; + } + DecodeOptions decodeOpts; + SetFDPDecodeOptions(FDP, decodeOpts); + std::shared_ptr srcPixelMap = imageSource->CreatePixelMapEx(0, decodeOpts, errorCode); + if (srcPixelMap == nullptr) { + IMAGE_LOGE("%{public}s failed, srcPixelMap is nullptr.", __func__); + return; + } + + uint32_t ret = ImageFormatConvert::ConvertImageFormat(srcPixelMap, destFormat); + if (ret != SUCCESS) { + srcPixelMap->FreePixelMap(); + IMAGE_LOGE("ConvertPixelFormatFuzzTest001: CreatePixelMap fail"); + return; + } +} + +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + if (size < OHOS::Media::OPT_SIZE) { + return -1; + } + FuzzedDataProvider fdp(data + size - OHOS::Media::OPT_SIZE, OHOS::Media::OPT_SIZE); + OHOS::Media::FDP = &fdp; + static const std::string pathName = "/data/local/tmp/P010.yuv"; + WriteDataToFile(data, size - OHOS::Media::OPT_SIZE, pathName); + OHOS::Media::ConvertPixelFormatFuzzTest001(pathName); + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/BUILD.gn new file mode 100644 index 000000000..5eb91ec76 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/BUILD.gn @@ -0,0 +1,43 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("ImageFwkImageSource2FuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer" + resource_config_file = "$image_subsystem/test/resource/image/ohos_test.xml" + + include_dirs = [ + "./include", + "$image_subsystem/frameworks/innerkitsimpl/utils/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_fwk_image_source2_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/frameworks/innerkitsimpl/utils:image_utils", + "$image_subsystem/interfaces/innerkits:image_native", + ] + + external_deps = [ + "c_utils:utils", + "graphic_2d:color_manager", + "hilog:libhilog", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/corpus/init b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/corpus/init new file mode 100644 index 000000000..8920b50aa --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/include/image_fwk_image_source_fuzzer.h b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/include/image_fwk_image_source_fuzzer.h new file mode 100644 index 000000000..0ec6bf680 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/include/image_fwk_image_source_fuzzer.h @@ -0,0 +1,19 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef IMAGE_FWK_IMAGE_SOURCE_FUZZER_H +#define IMAGE_FWK_IMAGE_SOURCE_FUZZER_H + +#define FUZZ_PROJECT_NAME "image_fwk_image_source_fuzzer" +#endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/project.xml new file mode 100644 index 000000000..6ce99e4b2 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 15728640 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/src/image_fwk_image_source2_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/src/image_fwk_image_source2_fuzzer.cpp new file mode 100644 index 000000000..f7acc48be --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkimagesource2_fuzzer/src/image_fwk_image_source2_fuzzer.cpp @@ -0,0 +1,413 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "image_fwk_image_source_fuzzer.h" + +#define private public +#include +#include +#include +#include +#include +#include "common_fuzztest_function.h" + +#include "image_log.h" +#include "image_packer.h" +#include "image_source.h" +#include "image_utils.h" +#include "media_errors.h" + +static const std::string JPEG_FORMAT = "image/jpeg"; +static const std::string HEIF_FORMAT = "image/heif"; +static const std::string WEBP_FORMAT = "image/webp"; +static const std::string GIF_FORMAT = "image/gif"; +static const std::string PNG_FORMAT = "image/png"; +static const std::string IMAGE_ENCODE_DEST = "/data/local/tmp/test_out.dat"; +constexpr uint32_t SOURCEOPTIONS_MIMETYPE_MODULO = 3; + +namespace OHOS { +namespace Media { +FuzzedDataProvider *FDP; +void ImageSourceFuncTest002(std::unique_ptr &imageSource, DecodeOptions &opts, PixelMap &pixelMap) +{ + IMAGE_LOGI("%{public}s IN", __func__); + uint32_t errCode = 0; + Rect cropRect; + ImageInfo imageInfo; + imageSource->ImageConverChange(cropRect, imageInfo, imageInfo); + imageSource->CreatePixelMapForYUV(errCode); + imageSource->CreatePixelMapList(opts, errCode); + imageSource->GetDelayTime(errCode); + imageSource->GetDisposalType(errCode); + imageSource->GetFrameCount(errCode); + imageSource->GetLoopCount(errCode); + auto exifMeta = imageSource->GetExifMetadata(); + imageSource->SetExifMetadata(exifMeta); + imageSource->GetFinalOutputStep(opts, pixelMap, false); + imageSource->SetIncrementalSource(false); + auto incrementalRecordIter = imageSource->incDecodingMap_.find(&pixelMap); + imageSource->AddIncrementalContext(pixelMap, incrementalRecordIter); + imageSource->GetImageInfoFromExif(0, imageInfo); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void ImageSourceFuncTest001(std::unique_ptr &imageSource) +{ + IMAGE_LOGI("%{public}s IN", __func__); + std::set formats; + imageSource->GetSupportedFormats(formats); + imageSource->GetDecodeEvent(); + std::string key = "ImageWidth"; + std::string value = "500"; + int32_t valueInt = 0; + uint32_t errCode = 0; + imageSource->ModifyImageProperty(key, value); + imageSource->ModifyImageProperty(nullptr, key, value); + imageSource->ModifyImageProperty(0, key, value, ""); + imageSource->ModifyImageProperty(0, key, value, 0); + imageSource->ModifyImageProperty(0, key, value, nullptr, 0); + imageSource->GetImagePropertyCommon(0, key, value); + imageSource->GetImagePropertyInt(0, key, valueInt); + imageSource->GetImagePropertyString(0, key, value); + imageSource->GetSourceInfo(errCode); + imageSource->RegisterListener(nullptr); + imageSource->UnRegisterListener(nullptr); + imageSource->AddDecodeListener(nullptr); + imageSource->RemoveDecodeListener(nullptr); + imageSource->IsStreamCompleted(); + auto agentIter = imageSource->formatAgentMap_.begin(); + imageSource->CheckEncodedFormat(*(agentIter->second)); + imageSource->CheckFormatHint(key, agentIter); + imageSource->DecodeSourceInfo(false); + imageSource->DecodeSourceInfo(true); + imageSource->CreateDecoder(errCode); + DecodeOptions opts; + DecodeOptions procOpts; + PixelMap pixelMap; + imageSource->CopyOptionsToProcOpts(opts, procOpts, pixelMap); + MemoryUsagePreference preference = MemoryUsagePreference::LOW_RAM; + imageSource->SetMemoryUsagePreference(preference); + imageSource->ImageSizeChange(1, 1, 1, 1); + ImageSourceFuncTest002(imageSource, opts, pixelMap); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void CreateIncrementalPixelMapByDataFuzz(const uint8_t *data, size_t size) +{ + Media::SourceOptions opts; + uint32_t errorCode = 0; + Media::IncrementalSourceOptions incOpts; + incOpts.incrementalMode = IncrementalMode::INCREMENTAL_DATA; + auto imageSource = Media::ImageSource::CreateIncrementalImageSource(incOpts, errorCode); + if (imageSource != nullptr) { + DecodeOptions decodeOpts; + std::unique_ptr incPixelMap = + imageSource->CreateIncrementalPixelMap(0, decodeOpts, errorCode); + uint32_t res = imageSource->UpdateData(data, size, true); + uint8_t decodeProgress = 0; + res = incPixelMap->PromoteDecoding(decodeProgress); + } +} + +void CreateImageSourceByPathFuzz(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + Media::SourceOptions opts; + uint32_t errorCode; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + auto imageSource = Media::ImageSource::CreateImageSource(pathName, opts, errorCode); + if (imageSource == nullptr) { + IMAGE_LOGI("%{public}s failed", __func__); + return; + } + ImageSourceFuncTest001(imageSource); + Media::DecodeOptions dopts; + SetFDPDecodeOptions(FDP, dopts); + imageSource->CreatePixelMap(dopts, errorCode); + imageSource->Reset(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void CreateImageSourceByFDEXFuzz(const std::string &pathName) +{ + int fd = open(pathName.c_str(), O_RDWR | O_CREAT, S_IRUSR | S_IWUSR); + if (fd < 0) { + IMAGE_LOGI("%{public}s fail, Invalid path:%{public}s", __func__, pathName.c_str()); + return; + } + Media::SourceOptions opts; + uint32_t errorCode = 0; + int32_t offset = 0; + int32_t length = 1; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + auto imagesource = Media::ImageSource::CreateImageSource(fd, offset, length, opts, errorCode); + Media::DecodeOptions dopts; + SetFDPDecodeOptions(FDP, dopts); + if (imagesource != nullptr) { + imagesource->CreatePixelMap(dopts, errorCode); + } + close(fd); +} + +void CreateImageSourceByIstreamFuzz(const std::string &pathName) +{ + std::unique_ptr is = std::make_unique(pathName.c_str()); + Media::SourceOptions opts; + uint32_t errorCode; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + Media::DecodeOptions dopts; + SetFDPDecodeOptions(FDP, dopts); + auto imageSource = Media::ImageSource::CreateImageSource(std::move(is), opts, errorCode); + if (imageSource != nullptr) { + imageSource->CreatePixelMap(dopts, errorCode); + } +} + +void CreateImageSourceByPathNameFuzz(const std::string &pathName) +{ + Media::SourceOptions opts; + uint32_t errorCode; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + Media::DecodeOptions dopts; + SetFDPDecodeOptions(FDP, dopts); + auto imageSource = Media::ImageSource::CreateImageSource(pathName, opts, errorCode); + if (imageSource != nullptr) { + imageSource->CreatePixelMap(dopts, errorCode); + } +} + +void CreateIncrementalPixelMapFuzz(const std::string &pathName) +{ + Media::SourceOptions opts; + uint32_t errorCode; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + auto imageSource = Media::ImageSource::CreateImageSource(pathName, opts, errorCode); + Media::DecodeOptions dopts; + SetFDPDecodeOptions(FDP, dopts); + uint32_t index = 1; + if (imageSource != nullptr) { + imageSource->CreateIncrementalPixelMap(index, dopts, errorCode); + } +} + +void CreateImageSourceByDataFuzz(const uint8_t *data, size_t size) +{ + uint32_t errCode = 0; + SourceOptions opts; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + std::unique_ptr imageSource = ImageSource::CreateImageSource(data, size, opts, errCode); +} + +void ImageSourceFuzzTest(const uint8_t *data, size_t size) +{ + if (data == nullptr) { + return; + } + SourceOptions opts; + uint32_t errorCode = 0; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + std::shared_ptr imageSource = ImageSource::CreateImageSource(data, size, opts, errorCode); + if (imageSource == nullptr) { + return; + } + uint32_t index = FDP->ConsumeIntegral() % KEY_VALUE_MAPS.size(); + auto key = KEY_VALUE_MAPS[index].first; + for (const auto &v : KEY_VALUE_MAPS[index].second) { + imageSource->ModifyImageProperty(0, key, v); + imageSource->ModifyImagePropertyEx(0, key, v); + } + bool isSupportOdd = false; + bool isAddUV = false; + std::vector buffer; + imageSource->ConvertYUV420ToRGBA(buffer.data(), size, isSupportOdd, isAddUV, errorCode); +} + +static std::string GetProperty(std::unique_ptr &imageSource, const std::string &prop) +{ + std::string value = ""; + imageSource->GetImagePropertyString(0, prop, value); + return value; +} + +void GetImagePropertyFuzzTest001(const std::string &pathName) +{ + uint32_t errCode = 0; + SourceOptions srcOpts; + auto imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errCode); + GetProperty(imageSource, "DateTimeOriginal"); + GetProperty(imageSource, "ExposureTime"); + GetProperty(imageSource, "SceneType"); + std::set keys = {"DateTimeOriginal", "ExposureTime", "SceneType"}; + errCode = imageSource->RemoveImageProperties(0, keys, pathName); + if (errCode != SUCCESS) { + return; + } + auto imageSourceNew = ImageSource::CreateImageSource(pathName, srcOpts, errCode); + GetProperty(imageSource, "DateTimeOriginal"); + GetProperty(imageSource, "ExposureTime"); + GetProperty(imageSource, "SceneType"); +} + +void EncodePictureTest(std::shared_ptr picture, const std::string &format, const std::string &outputPath) +{ + IMAGE_LOGI("%{public}s start.", __func__); + if (picture == nullptr) { + IMAGE_LOGE("%{public}s picture null.", __func__); + return; + } + ImagePacker pack; + PackOption packOption; + packOption.format = format; + if (pack.StartPacking(outputPath, packOption) != SUCCESS) { + IMAGE_LOGE("%{public}s StartPacking failed.", __func__); + return; + } + if (pack.AddPicture(*picture) != SUCCESS) { + IMAGE_LOGE("%{public}s AddPicture failed.", __func__); + return; + } + if (pack.FinalizePacking() != SUCCESS) { + IMAGE_LOGE("%{public}s FinalizePacking failed.", __func__); + return; + } + IMAGE_LOGI("%{public}s SUCCESS.", __func__); +} + +void EncodePixelMapTest(std::shared_ptr pixelmap, const std::string &format, const std::string &outputPath) +{ + IMAGE_LOGI("%{public}s start.", __func__); + if (pixelmap == nullptr) { + IMAGE_LOGE("%{public}s picture null.", __func__); + return; + } + ImagePacker pack; + PackOption packOption; + packOption.format = format; + if (pack.StartPacking(outputPath, packOption) != SUCCESS) { + IMAGE_LOGE("%{public}s StartPacking failed.", __func__); + return; + } + if (pack.AddImage(*pixelmap) != SUCCESS) { + IMAGE_LOGE("%{public}s AddImage failed.", __func__); + return; + } + if (pack.FinalizePacking() != SUCCESS) { + IMAGE_LOGE("%{public}s FinalizePacking failed.", __func__); + return; + } + IMAGE_LOGI("%{public}s SUCCESS.", __func__); +} + +bool CreatePixelMapUseArgbByRandomImageSource(const uint8_t *data, size_t size) +{ + if (data == nullptr) { + return false; + } + SourceOptions opts; + uint32_t errorCode; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + std::shared_ptr imageSource = ImageSource::CreateImageSource(data, size, opts, errorCode); + if (imageSource == nullptr) { + return false; + } + DecodeOptions dopts; + SetFDPDecodeOptions(FDP, dopts); + std::shared_ptr pixelMap = imageSource->CreatePixelMap(0, dopts, errorCode); + + if (pixelMap != nullptr) { + std::vector formats = {JPEG_FORMAT, HEIF_FORMAT, PNG_FORMAT, WEBP_FORMAT, GIF_FORMAT}; + uint8_t index = FDP->ConsumeIntegral() % formats.size(); + EncodePixelMapTest(pixelMap, formats[index], IMAGE_ENCODE_DEST); + } + ImageInfo info; + if (pixelMap == nullptr) { + pixelMap->GetImageInfo(info); + } + std::shared_ptr auxPicture = + AuxiliaryPicture::Create(pixelMap, AuxiliaryPictureType::FRAGMENT_MAP, info.size); + DecodingOptionsForPicture doptsForPicture; + doptsForPicture.desiredPixelFormat = dopts.desiredPixelFormat; + std::shared_ptr picture = imageSource->CreatePicture(doptsForPicture, errorCode); + if (auxPicture != nullptr && picture != nullptr) { + picture->SetAuxiliaryPicture(auxPicture); + } + if (picture != nullptr) { + bool action = FDP->ConsumeBool(); + if (action) { + EncodePictureTest(picture, JPEG_FORMAT, IMAGE_ENCODE_DEST); + } else { + EncodePictureTest(picture, HEIF_FORMAT, IMAGE_ENCODE_DEST); + } + } + return true; +} + +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + std::string pathName = "/data/local/tmp/test_create_imagesource_pathname.png"; + if (!WriteDataToFile(data, size, pathName)) { + IMAGE_LOGE("WriteDataToFile failed"); + return 0; + } + FuzzedDataProvider fdp(data, size); + OHOS::Media::FDP = &fdp; + uint8_t action = fdp.ConsumeIntegral() % 10; + switch (action) { + case 0: + OHOS::Media::CreateImageSourceByPathFuzz(pathName); + break; + case 1: + OHOS::Media::CreateImageSourceByFDEXFuzz(pathName); + break; + case 2: + OHOS::Media::CreateImageSourceByIstreamFuzz(pathName); + break; + case 3: + OHOS::Media::CreateIncrementalPixelMapFuzz(pathName); + break; + case 4: + OHOS::Media::CreateImageSourceByDataFuzz(data, size); + break; + case 5: + OHOS::Media::CreateIncrementalPixelMapByDataFuzz(data, size); + break; + case 6: + OHOS::Media::GetImagePropertyFuzzTest001(pathName); + break; + case 7: + OHOS::Media::CreatePixelMapUseArgbByRandomImageSource(data, size); + break; + case 8: + OHOS::Media::ImageSourceFuzzTest(data, size); + break; + default: + OHOS::Media::CreateIncrementalPixelMapByDataFuzz(data, size); + break; + } + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/BUILD.gn new file mode 100644 index 000000000..92f5172ed --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/BUILD.gn @@ -0,0 +1,38 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +config("image_external_config") { + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + ] +} + +ohos_fuzztest("ImagePixelYuv2FuzzTest") { + public_configs = [ ":image_external_config" ] + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_pixelyuv_fuzzer.cpp" + ] + deps = [ "$image_subsystem/interfaces/innerkits:image_native" ] + external_deps = [ + "c_utils:utils", + "hilog:libhilog", + ] + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer" + module_out_path = "multimedia_image/image_framework" +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/corpus/init b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/corpus/init new file mode 100644 index 000000000..e7c3fecd8 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/corpus/init @@ -0,0 +1,14 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +FUZZ \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/include/image_pixelyuv_fuzzer.h b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/include/image_pixelyuv_fuzzer.h new file mode 100644 index 000000000..08ee00df9 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/include/image_pixelyuv_fuzzer.h @@ -0,0 +1,20 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FRAMEWORKS_INNERKITSIMPL_TEST_FUZZTEST_IMAGEFRAMEWORK_FUZZER_IMAGEPIXELMAP_FUZZER_H +#define FRAMEWORKS_INNERKITSIMPL_TEST_FUZZTEST_IMAGEFRAMEWORK_FUZZER_IMAGEPIXELMAP_FUZZER_H + +#define FUZZ_PROJECT_NAME "image_pixelmap_yuv_fuzzer" +#endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/project.xml new file mode 100644 index 000000000..7133b2b92 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/src/image_pixelyuv_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/src/image_pixelyuv_fuzzer.cpp new file mode 100644 index 000000000..479259c48 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepixelYuv2_fuzzer/src/image_pixelyuv_fuzzer.cpp @@ -0,0 +1,78 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "image_pixelyuv_fuzzer.h" +#include "common_fuzztest_function.h" +#include +#include +#include +#include + +#include "pixel_map.h" + +#include "image_log.h" +#include "image_source.h" + +namespace OHOS { +namespace Media { + +FuzzedDataProvider* FDP; + +void PixelMapYuvFuzzTest(const uint8_t *data, size_t size) +{ + if (data == nullptr) { + return; + } + SourceOptions opts; + uint32_t errorCode; + std::shared_ptr imageSource = ImageSource::CreateImageSource(data, size, opts, errorCode); + if (imageSource == nullptr) { + return; + } + DecodeOptions decodeOpts; + SetFDPDecodeOptions(FDP, decodeOpts); + std::unique_ptr pixelMap = imageSource->CreatePixelMap(decodeOpts, errorCode); + if (pixelMap == nullptr) { + return; + } + uint8_t action = FDP->ConsumeBool(); + switch (action) { + case 0: { + float degrees = FDP->ConsumeFloatingPoint(); + pixelMap->rotate(degrees); + break; + } + default: { + float dstWidth = FDP->ConsumeFloatingPoint(); + float dstHeight = FDP->ConsumeFloatingPoint(); + AntiAliasingOption option = static_cast(FDP->ConsumeIntegral() % 11); + pixelMap->scale(dstWidth, dstHeight, option); + break; + } + } +} + +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + FuzzedDataProvider fdp(data, size); + OHOS::Media::FDP = &fdp; + OHOS::Media::PixelMapYuvFuzzTest(data, size); + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/BUILD.gn new file mode 100644 index 000000000..1b303b249 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/BUILD.gn @@ -0,0 +1,63 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("ImagePlugin2FuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer" + resource_config_file = "$image_subsystem/test/resource/image/ohos_test.xml" + + cflags = [ "-DIMAGE_COLORSPACE_FLAG" ] + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include/jpeg_yuv_decoder", + "$image_subsystem/plugins/common/libs/image/libsvgplugin/include", + "$image_subsystem/plugins/common/libs/image/libbmpplugin/include", + ] + + defines = [ + "JPEG_HW_DECODE_ENABLE", + "HEIF_HW_DECODE_ENABLE", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_plugin_fuzz.cpp", + ] + + deps = [ + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/plugins/common/libs/image/libextplugin:extplugin", + "$image_subsystem/plugins/common/libs/image/libsvgplugin:svgplugin", + "$image_subsystem/plugins/common/libs/image/libbmpplugin:bmpplugin", + ] + + external_deps = [ + "c_utils:utils", + "drivers_interface_codec:libimage_proxy_2.1", + "drivers_interface_display:display_buffer_idl_headers", + "drivers_interface_display:display_composer_idl_headers", + "drivers_interface_display:libdisplay_buffer_hdi_impl", + "drivers_interface_display:libdisplay_composer_hdi_impl_1.2", + "graphic_2d:color_manager", + "hilog:libhilog", + "libexif:libexif", + "libjpeg-turbo:turbojpeg", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/corpus/init b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/corpus/init new file mode 100644 index 000000000..8920b50aa --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/include/image_plugin_fuzz.h b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/include/image_plugin_fuzz.h new file mode 100644 index 000000000..b596cbad2 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/include/image_plugin_fuzz.h @@ -0,0 +1,19 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef IMAGE_PLUGIN_FUZZ_H +#define IMAGE_PLUGIN_FUZZ_H + +#define FUZZ_PROJECT_NAME "image_plugin_fuzzer" +#endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/project.xml new file mode 100644 index 000000000..0ca11a33f --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 6144 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/src/image_plugin_fuzz.cpp b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/src/image_plugin_fuzz.cpp new file mode 100644 index 000000000..03de46114 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imageplugin2_fuzzer/src/image_plugin_fuzz.cpp @@ -0,0 +1,338 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "image_plugin_fuzz.h" + +#define private public +#define protected public +#include +#include +#include +#include +#include +#include + +#include "common_fuzztest_function.h" +#include "image_source.h" +#include "ext_decoder.h" +#include "svg_decoder.h" +#include "bmp_decoder.h" +#include "image_log.h" +#include "pixel_yuv.h" +#ifdef IMAGE_COLORSPACE_FLAG +#include "color_space.h" +#endif +#include "ext_wstream.h" +#include "hdr_helper.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "PLUGIN_FUZZ" + +using FuzzTestFuction = std::function; +namespace OHOS { +namespace Media { +using namespace OHOS::ImagePlugin; +FuzzedDataProvider *FDP; +static const std::string JPEG_HW_PATH = "/data/local/tmp/test_hw.jpg"; +static const std::string JPEG_SW_PATH = "/data/local/tmp/test-tree-420.jpg"; +static const std::string HEIF_HW_PATH = "/data/local/tmp/test_hw.heic"; +static const std::string HDR_PATH = "/data/local/tmp/HEIFISOMultiChannelBaseColor0512V12.heic"; +static const std::string WEBP_PATH = "/data/local/tmp/test.webp"; +static const std::string GIF_PATH = "/data/local/tmp/test.gif"; +static const std::string HDR_PATH2 = "/data/local/tmp/HDRVividSingleLayer.heic"; +static const std::string HDR_PATH3 = "/data/local/tmp/JPEGISOSingle.jpg"; +static const std::string HDR_PATH4 = "/data/local/tmp/JPEGVividSingle.jpg"; +static const std::string HDR_PATH5 = "/data/local/tmp/siglechanel_yuv420_20240515V2.heic"; + +static const std::string PNG_PATH1 = "/data/local/tmp/test_chunk_itxt_nocompress.png"; +static const std::string PNG_PATH2 = "/data/local/tmp/test_out_chunk_itxt_withcompress.png"; +static const std::string PNG_PATH3 = "/data/local/tmp/test_chunk_text.png"; +static const std::string PNG_PATH5 = "/data/local/tmp/test_exif.png"; +static const std::string JPG_PATH1 = "/data/local/tmp/800-500.jpg"; +static const std::string JPG_PATH3 = "/data/local/tmp/jpeg_include_icc_profile.jpg"; +static const std::string JPG_PATH4 = "/data/local/tmp/test_raw_file.jpg"; +static const std::string SVG_PATH1 = "/data/local/tmp/test_large.svg"; +static const std::string SVG_PATH2 = "/data/local/tmp/test.svg"; +static const std::string ASTC_PATH1 = "/data/local/tmp/THM_ASTC.astc"; +constexpr uint8_t ITUT35_TAG_SIZE = 6; +static constexpr uint32_t ALLOCATORTYPE_MODULO = 5; +static constexpr uint32_t CROPANDSCALESTRATEGY_MODULO = 3; + +void SvgDecoderFuncTest001(const std::string &filename) +{ + IMAGE_LOGI("%{public}s IN path: %{public}s", __func__, filename.c_str()); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(filename, srcOpts, errorCode); + if (imageSource == nullptr) { + return; + } + + imageSource->sourceInfo_.encodedFormat = "image/svg+xml"; + auto svgDecoder = static_cast(imageSource->CreateDecoder(errorCode)); + PixelDecodeOptions plOpts; + SetFDPPixelDecodeOptions(FDP, plOpts); + PlImageInfo plInfo; + svgDecoder->SetDecodeOptions(0, plOpts, plInfo); + DecodeContext context; + svgDecoder->Decode(0, context); + uint32_t num; + svgDecoder->GetTopLevelImageNum(num); + context.allocatorType = static_cast(FDP->ConsumeIntegral() % ALLOCATORTYPE_MODULO); + svgDecoder->AllocBuffer(context); + svgDecoder->DoSetDecodeOptions(0, plOpts, plInfo); + Size plSize; + svgDecoder->DoGetImageSize(0, plSize); + svgDecoder->DoDecode(0, context); + svgDecoder->Reset(); + delete svgDecoder; + svgDecoder = nullptr; + + DecodeOptions dstOpts; + imageSource = ImageSource::CreateImageSource(filename, srcOpts, errorCode); + imageSource->CreatePixelMap(0, dstOpts, errorCode); + imageSource->Reset(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void JpegHardwareTest001(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errorCode); + if (imageSource == nullptr) { + return; + } + DecodeOptions decodeOpts; + SetFDPDecodeOptions(FDP, decodeOpts); + auto pixelMap = imageSource->CreatePixelMapEx(0, decodeOpts, errorCode); + if (pixelMap == nullptr) { + return; + } + + PixelMapTest001(pixelMap.get()); + PixelMapTest002(pixelMap.get()); + PixelYuvTest001(pixelMap.get()); + PixelYuvTest002(pixelMap.get()); + + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void JpegSoftTest001(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errorCode); + if (imageSource == nullptr) { + return; + } + DecodeOptions decodeOpts; + SetFDPDecodeOptions(FDP, decodeOpts); + auto pixelMap = imageSource->CreatePixelMapEx(0, decodeOpts, errorCode); + if (pixelMap == nullptr) { + return; + } + PixelMapTest001(pixelMap.get()); + PixelMapTest002(pixelMap.get()); + PixelYuvTest001(pixelMap.get()); + PixelYuvTest002(pixelMap.get()); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void HeifHardwareTest001(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errorCode); + if (imageSource == nullptr) { + return; + } + DecodeOptions decodeOpts; + SetFDPDecodeOptions(FDP, decodeOpts); + auto pixelMap = imageSource->CreatePixelMapEx(0, decodeOpts, errorCode); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void HdrTest001(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errorCode); + if (imageSource == nullptr) { + return; + } + ImageInfo imageInfo; + imageSource->GetImageInfo(0, imageInfo); + if (!imageSource->IsHdrImage()) { + IMAGE_LOGE("%{public}s %{public}s is not hdr", __func__, pathName.c_str()); + return; + } + DecodeContext gainMapCtx; + if (imageSource->mainDecoder_->DecodeHeifGainMap(gainMapCtx)) { + IMAGE_LOGI("%{public}s DecodeHeifGainMap SUCCESS, %{public}s", __func__, pathName.c_str()); + imageSource->mainDecoder_->GetHdrMetadata(imageSource->mainDecoder_->CheckHdrType()); + } else { + IMAGE_LOGE("%{public}s DecodeHeifGainMap failed, %{public}s", __func__, pathName.c_str()); + } + + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void GifTest001(const std::string &pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errorCode); + if (imageSource == nullptr) { + return; + } + DecodeOptions decodeOpts; + SetFDPDecodeOptions(FDP, decodeOpts); + for (uint32_t index = 0; index < imageSource->GetFrameCount(errorCode); ++index) { + auto pixelMap = imageSource->CreatePixelMapEx(0, decodeOpts, errorCode); + IMAGE_LOGI("%{public}s gif decode SUCCESS", __func__); + } + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void ExtDecoderRegionFuncTest001(const std::string &filename) +{ + IMAGE_LOGI("%{public}s IN path: %{public}s", __func__, filename.c_str()); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(filename, srcOpts, errorCode); + if (imageSource == nullptr) { + return; + } + int32_t x = FDP->ConsumeIntegral(); + int32_t y = FDP->ConsumeIntegral(); + int32_t width = FDP->ConsumeIntegral(); + int32_t height = FDP->ConsumeIntegral(); + Media::DecodeOptions dopts; + dopts.desiredRegion.left = x; + dopts.desiredRegion.top = y; + dopts.desiredRegion.width = width; + dopts.desiredRegion.height = height; + dopts.cropAndScaleStrategy = + static_cast(FDP->ConsumeIntegral() % CROPANDSCALESTRATEGY_MODULO); + imageSource->CreatePixelMap(dopts, errorCode); + auto extDecoder = static_cast((imageSource->mainDecoder_).get()); + if (extDecoder == nullptr || !extDecoder->DecodeHeader()) { + return; + } + DecodeContext context; + SkImageInfo heifInfo; + extDecoder->HeifYUVMemAlloc(context, heifInfo); + int dWidth; + int dHeight; + float scale; + extDecoder->GetScaledSize(dWidth, dHeight, scale); + extDecoder->GetHardwareScaledSize(dWidth, dHeight, scale); + extDecoder->IsSupportScaleOnDecode(); + PixelDecodeOptions plOpts; + PlImageInfo plInfo; + extDecoder->SetDecodeOptions(0, plOpts, plInfo); + PixelFormat dstFormat = PixelFormat::UNKNOWN; + extDecoder->PreDecodeCheckYuv(0, dstFormat); + extDecoder->DoHardWareDecode(context); + extDecoder->GetJpegYuvOutFmt(dstFormat); + extDecoder->DecodeToYuv420(0, context); + extDecoder->CheckContext(context); + extDecoder->HardWareDecode(context); + SkAlphaType alphaType; + AlphaType outputType; + extDecoder->ConvertInfoToAlphaType(alphaType, outputType); + SkColorType format; + PixelFormat outputFormat; + extDecoder->ConvertInfoToColorType(format, outputFormat); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void HdrHelperFucTest() +{ + HdrMetadata metadataOne; + metadataOne.extendMeta.baseColorMeta.baseMappingFlag = ITUT35_TAG_SIZE; + metadataOne.extendMeta.gainmapColorMeta.combineMappingFlag = ITUT35_TAG_SIZE; + ImagePlugin::HdrJpegPackerHelper::PackVividMetadataMarker(metadataOne); + + HdrMetadata metadataTwo; + metadataTwo.extendMeta.baseColorMeta.baseMappingFlag = ITUT35_TAG_SIZE; + metadataTwo.extendMeta.gainmapColorMeta.combineMappingFlag = ITUT35_TAG_SIZE; + ImagePlugin::HdrJpegPackerHelper::PackISOMetadataMarker(metadataTwo); + + HdrMetadata metadataThree; + metadataThree.extendMeta.baseColorMeta.baseMappingFlag = ITUT35_TAG_SIZE; + metadataThree.extendMeta.gainmapColorMeta.combineMappingFlag = ITUT35_TAG_SIZE; + sk_sp baseImageData; + sk_sp gainMapImageData; + ExtWStream extWStream(nullptr); + ImagePlugin::HdrJpegPackerHelper::SpliceHdrStream(baseImageData, gainMapImageData, extWStream, metadataThree); + + HdrMetadata metadataFour; + metadataFour.extendMeta.baseColorMeta.baseMappingFlag = ITUT35_TAG_SIZE; + metadataFour.extendMeta.gainmapColorMeta.combineMappingFlag = ITUT35_TAG_SIZE; + std::vector it35Info; + ImagePlugin::HdrHeifPackerHelper::PackIT35Info(metadataFour, it35Info); +} + +void ImagePluginFuzzTest001(const uint8_t *data, size_t size) +{ + std::string filename = "/data/local/tmp/test_decode_ext.jpg"; + if (!WriteDataToFile(data, size, filename)) { + IMAGE_LOGE("WriteDataToFile failed"); + return; + } + std::vector>> testFunctions = { + {SvgDecoderFuncTest001, {SVG_PATH1, SVG_PATH2, filename}}, + {JpegHardwareTest001, {JPEG_HW_PATH, filename}}, + {JpegSoftTest001, {JPEG_SW_PATH, filename}}, + {HeifHardwareTest001, {HEIF_HW_PATH, filename}}, + {GifTest001, {GIF_PATH, WEBP_PATH, filename}}, + {HdrTest001, {HDR_PATH, HDR_PATH2, HDR_PATH3, HDR_PATH4, HDR_PATH5, filename}}, + {ExtDecoderRegionFuncTest001, {filename}}}; + uint8_t functionIndex = FDP->ConsumeIntegral() % testFunctions.size(); + uint8_t parmIndex = FDP->ConsumeIntegral() % testFunctions[functionIndex].second.size(); + auto function = testFunctions[functionIndex].first; + std::string param = testFunctions[functionIndex].second[parmIndex]; + function(param); +} +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + FuzzedDataProvider fdp(data, size); + OHOS::Media::FDP = &fdp; + uint8_t action = fdp.ConsumeBool(); + switch (action) { + case 0: + OHOS::Media::ImagePluginFuzzTest001(data, size); + break; + default: + OHOS::Media::HdrHelperFucTest(); + break; + } + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/BUILD.gn new file mode 100644 index 000000000..e76a9b13a --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/BUILD.gn @@ -0,0 +1,45 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("ImagePngPlugin2FuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer" + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + "$image_subsystem/plugins/common/libs/image/libpngplugin/include", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_png_plugin_fuzz.cpp", + ] + + deps = [ + "$image_subsystem/frameworks/innerkitsimpl/utils:image_utils", + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/plugins/common/libs/image/libpngplugin:pngplugin", + ] + + external_deps = [ + "c_utils:utils", + "graphic_2d:color_manager", + "hilog:libhilog", + "libpng:libpng", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/corpus/init b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/corpus/init new file mode 100644 index 000000000..8920b50aa --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/include/image_png_plugin_fuzz.h b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/include/image_png_plugin_fuzz.h new file mode 100644 index 000000000..d12f6e36d --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/include/image_png_plugin_fuzz.h @@ -0,0 +1,19 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef IMAGE_PNG_PLUGIN_FUZZE_H +#define IMAGE_PNG_PLUGIN_FUZZE_H + +#define FUZZ_PROJECT_NAME "imagepngplugin_fuzzer" +#endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/project.xml new file mode 100644 index 000000000..732603b22 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/src/image_png_plugin_fuzz.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/src/image_png_plugin_fuzz.cpp new file mode 100644 index 000000000..6b5b9992a --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin2_fuzzer/src/image_png_plugin_fuzz.cpp @@ -0,0 +1,166 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include "image_png_plugin_fuzz.h" + +#define private public +#include +#include +#include +#include + +#include "common_fuzztest_function.h" +#include "image_source.h" +#include "png_decoder.h" +#include "nine_patch_listener.h" +#include "image_log.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "PNG_PLUGIN_FUZZ" + +constexpr uint32_t OPT_SIZE = 40; +namespace OHOS { +namespace Media { +FuzzedDataProvider *FDP; +const std::string NINE_PATCH = "ninepatch"; +using namespace OHOS::ImagePlugin; + +void DoPrivateFun(PngDecoder *pngDecoder) +{ + IMAGE_LOGI("%{public}s IN", __func__); + DecodeContext context; + pngDecoder->AllocOutputBuffer(context); + uint32_t num; + pngDecoder->GetTopLevelImageNum(num); + png_structp pngPtr = nullptr; + png_const_charp message; + pngDecoder->PngWarning(pngPtr, message); + pngDecoder->PngWarningMessage(pngPtr, message); + pngDecoder->PngErrorMessage(pngPtr, message); + png_bytep row = nullptr; + png_uint_32 rowNum = 0; + int pass = 0; + pngDecoder->GetAllRows(pngPtr, row, rowNum, pass); + pngDecoder->GetInterlacedRows(pngPtr, row, rowNum, pass); + png_structp png_ptr = nullptr; + png_unknown_chunkp chunk = nullptr; + pngDecoder->ReadUserChunk(png_ptr, chunk); + rowNum = 1; + pngDecoder->SaveRows(const_cast(new uint8_t), rowNum); + pngDecoder->SaveInterlacedRows(const_cast(new uint8_t), rowNum, pass); + PngImageInfo info; + pngDecoder->ReadIncrementalHead(nullptr, info); + png_byte chunkData[] = {0, 0, 0, 0, 'I', 'D', 'A', 'T'}; + pngDecoder->IsChunk(const_cast(&chunkData[0]), "IDAT"); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void PngDecoderFuncTest001(const std::string &filename) +{ + IMAGE_LOGI("%{public}s IN", __func__); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(filename, srcOpts, errorCode); + if (imageSource == nullptr) { + return; + } + imageSource->sourceInfo_.encodedFormat = "image/png"; + auto pngDecoder = static_cast(imageSource->CreateDecoder(errorCode)); + if (pngDecoder == nullptr) { + return; + } + pngDecoder->HasProperty(NINE_PATCH); + if (SUCCESS != pngDecoder->DecodeHeader()) { + IMAGE_LOGI("%{public}s png DecodeHeader failed", __func__); + delete pngDecoder; + pngDecoder = nullptr; + return; + } + PixelDecodeOptions plOpts; + SetFDPPixelDecodeOptions(FDP, plOpts); + + PlImageInfo plInfo; + pngDecoder->SetDecodeOptions(0, plOpts, plInfo); + DecodeContext context; + if (pngDecoder->Decode(0, context) != SUCCESS) { + pngDecoder->Reset(); + delete pngDecoder; + pngDecoder = nullptr; + return; + } + Size size; + pngDecoder->GetImageSize(0, size); + DoPrivateFun(pngDecoder); + ProgDecodeContext progContext; + pngDecoder->PromoteIncrementalDecode(0, progContext); + pngDecoder->SetSource(*(pngDecoder->inputStreamPtr_)); + pngDecoder->Reset(); + delete pngDecoder; + pngDecoder = nullptr; + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void CreateImageSourceByFDFuzz001(const uint8_t *data, size_t size) +{ + std::string filename = "/data/local/tmp/test_decode_png.png"; + if (!WriteDataToFile(data, size, filename)) { + IMAGE_LOGE("WriteDataToFile failed"); + return; + } + PngDecoderFuncTest001(filename); +} + +void CreateImageSourceByNinePatchFuzz001(const uint8_t *data, size_t size) +{ + if (data == nullptr || size == 0) { + return; + } + NinePatchListener ninepath; + const std::string tag = "npTc"; + ninepath.ReadChunk(tag, reinterpret_cast(const_cast(data)), size); + + float scaleX = FDP->ConsumeFloatingPoint(); + float scaleY = FDP->ConsumeFloatingPoint(); + int32_t scaledWidth = FDP->ConsumeIntegral(); + int32_t scaledHeight = FDP->ConsumeIntegral(); + ninepath.Scale(scaleX, scaleY, scaledWidth, scaledHeight); +} + +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + if (size < OPT_SIZE) { + return -1; + } + FuzzedDataProvider fdp(data + size - OPT_SIZE, OPT_SIZE); + OHOS::Media::FDP = &fdp; + uint8_t action = fdp.ConsumeBool(); + switch (action) { + case 0: + OHOS::Media::CreateImageSourceByFDFuzz001(data, size); + break; + default: + OHOS::Media::CreateImageSourceByNinePatchFuzz001(data, size); + break; + } + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin_fuzzer/src/image_png_plugin_fuzz.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin_fuzzer/src/image_png_plugin_fuzz.cpp index a13aa2994..17796c2e0 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin_fuzzer/src/image_png_plugin_fuzz.cpp +++ b/frameworks/innerkitsimpl/test/fuzztest/imagepngplugin_fuzzer/src/image_png_plugin_fuzz.cpp @@ -84,6 +84,8 @@ void PngDecoderFuncTest001(const std::string& filename) pngDecoder->HasProperty(NINE_PATCH); if (SUCCESS != pngDecoder->DecodeHeader()) { IMAGE_LOGI("%{public}s png DecodeHeader failed", __func__); + delete pngDecoder; + pngDecoder = nullptr; return; } PixelDecodeOptions plOpts; diff --git a/test/resource/image/ohos_test.xml b/test/resource/image/ohos_test.xml index 16e2d8f8f..d40e33fa1 100644 --- a/test/resource/image/ohos_test.xml +++ b/test/resource/image/ohos_test.xml @@ -503,4 +503,29 @@