From 564be07e4ee2d449435dcbff3a187de584c5d01f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=BC=A0=E6=99=BA=E5=8B=87?= Date: Wed, 6 Aug 2025 20:32:57 +0800 Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E5=85=85fuzz=E7=94=A8=E4=BE=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 张智勇 --- .../{include => }/BUILD.gn | 2 +- ...er.h => image_fwk_decode_picture_fuzzer.h} | 6 +- .../imagefwkdecodepicture2_fuzzer/project.xml | 25 ++ .../src/image_fwk_decode_picture_fuzzer.cpp | 259 ++++++++++++++++ .../imagefwkdecodepicture_fuzzer/BUILD.gn | 12 +- .../src/image_fwk_decode_picture_fuzzer.cpp | 293 +++++++++++------- .../imagefwkdecodepng2_fuzzer/BUILD.gn | 45 +++ ...fuzzer.h => image_fwk_decode_png_fuzzer.h} | 4 +- .../imagefwkdecodepng2_fuzzer/project.xml | 25 ++ .../src/image_fwk_decode_png_fuzzer.cpp | 116 +++++++ .../imagefwkdecodepng_fuzzer/BUILD.gn | 45 +++ ...fuzzer.h => image_fwk_decode_png_fuzzer.h} | 6 +- .../imagefwkdecodepng_fuzzer/project.xml | 25 ++ .../src/image_fwk_decode_png_fuzzer.cpp | 143 +++++++++ .../imagefwkdecodesvg2_fuzzer/BUILD.gn | 63 ++++ ...fuzzer.h => image_fwk_decode_svg_fuzzer.h} | 2 +- .../imagefwkdecodesvg2_fuzzer/project.xml | 25 ++ .../src/image_fwk_decode_svg_fuzzer.cpp | 143 +++++++++ .../imagefwkdecodesvg_fuzzer/BUILD.gn | 62 ++++ ...fuzzer.h => image_fwk_decode_svg_fuzzer.h} | 2 +- .../imagefwkdecodesvg_fuzzer/project.xml | 25 ++ .../src/image_fwk_decode_svg_fuzzer.cpp | 94 ++++++ .../imagefwkencodeext2_fuzzer/BUILD.gn | 72 +++++ .../imagefwkencodeext2_fuzzer/project.xml | 25 ++ .../src/image_fwk_decode_ext_fuzzer.cpp | 110 +++++++ .../imagefwkencodegif2_fuzzer/BUILD.gn | 66 ++++ .../imagefwkencodegif2_fuzzer/project.xml | 25 ++ .../src/image_fwk_decode_gif_fuzzer.cpp | 105 +++++++ .../imagefwkencodejpeg2_fuzzer/BUILD.gn | 64 ++++ .../imagefwkencodejpeg2_fuzzer/project.xml | 25 ++ .../src/image_fwk_decode_jpeg_fuzzer.cpp | 99 ++++++ 31 files changed, 1887 insertions(+), 126 deletions(-) rename frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/{include => }/BUILD.gn (99%) rename frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/{image_fwk_docode_picture_fuzzer.h => image_fwk_decode_picture_fuzzer.h} (82%) create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/src/image_fwk_decode_picture_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/BUILD.gn rename frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/include/{image_fwk_docode_png_fuzzer.h => image_fwk_decode_png_fuzzer.h} (90%) create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/src/image_fwk_decode_png_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/BUILD.gn rename frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/include/{image_fwk_docode_png_fuzzer.h => image_fwk_decode_png_fuzzer.h} (83%) create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/src/image_fwk_decode_png_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/BUILD.gn rename frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/include/{image_fwk_docode_svg_fuzzer.h => image_fwk_decode_svg_fuzzer.h} (93%) create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/src/image_fwk_decode_svg_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/BUILD.gn rename frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/include/{image_fwk_docode_svg_fuzzer.h => image_fwk_decode_svg_fuzzer.h} (93%) create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/src/image_fwk_decode_svg_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/BUILD.gn create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/src/image_fwk_decode_ext_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/BUILD.gn create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/src/image_fwk_decode_gif_fuzzer.cpp create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/BUILD.gn create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/project.xml create mode 100644 frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/src/image_fwk_decode_jpeg_fuzzer.cpp diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/BUILD.gn similarity index 99% rename from frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/BUILD.gn rename to frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/BUILD.gn index 3663fbfe1..43da81604 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/BUILD.gn +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/BUILD.gn @@ -26,7 +26,7 @@ ohos_fuzztest("Imagefwkdecodepicture2FuzzTest") { "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/include", ] - sources = [ + sources = [ "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", "src/image_fwk_decode_picture_fuzzer.cpp", ] diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/image_fwk_docode_picture_fuzzer.h b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/image_fwk_decode_picture_fuzzer.h similarity index 82% rename from frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/image_fwk_docode_picture_fuzzer.h rename to frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/image_fwk_decode_picture_fuzzer.h index a001abf9f..34b375b96 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/image_fwk_docode_picture_fuzzer.h +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/include/image_fwk_decode_picture_fuzzer.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2025 Huawei Device Co., Ltd. + * Copyright (c) 2024 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -12,8 +12,8 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -#ifndef IMAGE_FWK_DECODE_PICTURE_FUZZ_H -#define IMAGE_FWK_DECODE_PICTURE_FUZZ_H +#ifndef IMAGE_FWK_DECODE_PICTURE_FUZZER_H +#define IMAGE_FWK_DECODE_PICTURE_FUZZER_H #define FUZZ_PROJECT_NAME "image_fwk_decode_picture_fuzzer" #endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/project.xml new file mode 100644 index 000000000..32963ae67 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 8192 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/src/image_fwk_decode_picture_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/src/image_fwk_decode_picture_fuzzer.cpp new file mode 100644 index 000000000..31a9748cc --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture2_fuzzer/src/image_fwk_decode_picture_fuzzer.cpp @@ -0,0 +1,259 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include "image_fwk_decode_picture_fuzzer.h" + +#include +#include + +#include "common_fuzztest_function.h" +#include +#include "picture.h" +#include "image_type.h" +#include "image_utils.h" +#include "pixel_map.h" +#include "metadata.h" +#include "exif_metadata.h" +#include "fragment_metadata.h" +#include "media_errors.h" +#include "surface_buffer.h" +#include "surface_buffer_impl.h" +#include "tiff_parser.h" +#include "securec.h" +#include "image_source.h" +#include "image_log.h" +#include "image_packer.h" +#include "message_parcel.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "IMAGE_PICTURE_FUZZ" + +static const std::string IMAGE_DEST = "/data/local/tmp/test_out"; + +constexpr uint32_t MAX_LENGTH_MODULO = 0xfff; +constexpr uint32_t PIXELFORMAT_MODULO = 105; +constexpr uint32_t ALPHATYPE_MODULO = 4; +constexpr uint32_t SCALEMODE_MODULO = 2; +constexpr uint32_t AUXILLIARYMODE_MODULO = 6; +constexpr uint32_t MIMTTYPE_MODULO = 14; +constexpr uint32_t OPT_SIZE = 785; + +namespace OHOS { +namespace Media { +FuzzedDataProvider* FDP; + +void AuxiliaryPictureFuncTest(std::shared_ptr auxPicture) +{ + AuxiliaryPictureType type = auxPicture->GetType(); + auxPicture->SetType(type); + Size size = auxPicture->GetSize(); + auxPicture->SetSize(size); + std::shared_ptr pixelMap = auxPicture->GetContentPixel(); + if (pixelMap == nullptr) { + IMAGE_LOGE("%{public}s pixelMap is nullptr", __func__); + return; + } + auxPicture->SetContentPixel(pixelMap); + AuxiliaryPictureInfo pictureInfo = auxPicture->GetAuxiliaryPictureInfo(); + auxPicture->SetAuxiliaryPictureInfo(pictureInfo); + if (auxPicture->HasMetadata(MetadataType::EXIF)) { + std::shared_ptr exifMetaData = auxPicture->GetMetadata(MetadataType::EXIF); + auxPicture->SetMetadata(MetadataType::EXIF, exifMetaData); + } + if (auxPicture->HasMetadata(MetadataType::FRAGMENT)) { + std::shared_ptr exifMetaData = auxPicture->GetMetadata(MetadataType::FRAGMENT); + auxPicture->SetMetadata(MetadataType::FRAGMENT, exifMetaData); + } + uint64_t bufferSize = pixelMap->GetCapacity(); + if (bufferSize == 0) { + return; + } + std::unique_ptr dst = std::make_unique(bufferSize); + auxPicture->ReadPixels(bufferSize, dst.get()); + auxPicture->WritePixels(dst.get(), bufferSize); + +} + +static void TestAllAuxiliaryPicture(std::shared_ptr &picture) +{ + AuxiliaryPictureType type; + type = static_cast(FDP->ConsumeIntegral() % AUXILLIARYMODE_MODULO); + + std::shared_ptr auxGainPic = picture->GetAuxiliaryPicture(type); + if (auxGainPic != nullptr) { + picture->SetAuxiliaryPicture(auxGainPic); + AuxiliaryPictureFuncTest(auxGainPic); + } +} + +void EncodePictureTest(std::shared_ptr picture) +{ + if (picture == nullptr) { + IMAGE_LOGE("%{public}s picture null.", __func__); + return; + } + std::string mimeType[] = {"image/png" , "image/raw" , "image/vnd.wap.wbmp" , "image/bmp" , "image/gif" , "image/jpeg" , "image/mpo" , "image/heic" , "image/heif" , "image/x-adobe-dng" , "image/webp" , "image/tiff" , "image/x-icon" , "image/x-sony-arw"}; + + ImagePacker pack; + PackOption packOption; + packOption.format = mimeType[FDP->ConsumeIntegral() % MIMTTYPE_MODULO]; + packOption.quality = FDP->ConsumeIntegral(); + packOption.numberHint = FDP->ConsumeIntegral(); + packOption.desiredDynamicRange = static_cast(FDP->ConsumeIntegral() % ALPHATYPE_MODULO); + packOption.needsPackProperties = FDP->ConsumeBool(); + packOption.isEditScene = FDP->ConsumeBool(); + packOption.loop = FDP->ConsumeIntegral(); + uint8_t delaytimessize = FDP->ConsumeIntegral(); + std::vector delaytimes(delaytimessize); + FDP->ConsumeData(delaytimes.data(), delaytimessize*2); + packOption.delayTimes = delaytimes; + uint8_t disposalsize = FDP->ConsumeIntegral(); + packOption.disposalTypes = FDP->ConsumeBytes(disposalsize); + + if (pack.StartPacking(IMAGE_DEST, packOption) != SUCCESS) { + IMAGE_LOGE("%{public}s StartPacking failed.", __func__); + return; + } + if (pack.AddPicture(*picture) != SUCCESS) { + IMAGE_LOGE("%{public}s AddPicture failed.", __func__); + return; + } + if (pack.FinalizePacking() != SUCCESS) { + IMAGE_LOGE("%{public}s FinalizePacking failed.", __func__); + return; + } +} + +void PictureFuncTest(std::shared_ptr picture) +{ + IMAGE_LOGI("%{public}s start.", __func__); + if (picture == nullptr) { + IMAGE_LOGE("%{public}s picture is null.", __func__); + return; + } + std::shared_ptr mainPixelMap = picture->GetMainPixel(); + picture->SetMainPixel(mainPixelMap); + picture->GetGainmapPixelMap(); + TestAllAuxiliaryPicture(picture); + + std::shared_ptr exifData = picture->GetExifMetadata(); + picture->SetExifMetadata(exifData); + sptr maintenanceData = picture->GetMaintenanceData(); + picture->SetMaintenanceData(maintenanceData); + +} + +/* + * test picture IPC interface + */ +bool PictureIPCTest(const uint8_t *data, size_t size) +{ + MessageParcel parcel; + parcel.WriteBuffer(data, size); + + Media::Picture* unmarshallingPicture = Media::Picture::Unmarshalling(parcel); + if (unmarshallingPicture != nullptr) { + delete unmarshallingPicture; + unmarshallingPicture = nullptr; + } + + return true; +} + +bool PictureRandomFuzzTest() +{ + // creatye from opts + Media::InitializationOptions opts; + opts.size.width = FDP->ConsumeIntegral() % MAX_LENGTH_MODULO; + opts.size.height = FDP->ConsumeIntegral() % MAX_LENGTH_MODULO; + opts.srcPixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + opts.pixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + opts.alphaType = static_cast(FDP->ConsumeIntegral() % ALPHATYPE_MODULO); + opts.scaleMode = static_cast(FDP->ConsumeIntegral() % SCALEMODE_MODULO); + opts.editable = FDP->ConsumeBool(); + opts.useSourceIfMatch = FDP->ConsumeBool(); + int32_t pixelbytes = Media::ImageUtils::GetPixelBytes(opts.srcPixelFormat); + size_t datalength = opts.size.width * opts.size.height * pixelbytes; + std::unique_ptr colorData = std::make_unique(datalength); + if(colorData == nullptr) + return false; + FDP->ConsumeData(colorData.get(), datalength); + std::shared_ptr pixelMapFromOpts = Media::PixelMap::Create(reinterpret_cast(colorData.get()), datalength, opts); + if(pixelMapFromOpts.get() == nullptr) + return false; + + std::unique_ptr pictureFromOpts = Picture::Create(pixelMapFromOpts); + if (!pictureFromOpts) { + return false; + } + + MessageParcel parcel; + pictureFromOpts->Marshalling(parcel); + return true; +} + +bool CreatePictureByRandomImageSource(const std::string& pathName) +{ + std::string mimeType[] = {"image/jpeg" , "image/heic" , "image/heif"}; + SourceOptions opts; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % 3]; + uint32_t errorCode; + std::shared_ptr imageSource = ImageSource::CreateImageSource(pathName, opts, errorCode); + if (imageSource == nullptr) { + IMAGE_LOGE("%{public}s failed, imageSource is nullptr.", __func__); + return false; + } + DecodingOptionsForPicture pictureOpts; + pictureOpts.desireAuxiliaryPictures.insert(static_cast(FDP->ConsumeIntegral() % AUXILLIARYMODE_MODULO)); + pictureOpts.desiredPixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + + std::shared_ptr picture = imageSource->CreatePicture(pictureOpts, errorCode); + + PictureFuncTest(picture); + EncodePictureTest(picture); + + return true; +} +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + FuzzedDataProvider fdp(data, size); + OHOS::Media::FDP = &fdp; + uint8_t action = fdp.ConsumeIntegral() % 3; + switch(action){ + case 0: + OHOS::Media::PictureRandomFuzzTest(); + break; + case 1: + OHOS::Media::PictureIPCTest(data, size - 1); + break; + default: + if(size < OPT_SIZE) return -1; + FuzzedDataProvider fdp(data + size - OPT_SIZE, OPT_SIZE - 1); + OHOS::Media::FDP = &fdp; + static const std::string pathName = "/data/local/tmp/test_decode_bmp.bmp"; + WriteDataToFile(data, size - OPT_SIZE, pathName); + OHOS::Media::CreatePictureByRandomImageSource(pathName); + break; + } + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/BUILD.gn index 30f9d0cc2..93cb1e079 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/BUILD.gn +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/BUILD.gn @@ -22,16 +22,12 @@ ohos_fuzztest("ImageFwkDecodePictureFuzzTest") { include_dirs = [ "./include", "$image_subsystem/interfaces/innerkits/include", - "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/include", "$image_subsystem/plugins/common/libs/image/libextplugin/include", "$image_subsystem/plugins/common/libs/image/libextplugin/include/heif_impl", ] - sources = [ - "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", - "src/image_fwk_decode_picture_fuzzer.cpp", - ] + sources = [ "src/image_fwk_decode_picture_fuzzer.cpp" ] deps = [ "$image_subsystem/frameworks/innerkitsimpl/utils:image_utils", @@ -42,11 +38,11 @@ ohos_fuzztest("ImageFwkDecodePictureFuzzTest") { external_deps = [ "c_utils:utils", + "drivers_interface_codec:libcodec_proxy_4.0", "graphic_surface:surface", "hilog:libhilog", + "libexif:libexif", "ipc:ipc_core", ] - if (enable_libexif) { - external_deps += [ "libexif:libexif" ] - } + } diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/src/image_fwk_decode_picture_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/src/image_fwk_decode_picture_fuzzer.cpp index f06d6e355..faadb14bc 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/src/image_fwk_decode_picture_fuzzer.cpp +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepicture_fuzzer/src/image_fwk_decode_picture_fuzzer.cpp @@ -12,9 +12,8 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -#include + #include "image_fwk_decode_picture_fuzzer.h" -#include "common_fuzztest_function.h" #include #include @@ -48,23 +47,109 @@ #undef LOG_TAG #define LOG_TAG "IMAGE_PICTURE_FUZZ" -static const std::string IMAGE_DEST = "/data/local/tmp/test_out.dat"; -static constexpr uint32_t SIZE_WIDTH = 3072; -static constexpr uint32_t SIZE_HEIGHT = 4096; -static constexpr uint32_t MAX_LENGTH_MODULO = 0xfff; -static constexpr uint32_t PIXELFORMAT_MODULO = 105; -static constexpr uint32_t ALPHATYPE_MODULO = 4; -static constexpr uint32_t SCALEMODE_MODULO = 2; -static constexpr uint32_t AUXILIARYMODE_MODULO = 6; -static constexpr uint32_t MIMETYPE_MODULO = 14; -static constexpr uint32_t OPT_SIZE = 785; -static constexpr uint32_t DELAY_TIMES_SIZE = 2; -static constexpr uint32_t IMAGE_SOURCE_MIMETYPE_MODULO = 3; +static const std::string IMAGE_JPEG_DEST = "/data/local/tmp/test_jpeg_out.jpg"; +static const std::string IMAGE_HEIF_DEST = "/data/local/tmp/test_heif_out.heic"; +static const std::string JPEG_FORMAT = "image/jpeg"; +static const std::string HEIF_FORMAT = "image/heif"; +static const std::string IMAGE_ENCODE_DEST = "/data/local/tmp/test_out.dat"; +static const uint32_t WIDTH_FACTOR = 4; +static const uint32_t SIZE_WIDTH = 3072; +static const uint32_t SIZE_HEIGHT = 4096; +static const int32_t MAX_WIDTH = 4096; +static const int32_t MAX_HEIGHT = 4096; namespace OHOS { namespace Media { using namespace OHOS::ImagePlugin; -FuzzedDataProvider* FDP; + +namespace { + const uint8_t* g_data = nullptr; + size_t g_size = 0; + size_t g_pos = 0; +} // namespace +/* + *describe: get data from outside untrusted data(g_data) which size is according to sizeof(T) + * tips: only support basic type + */ +template +T GetData() +{ + T object {}; + size_t objectsize = sizeof(object); + if (g_data == nullptr || objectsize > g_size - g_pos) { + return object; + } + errno_t ret = memcpy_s(&object, objectsize, g_data + g_pos, objectsize); + if (ret != EOK) { + return {}; + } + g_pos += objectsize; + return object; +} +/* + *get parcel from g_data + */ +bool ChangeParcel(Parcel &parcel) +{ + if (!parcel.WriteBuffer(g_data, g_size)) { + return false; + } + return true; +} +/* + *get a pixelmap from opts + */ +std::unique_ptr GetPixelMapFromOpts(Media::PixelFormat pixelFormat = PixelFormat::UNKNOWN) +{ + int32_t width = GetData(); + int32_t height = GetData(); + if (width <= 0 || width > MAX_WIDTH) { + return nullptr; + } + if (height <= 0 || height > MAX_HEIGHT) { + return nullptr; + } + Media::InitializationOptions opts; + opts.size.width = width; + opts.size.height = height; + opts.pixelFormat = pixelFormat == PixelFormat::UNKNOWN ? + static_cast(GetData()) : pixelFormat; + opts.alphaType = static_cast(GetData()); + opts.scaleMode = static_cast(GetData()); + opts.editable = GetData(); + opts.useSourceIfMatch = GetData(); + return Media::PixelMap::Create(opts); +} + +/* + * get a pixelmap from g_data + */ +std::unique_ptr GetPixelMapFromData(Media::PixelFormat pixelFormat = PixelFormat::UNKNOWN) +{ + int32_t width = GetData(); + int32_t height = GetData(); + if (width <= 0 || width > MAX_WIDTH) { + return nullptr; + } + if (height <= 0 || height > MAX_HEIGHT) { + return nullptr; + } + Media::InitializationOptions opts; + opts.size.width = width; + opts.size.height = height; + opts.pixelFormat = pixelFormat == PixelFormat::UNKNOWN ? + static_cast(GetData()) : pixelFormat; + opts.alphaType = static_cast(GetData()); + opts.scaleMode = static_cast(GetData()); + opts.editable = GetData(); + opts.useSourceIfMatch = GetData(); + size_t datalength = width * height * WIDTH_FACTOR; + std::unique_ptr colorData = std::make_unique(datalength); + for (size_t i = 0; i < datalength; i++) { + colorData[i] = GetData(); + } + return Media::PixelMap::Create(colorData.get(), datalength, opts); +} void AuxiliaryPictureFuncTest(std::shared_ptr auxPicture) { @@ -115,44 +200,52 @@ void AuxiliaryPictureFuncTest(std::shared_ptr auxPicture) static void TestAllAuxiliaryPicture(std::shared_ptr &picture) { IMAGE_LOGI("%{public}s start.", __func__); - AuxiliaryPictureType type = - static_cast(FDP->ConsumeIntegral() % AUXILIARYMODE_MODULO); - std::shared_ptr auxPicture = picture->GetAuxiliaryPicture(type); - if (auxPicture != nullptr) { - IMAGE_LOGI("Picture has %{public}d auxiliaryPicture.", static_cast(type)); - picture->SetAuxiliaryPicture(auxPicture); - AuxiliaryPictureFuncTest(auxPicture); + std::shared_ptr auxGainPic = picture->GetAuxiliaryPicture(AuxiliaryPictureType::GAINMAP); + if (auxGainPic != nullptr) { + IMAGE_LOGI("Picture has GAINMAP auxiliaryPicture."); + picture->SetAuxiliaryPicture(auxGainPic); + AuxiliaryPictureFuncTest(auxGainPic); + } + std::shared_ptr auxDepthPic = picture->GetAuxiliaryPicture(AuxiliaryPictureType::DEPTH_MAP); + if (auxDepthPic != nullptr) { + IMAGE_LOGI("Picture has DEPTH_MAP auxiliaryPicture."); + picture->SetAuxiliaryPicture(auxDepthPic); + AuxiliaryPictureFuncTest(auxDepthPic); + } + std::shared_ptr auxUnrefocusPic = + picture->GetAuxiliaryPicture(AuxiliaryPictureType::UNREFOCUS_MAP); + if (auxUnrefocusPic != nullptr) { + IMAGE_LOGI("Picture has UNREFOCUS_MAP auxiliaryPicture."); + picture->SetAuxiliaryPicture(auxUnrefocusPic); + AuxiliaryPictureFuncTest(auxUnrefocusPic); + } + std::shared_ptr auxLinearPic = picture->GetAuxiliaryPicture(AuxiliaryPictureType::LINEAR_MAP); + if (auxLinearPic != nullptr) { + IMAGE_LOGI("Picture has LINEAR_MAP auxiliaryPicture."); + picture->SetAuxiliaryPicture(auxLinearPic); + AuxiliaryPictureFuncTest(auxLinearPic); + } + std::shared_ptr auxFramentPic = picture->GetAuxiliaryPicture(AuxiliaryPictureType::FRAGMENT_MAP); + if (auxFramentPic != nullptr) { + IMAGE_LOGI("Picture has FRAGMENT _MAP auxiliaryPicture."); + picture->SetAuxiliaryPicture(auxFramentPic); + AuxiliaryPictureFuncTest(auxFramentPic); } IMAGE_LOGI("%{public}s SUCCESS.", __func__); } -static void EncodePictureTest(std::shared_ptr picture) +static void EncodePictureTest(std::shared_ptr picture, const std::string& format, + const std::string& outputPath) { IMAGE_LOGI("%{public}s start.", __func__); if (picture == nullptr) { IMAGE_LOGE("%{public}s picture null.", __func__); return; } - std::string mimeType[] = {"image/png", "image/raw", "image/vnd.wap.wbmp", "image/bmp", "image/gif", "image/jpeg", - "image/mpo", "image/heic", "image/heif", "image/x-adobe-dng", "image/webp", "image/tiff", "image/x-icon", - "image/x-sony-arw"}; ImagePacker pack; - PackOption packOption; - packOption.format = mimeType[FDP->ConsumeIntegral() % MIMETYPE_MODULO]; - packOption.quality = FDP->ConsumeIntegral(); - packOption.numberHint = FDP->ConsumeIntegral(); - packOption.desiredDynamicRange = - static_cast(FDP->ConsumeIntegral() % ALPHATYPE_MODULO); - packOption.needsPackProperties = FDP->ConsumeBool(); - packOption.isEditScene = FDP->ConsumeBool(); - packOption.loop = FDP->ConsumeIntegral(); - uint8_t delayTimesSize = FDP->ConsumeIntegral(); - std::vector delayTimes(delayTimesSize); - FDP->ConsumeData(delayTimes.data(), delayTimesSize * DELAY_TIMES_SIZE); - packOption.delayTimes = delayTimes; - uint8_t disposalSize = FDP->ConsumeIntegral(); - packOption.disposalTypes = FDP->ConsumeBytes(disposalSize); - if (pack.StartPacking(IMAGE_DEST, packOption) != SUCCESS) { + PackOption packoption; + packoption.format = format; + if (pack.StartPacking(outputPath, packoption) != SUCCESS) { IMAGE_LOGE("%{public}s StartPacking failed.", __func__); return; } @@ -197,53 +290,60 @@ void PictureFuncTest(std::shared_ptr picture) /* *test picture IPc interface */ -bool PictureIPCTest(const uint8_t *data, size_t size) +bool PictureIPCTest(std::unique_ptr &picture) { - if (data == nullptr) { - IMAGE_LOGE("%{public}s data is nullptr.", __func__); + if (picture == nullptr) { + IMAGE_LOGE("%{public}s picture is nullptr.", __func__); return false; } //test parcel picture MessageParcel parcel; - parcel.WriteBuffer(data, size); - Media::Picture* unmarshallingPicture = Media::Picture::Unmarshalling(parcel); - if (unmarshallingPicture != nullptr) { - delete unmarshallingPicture; - unmarshallingPicture = nullptr; + if (picture->Marshalling(parcel)) { + ChangeParcel(parcel); + Media::Picture* unmarshallingPicture = Media::Picture::Unmarshalling(parcel); + if (unmarshallingPicture != nullptr) { + delete unmarshallingPicture; + unmarshallingPicture = nullptr; + } else { + IMAGE_LOGE("%{public}s Unmarshalling falied.", __func__); + } + } else { + IMAGE_LOGE("%{public}s Marshalling falied.", __func__); } return true; } -bool PictureRandomFuzzTest() +bool PictureRandomFuzzTest(const uint8_t* data, size_t size) { IMAGE_LOGI("%{public}s start.", __func__); - Media::InitializationOptions opts; - opts.size.width = FDP->ConsumeIntegral() % MAX_LENGTH_MODULO; - opts.size.height = FDP->ConsumeIntegral() % MAX_LENGTH_MODULO; - opts.srcPixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); - opts.pixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); - opts.alphaType = static_cast(FDP->ConsumeIntegral() % ALPHATYPE_MODULO); - opts.scaleMode = static_cast(FDP->ConsumeIntegral() % SCALEMODE_MODULO); - opts.editable = FDP->ConsumeBool(); - opts.useSourceIfMatch = FDP->ConsumeBool(); - int32_t pixelBytes = Media::ImageUtils::GetPixelBytes(opts.srcPixelFormat); - size_t dataLength = opts.size.width * opts.size.height * pixelBytes; - std::unique_ptr colorData = std::make_unique(dataLength); - if (colorData == nullptr) { - return false; + if (data == nullptr) { + return false; } - FDP->ConsumeData(colorData.get(), dataLength); - std::shared_ptr pixelMapFromOpts = Media::PixelMap::Create(reinterpret_cast(colorData.get()), - dataLength, opts); - if (pixelMapFromOpts.get() == nullptr) { + //initialize + g_data = data; + g_size = size; + g_pos = 0; + // create from opts + std::shared_ptr pixelMapFromOpts = GetPixelMapFromOpts(Media::PixelFormat::RGBA_8888); + if (!pixelMapFromOpts) { return false; } std::unique_ptr pictureFromOpts = Picture::Create(pixelMapFromOpts); - if (pictureFromOpts.get() == nullptr) { + if (!pictureFromOpts) { return false; } - MessageParcel parcel; - pictureFromOpts->Marshalling(parcel); + //create from data + std::shared_ptr pixelMapFromData = GetPixelMapFromData(Media::PixelFormat::RGBA_8888); + if (!pixelMapFromData) { + return false; + } + std::unique_ptr pictureFromData = Picture::Create(pixelMapFromData); + if (!pictureFromData) { + return false; + } + PictureIPCTest(pictureFromOpts); + PictureIPCTest(pictureFromData); + IMAGE_LOGI("%{public}s SUCCESS.", __func__); return true; } @@ -253,7 +353,7 @@ bool CreatePictureByRandomImageSource(const uint8_t *data, size_t size, const st BufferRequestConfig requestConfig = { .width = SIZE_WIDTH, .height = SIZE_HEIGHT, - .strideAlignment = 0x8, // set 0x8 as default value to alloc SurfaceBufferImpl + .strideAlignment = 0x8, // set Ox8 as default value to alloc SurfaceBufferImpl .format = GRAPHIC_PIXEL_FMT_YCRCB_420_SP, // hardware decode only support rgba8888 .usage = BUFFER_USAGE_CPU_READ | BUFFER_USAGE_CPU_WRITE | BUFFER_USAGE_MEM_DMA | BUFFER_USAGE_MEM_MMZ_CACHE, .timeout = 0, @@ -261,13 +361,9 @@ bool CreatePictureByRandomImageSource(const uint8_t *data, size_t size, const st .transform = GraphicTransformType::GRAPHIC_ROTATE_NONE, }; sptr sb = SurfaceBuffer::Create(); - if (sb != nullptr) { - sb->Alloc(requestConfig); - Picture::Create(sb); - } - std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + sb->Alloc(requestConfig); + Picture::Create(sb); SourceOptions opts; - opts.formatHint = mimeType[FDP->ConsumeIntegral() % IMAGE_SOURCE_MIMETYPE_MODULO]; uint32_t errorCode; std::shared_ptr imageSource = nullptr; if (pathName != "") { @@ -280,13 +376,15 @@ bool CreatePictureByRandomImageSource(const uint8_t *data, size_t size, const st return false; } DecodingOptionsForPicture pictureOpts; - pictureOpts.desireAuxiliaryPictures.insert(static_cast( - FDP->ConsumeIntegral()% AUXILIARYMODE_MODULO)); - pictureOpts.desiredPixelFormat = static_cast(FDP->ConsumeIntegral() % - PIXELFORMAT_MODULO); std::shared_ptr picture = imageSource->CreatePicture(pictureOpts, errorCode); PictureFuncTest(picture); - EncodePictureTest(picture); + EncodePictureTest(picture, JPEG_FORMAT, IMAGE_JPEG_DEST); + EncodePictureTest(picture, HEIF_FORMAT, IMAGE_HEIF_DEST); + pictureOpts.desiredPixelFormat = PixelFormat::NV21; + picture = imageSource->CreatePicture(pictureOpts, errorCode); + PictureFuncTest(picture); + EncodePictureTest(picture, JPEG_FORMAT, IMAGE_JPEG_DEST); + EncodePictureTest(picture, HEIF_FORMAT, IMAGE_HEIF_DEST); IMAGE_LOGI("%{public}s SUCCESS.", __func__); return true; } @@ -306,7 +404,7 @@ void HeifDecodeFuzz(const uint8_t *data, size_t size, const std::string& pathNam if (imageSource == nullptr) { return; } - auto extStream = std::make_unique(); + auto extStream = std::make_unique; if (extStream == nullptr) { return; } @@ -333,31 +431,12 @@ void HeifDecodeFuzz(const uint8_t *data, size_t size, const std::string& pathNam extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /*Run your code on data */ - FuzzedDataProvider fdp(data, size); - OHOS::Media::FDP = &fdp; - std::string pathName = "/data/local/tmp/test_jpeg.jpg"; + OHOS::Media::PictureRandomFuzzTest(data, size); + std::string pathName = "/data/local/tmp/test_jpeg·jpg"; + OHOS::Media::HeifDecodeFuzz(data, size, pathName); OHOS::Media::CreatePictureByRandomImageSource(data, size, pathName); pathName = "/data/local/tmp/test_heif.heic"; OHOS::Media::HeifDecodeFuzz(data, size, pathName); OHOS::Media::CreatePictureByRandomImageSource(data, size, pathName); - uint8_t action = fdp.ConsumeIntegral() % 3; - switch (action) { - case 0: - OHOS::Media::PictureRandomFuzzTest(); - break; - case 1: - OHOS::Media::PictureIPCTest(data, size - 1); - break; - default: - if (size < OPT_SIZE) { - return -1; - } - FuzzedDataProvider fdp(data + size - OPT_SIZE, OPT_SIZE - 1); - OHOS::Media::FDP = &fdp; - std::string path = "/data/local/tmp/test_picture_fuzz.jpg"; - WriteDataToFile(data, size - OPT_SIZE, path); - OHOS::Media::CreatePictureByRandomImageSource(data, size, path); - break; - } return 0; } \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/BUILD.gn new file mode 100644 index 000000000..74247e0fa --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/BUILD.gn @@ -0,0 +1,45 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("ImageFwkDecodePng2FuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer" + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + "$image_subsystem/plugins/common/libs/image/libpngplugin/include", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_fwk_decode_png_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/frameworks/innerkitsimpl/utils:image_utils", + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/plugins/common/libs/image/libpngplugin:pngplugin", + ] + + external_deps = [ + "c_utils:utils", + "graphic_2d:color_manager", + "hilog:libhilog", + "libpng:libpng", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/include/image_fwk_docode_png_fuzzer.h b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/include/image_fwk_decode_png_fuzzer.h similarity index 90% rename from frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/include/image_fwk_docode_png_fuzzer.h rename to frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/include/image_fwk_decode_png_fuzzer.h index dbca20b3e..870546dfe 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/include/image_fwk_docode_png_fuzzer.h +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/include/image_fwk_decode_png_fuzzer.h @@ -12,8 +12,8 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -#ifndef IMAGE_FWK_DECODE_PNG_FUZZ_H -#define IMAGE_FWK_DECODE_PNG_FUZZ_H +#ifndef IMAGE_FWK_DECODE_PNG_FUZZE_H +#define IMAGE_FWK_DECODE_PNG_FUZZE_H #define FUZZ_PROJECT_NAME "image_fwk_decode_png_fuzzer" #endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/project.xml new file mode 100644 index 000000000..138c61f16 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/src/image_fwk_decode_png_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/src/image_fwk_decode_png_fuzzer.cpp new file mode 100644 index 000000000..04ab6c214 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng2_fuzzer/src/image_fwk_decode_png_fuzzer.cpp @@ -0,0 +1,116 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "image_fwk_decode_png_fuzzer.h" + +#define private public +#include +#include +#include +#include + +#include "common_fuzztest_function.h" +#include "image_source.h" +#include "png_decoder.h" +#include "nine_patch_listener.h" +#include "image_log.h" +#include "file_source_stream.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "IMAGE_FWK_DECODE_PNG_FUZZER" + +namespace OHOS { +namespace Media { +using namespace OHOS::ImagePlugin; +FuzzedDataProvider* FDP; + +const std::string NINE_PATCH = "ninepatch"; +constexpr uint32_t OPT_SIZE = 40; +constexpr uint32_t SOURCEOPTIONS_MIMETYPE_MODULO = 3; + +void PngDecoderFuncTest001(const std::string& pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + Media::SourceOptions opts; + std::string mimeType[] = {"image/jpeg", "image/heic", "image/heif"}; + opts.formatHint = mimeType[FDP->ConsumeIntegral() % SOURCEOPTIONS_MIMETYPE_MODULO]; + uint32_t errorCode; + std::shared_ptr imageSource = ImageSource::CreateImageSource(pathName, opts, errorCode); + if (imageSource == nullptr) { + IMAGE_LOGE("%{public}s failed, imageSource is nullptr.", __func__); + return; + } + DecodeOptions dstOpts; + SetFdpDecodeOptions(FDP, dstOpts); + imageSource->CreatePixelMap(0, dstOpts, errorCode); + std::shared_ptr pngDecoder = std::make_shared(); + SourceStream* sourceStreamPtr = (imageSource->sourceStreamPtr_).get(); + pngDecoder->SetSource(*sourceStreamPtr); + pngDecoder->HasProperty(NINE_PATCH); + PixelDecodeOptions plOpts; + SetFdpPixelDecodeOptions(FDP, plOpts); + PlImageInfo plInfo; + pngDecoder->SetDecodeOptions(0, plOpts, plInfo); + DecodeContext context; + if (pngDecoder->Decode(0, context) != SUCCESS) { + pngDecoder->Reset(); + return; + } + Size size; + pngDecoder->GetImageSize(0, size); + ProgDecodeContext progContext; + pngDecoder->PromoteIncrementalDecode(0, progContext); + pngDecoder->SetSource(*(pngDecoder->inputStreamPtr_)); + pngDecoder->Reset(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void CreateImageSourceByNinePatchFuzz001(const uint8_t *data, size_t size) +{ + if (data == nullptr || size == 0) { + return; + } + NinePatchListener ninepath; + const std::string tag = "npTc"; + ninepath.ReadChunk(tag, reinterpret_cast(const_cast(data)), size); + + float scaleX = FDP->ConsumeFloatingPoint(); + float scaleY = FDP->ConsumeFloatingPoint(); + int32_t scaledWidth = FDP->ConsumeIntegral(); + int32_t scaledHeight = FDP->ConsumeIntegral(); + ninepath.Scale(scaleX, scaleY, scaledWidth, scaledHeight); +} + +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + if (size < OHOS::Media::OPT_SIZE) { + return -1; + } + FuzzedDataProvider fdp(data + size - OHOS::Media::OPT_SIZE, OHOS::Media::OPT_SIZE); + OHOS::Media::FDP = &fdp; + static const std::string pathName = "/data/local/tmp/test_decoder_png.png"; + WriteDataToFile(data, size - OHOS::Media::OPT_SIZE, pathName); + OHOS::Media::PngDecoderFuncTest001(pathName); + OHOS::Media::CreateImageSourceByNinePatchFuzz001(data, size); + return 0; +} \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/BUILD.gn new file mode 100644 index 000000000..2ae965662 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/BUILD.gn @@ -0,0 +1,45 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("ImageFwkDecodePngFuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer" + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + "$image_subsystem/plugins/common/libs/image/libpngplugin/include", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_fwk_decode_png_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/frameworks/innerkitsimpl/utils:image_utils", + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/plugins/common/libs/image/libpngplugin:pngplugin", + ] + + external_deps = [ + "c_utils:utils", + "graphic_2d:color_manager", + "hilog:libhilog", + "libpng:libpng", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/include/image_fwk_docode_png_fuzzer.h b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/include/image_fwk_decode_png_fuzzer.h similarity index 83% rename from frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/include/image_fwk_docode_png_fuzzer.h rename to frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/include/image_fwk_decode_png_fuzzer.h index dbca20b3e..a9a12be8b 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/include/image_fwk_docode_png_fuzzer.h +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/include/image_fwk_decode_png_fuzzer.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2025 Huawei Device Co., Ltd. + * Copyright (c) 2024 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -12,8 +12,8 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -#ifndef IMAGE_FWK_DECODE_PNG_FUZZ_H -#define IMAGE_FWK_DECODE_PNG_FUZZ_H +#ifndef IMAGE_FWK_DECODE_PNG_FUZZE_H +#define IMAGE_FWK_DECODE_PNG_FUZZE_H #define FUZZ_PROJECT_NAME "image_fwk_decode_png_fuzzer" #endif \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/project.xml new file mode 100644 index 000000000..8b63c0e57 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/src/image_fwk_decode_png_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/src/image_fwk_decode_png_fuzzer.cpp new file mode 100644 index 000000000..31678ef3e --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodepng_fuzzer/src/image_fwk_decode_png_fuzzer.cpp @@ -0,0 +1,143 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "image_fwk_decode_png_fuzzer.h" + +#define private public +#include +#include +#include +#include + +#include "common_fuzztest_function.h" +#include "image_source.h" +#include "png_decoder.h" +#include "nine_patch_listener.h" +#include "image_log.h" +#include "file_source_stream.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "IMAGE_FWK_DECODE_PNG_FUZZER" + +namespace OHOS { +namespace Media { +using namespace OHOS::ImagePlugin; + +const std::string NINE_PATCH = "ninepatch"; + +void DoPrivateFun(PngDecoder* pngDecoder) +{ + IMAGE_LOGI("%{public}s IN", __func__); + DecodeContext context; + pngDecoder->AllocOutputBuffer(context); + uint32_t num; + pngDecoder->GetTopLevelImageNum(num); + png_structp pngPtr = nullptr; + png_const_charp message; + pngDecoder->PngWarning(pngPtr, message); + pngDecoder->PngWarningMessage(pngPtr, message); + pngDecoder->PngErrorMessage(pngPtr, message); + png_bytep row = nullptr; + png_uint_32 rowNum = 0; + int pass = 0; + pngDecoder->GetAllRows(pngPtr, row, rowNum, pass); + pngDecoder->GetInterlacedRows(pngPtr, row, rowNum, pass); + png_structp png_ptr = nullptr; + png_unknown_chunkp chunk = nullptr; + pngDecoder->ReadUserChunk(png_ptr, chunk); + rowNum = 1; + pngDecoder->SaveRows(const_cast(new uint8_t), rowNum); + pngDecoder->SaveInterlacedRows(const_cast(new uint8_t), rowNum, pass); + PngImageInfo info; + pngDecoder->ReadIncrementalHead(nullptr, info); + png_byte chunkData[] = { 0, 0, 0, 0, 'I', 'D', 'A', 'T' }; + pngDecoder->IsChunk(const_cast(&chunkData[0]), "IDAT"); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void PngDecoderFuncTest001(const std::string& pathName) +{ + IMAGE_LOGI("%{public}s IN", __func__); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errorCode); + if (imageSource == nullptr) { + IMAGE_LOGI("%{public}s CreateImageSource failed", __func__); + return; + } + DecodeOptions dstOpts; + imageSource->CreatePixelMap(0, dstOpts, errorCode); + std::shared_ptr pngDecoder = std::make_shared(); + SourceStream* sourceStreamPtr = (imageSource->sourceStreamPtr_).get(); + pngDecoder->SetSource(*sourceStreamPtr); + if (!pngDecoder->DecodeHeader()) { + IMAGE_LOGE("%{public}s not png", __func__); + return; + } + pngDecoder->HasProperty(NINE_PATCH); + if (SUCCESS != pngDecoder->DecodeHeader()) { + IMAGE_LOGI("%{public}s png DecodeHeader failed", __func__); + return; + } + PixelDecodeOptions plOpts; + PlImageInfo plInfo; + pngDecoder->SetDecodeOptions(0, plOpts, plInfo); + DecodeContext context; + if (pngDecoder->Decode(0, context) != SUCCESS) { + pngDecoder->Reset(); + return; + } + Size size; + pngDecoder->GetImageSize(0, size); + DoPrivateFun(pngDecoder.get()); + ProgDecodeContext progContext; + pngDecoder->PromoteIncrementalDecode(0, progContext); + pngDecoder->SetSource(*(pngDecoder->inputStreamPtr_)); + pngDecoder->Reset(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} + +void CreateImageSourceByNinePatchFuzz001(const uint8_t *data, size_t size) +{ + if (data == nullptr || size == 0) { + return; + } + NinePatchListener ninepath; + const std::string tag = "npTc"; + ninepath.ReadChunk(tag, reinterpret_cast(const_cast(data)), size); + + float scaleX = 1.0; + float scaleY = 2.0; + int32_t scaledWidth = 3; + int32_t scaledHeight = 4; + ninepath.Scale(scaleX, scaleY, scaledWidth, scaledHeight); +} + +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + OHOS::Media::CreateImageSourceByNinePatchFuzz001(data, size); + static const std::string pathName = "/data/local/tmp/test_decoder_png.png"; + WriteDataToFile(data, size, pathName); + OHOS::Media::PngDecoderFuncTest001(pathName); + return 0; +} \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/BUILD.gn new file mode 100644 index 000000000..636a94639 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/BUILD.gn @@ -0,0 +1,63 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("Imagefwkdecodesvg2FuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer" + + cflags = [ "-DIMAGE_COLORSPACE_FLAG" ] + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include/jpeg_yuv_decoder", + "$image_subsystem/plugins/common/libs/image/libsvgplugin/include", + "$image_subsystem/plugins/common/libs/image/libbmpplugin/include", + ] + + defines = [ + "JPEG_HW_DECODE_ENABLE", + "HEIF_HW_DECODE_ENABLE", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_fwk_decode_svg_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/plugins/common/libs/image/libextplugin:extplugin", + "$image_subsystem/plugins/common/libs/image/libsvgplugin:svgplugin", + "$image_subsystem/plugins/common/libs/image/libbmpplugin:bmpplugin", + ] + + external_deps = [ + "c_utils:utils", + "drivers_interface_codec:image_idl_headers", + "drivers_interface_codec:libimage_proxy_2.1", + "drivers_interface_display:display_buffer_idl_headers", + "drivers_interface_display:display_composer_idl_headers", + "drivers_interface_display:libdisplay_buffer_hdi_impl", + "drivers_interface_display:libdisplay_composer_hdi_impl", + "graphic_2d:color_manager", + "hilog:libhilog", + "libexif:libexif", + "libjpeg-turbo:turbojpeg", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/include/image_fwk_docode_svg_fuzzer.h b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/include/image_fwk_decode_svg_fuzzer.h similarity index 93% rename from frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/include/image_fwk_docode_svg_fuzzer.h rename to frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/include/image_fwk_decode_svg_fuzzer.h index 92786b48a..2a35d3f4a 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/include/image_fwk_docode_svg_fuzzer.h +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/include/image_fwk_decode_svg_fuzzer.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2025 Huawei Device Co., Ltd. + * Copyright (c) 2024 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/project.xml new file mode 100644 index 000000000..8b63c0e57 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/src/image_fwk_decode_svg_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/src/image_fwk_decode_svg_fuzzer.cpp new file mode 100644 index 000000000..095107b82 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg2_fuzzer/src/image_fwk_decode_svg_fuzzer.cpp @@ -0,0 +1,143 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include "image_fwk_decode_svg_fuzzer.h" + +#define private public +#define protected public +#include +#include +#include +#include +#include + +#include "common_fuzztest_function.h" +#include "image_source.h" +#include "svg_decoder.h" +#include "image_log.h" +#include "pixel_yuv.h" +#include "file_source_stream.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "IMAGE_FWK_DECODE_SVG_FUZZ" + +constexpr uint32_t PIXELFORMAT_MODULO = 105; +constexpr uint32_t COLORSPACE_MODULO = 17; +constexpr uint32_t DYNAMICRANGE_MODULO = 3; +constexpr uint32_t RESOLUTION_MODULO = 4; +constexpr uint32_t ALPHATYPE_MODULO = 4; +constexpr uint32_t OPT_SIZE = 110; + +namespace OHOS { +namespace Media { +FuzzedDataProvider* FDP; + +using namespace OHOS::ImagePlugin; +void SvgDecoderFuncTest001(const std::string& pathName) +{ + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errorCode); + if (imageSource == nullptr) { + IMAGE_LOGE("%{public}s CreateImageSource failed", __func__); + return; + } + + DecodeOptions dstOpts; + dstOpts.fitDensity = FDP->ConsumeIntegral(); + dstOpts.CropRect.left = FDP->ConsumeIntegral(); + dstOpts.CropRect.top = FDP->ConsumeIntegral(); + dstOpts.CropRect.width = FDP->ConsumeIntegral(); + dstOpts.CropRect.height = FDP->ConsumeIntegral(); + dstOpts.desiredSize.width = FDP->ConsumeIntegralInRange(0, 0xfff); + dstOpts.desiredSize.height = FDP->ConsumeIntegralInRange(0, 0xfff); + dstOpts.desiredRegion.left = FDP->ConsumeIntegral(); + dstOpts.desiredRegion.top = FDP->ConsumeIntegral(); + dstOpts.desiredRegion.width = FDP->ConsumeIntegral(); + dstOpts.desiredRegion.height = FDP->ConsumeIntegral(); + dstOpts.rotateDegrees = FDP->ConsumeFloatingPoint(); + dstOpts.rotateNewDegrees = FDP->ConsumeIntegral(); + dstOpts.sampleSize = FDP->ConsumeIntegral(); + dstOpts.desiredPixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + dstOpts.photoDesiredPixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + dstOpts.desiredColorSpace = static_cast(FDP->ConsumeIntegral() % COLORSPACE_MODULO); + dstOpts.allowPartialImage = FDP->ConsumeBool(); + dstOpts.editable = FDP->ConsumeBool(); + dstOpts.preference = static_cast(FDP->ConsumeBool()); + dstOpts.fastAstc = FDP->ConsumeBool(); + dstOpts.invokeType = FDP->ConsumeIntegral(); + dstOpts.desiredDynamicRange = static_cast(FDP->ConsumeIntegral() % DYNAMICRANGE_MODULO); + dstOpts.resolutionQuality = static_cast(FDP->ConsumeIntegral() % RESOLUTION_MODULO); + dstOpts.isAisr = FDP->ConsumeBool(); + dstOpts.isAppUseAllocator = FDP->ConsumeBool(); + + imageSource->CreatePixelMap(0, dstOpts, errorCode); + + std::shared_ptr svgDecoder = std::make_shared(); + SourceStream* sourceStreamPtr = (imageSource->sourceStreamPtr_).get(); + svgDecoder->SetSource(*sourceStreamPtr); + svgDecoder->DoDecodeHeader(); + + PixelDecodeOptions plOpts; + plOpts.CropRect.left = FDP->ConsumeIntegral(); + plOpts.CropRect.top = FDP->ConsumeIntegral(); + plOpts.CropRect.width = FDP->ConsumeIntegral(); + plOpts.CropRect.height = FDP->ConsumeIntegral(); + plOpts.desiredSize.width = FDP->ConsumeIntegralInRange(0, 0xfff); + plOpts.desiredSize.height = FDP->ConsumeIntegralInRange(0, 0xfff); + plOpts.rotateDegrees = FDP->ConsumeFloatingPoint(); + plOpts.sampleSize = FDP->ConsumeIntegral(); + plOpts.desiredPixelFormat = static_cast(FDP->ConsumeIntegral() % PIXELFORMAT_MODULO); + plOpts.desiredColorSpace = static_cast(FDP->ConsumeIntegral() % COLORSPACE_MODULO); + plOpts.desireAlphaType = static_cast(FDP->ConsumeIntegral() % ALPHATYPE_MODULO); + plOpts.allowPartialImage = FDP->ConsumeBool(); + plOpts.editable = FDP->ConsumeBool(); + + PlImageInfo plInfo; + svgDecoder->SetDecodeOptions(0, plOpts, plInfo); + DecodeContext context; + svgDecoder->Decode(0, context); + uint32_t num; + svgDecoder->GetTopLevelImageNum(num); + context.allocatorType = AllocatorType::SHARE_MEM_ALLOC; + svgDecoder->AllocBuffer(context); + context.allocatorType = AllocatorType::DMA_ALLOC; + svgDecoder->AllocBuffer(context); + context.allocatorType = AllocatorType::HEAP_ALLOC; + svgDecoder->AllocBuffer(context); + + Size plSize; + svgDecoder->DoGetImageSize(0, plSize); + + imageSource->Reset(); +} +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + if(size < OPT_SIZE) return -1; + FuzzedDataProvider fdp(data + size - OPT_SIZE, OPT_SIZE); + OHOS::Media::FDP = &fdp; + static const std::string pathName = "/data/local/tmp/test_decode_svg.svg"; + WriteDataToFile(data, size - OPT_SIZE, pathName); + OHOS::Media::SvgDecoderFuncTest001(pathName); + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/BUILD.gn new file mode 100644 index 000000000..02855b255 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/BUILD.gn @@ -0,0 +1,62 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("ImageFwkDecodeSvgFuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer" + + cflags = [ "-DIMAGE_COLORSPACE_FLAG" ] + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include/jpeg_yuv_decoder", + "$image_subsystem/plugins/common/libs/image/libsvgplugin/include", + "$image_subsystem/plugins/common/libs/image/libbmpplugin/include", + ] + + defines = [ + "JPEG_HW_DECODE_ENABLE", + "HEIF_HW_DECODE_ENABLE", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_fwk_decode_svg_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/plugins/common/libs/image/libextplugin:extplugin", + "$image_subsystem/plugins/common/libs/image/libsvgplugin:svgplugin", + "$image_subsystem/plugins/common/libs/image/libbmpplugin:bmpplugin", + ] + + external_deps = [ + "c_utils:utils", + "drivers_interface_codec:libimage_proxy_2.1", + "drivers_interface_display:display_buffer_idl_headers", + "drivers_interface_display:display_composer_idl_headers", + "drivers_interface_display:libdisplay_buffer_hdi_impl", + "drivers_interface_display:libdisplay_composer_hdi_impl", + "graphic_2d:color_manager", + "hilog:libhilog", + "libexif:libexif", + "libjpeg-turbo:turbojpeg", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/include/image_fwk_docode_svg_fuzzer.h b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/include/image_fwk_decode_svg_fuzzer.h similarity index 93% rename from frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/include/image_fwk_docode_svg_fuzzer.h rename to frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/include/image_fwk_decode_svg_fuzzer.h index 92786b48a..2a35d3f4a 100644 --- a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/include/image_fwk_docode_svg_fuzzer.h +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/include/image_fwk_decode_svg_fuzzer.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2025 Huawei Device Co., Ltd. + * Copyright (c) 2024 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/project.xml new file mode 100644 index 000000000..340233b8e --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 15728640 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/src/image_fwk_decode_svg_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/src/image_fwk_decode_svg_fuzzer.cpp new file mode 100644 index 000000000..db354a2ba --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkdecodesvg_fuzzer/src/image_fwk_decode_svg_fuzzer.cpp @@ -0,0 +1,94 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "image_fwk_decode_svg_fuzzer.h" + +#define private public +#define protected public +#include +#include +#include +#include +#include + +#include "common_fuzztest_function.h" +#include "image_source.h" +#include "svg_decoder.h" +#include "image_log.h" +#include "pixel_yuv.h" +#include "file_source_stream.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "IMAGE_FWK_DECODE_SVG_FUZZ" + +namespace OHOS { +namespace Media { +using namespace OHOS::ImagePlugin; +void SvgDecoderFuncTest001(const std::string& pathName) +{ + IMAGE_LOGI("%{public}s IN path: %{public}s", __func__, pathName.c_str()); + SourceOptions srcOpts; + uint32_t errorCode; + auto imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errorCode); + if (imageSource == nullptr) { + IMAGE_LOGE("%{public}s CreateImageSource failed", __func__); + return; + } + std::shared_ptr svgDecoder = std::make_shared(); + SourceStream* sourceStreamPtr = (imageSource->sourceStreamPtr_).get(); + svgDecoder->SetSource(*sourceStreamPtr); + if (!svgDecoder->DoDecodeHeader()) { + IMAGE_LOGE("%{public}s not svg", __func__); + return; + } + PixelDecodeOptions plOpts; + PlImageInfo plInfo; + svgDecoder->SetDecodeOptions(0, plOpts, plInfo); + DecodeContext context; + svgDecoder->Decode(0, context); + uint32_t num; + svgDecoder->GetTopLevelImageNum(num); + context.allocatorType = AllocatorType::SHARE_MEM_ALLOC; + svgDecoder->AllocBuffer(context); + context.allocatorType = AllocatorType::DMA_ALLOC; + svgDecoder->AllocBuffer(context); + context.allocatorType = AllocatorType::HEAP_ALLOC; + svgDecoder->AllocBuffer(context); + svgDecoder->DoSetDecodeOptions(0, plOpts, plInfo); + Size plSize; + svgDecoder->DoGetImageSize(0, plSize); + svgDecoder->DoDecode(0, context); + + DecodeOptions dstOpts; + imageSource = ImageSource::CreateImageSource(pathName, srcOpts, errorCode); + imageSource->CreatePixelMap(0, dstOpts, errorCode); + imageSource->Reset(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + static const std::string pathName = "/data/local/tmp/test_decode_svg.svg"; + WriteDataToFile(data, size, pathName); + OHOS::Media::SvgDecoderFuncTest001(pathName); + return 0; +} \ No newline at end of file diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/BUILD.gn new file mode 100644 index 000000000..4b47e5379 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/BUILD.gn @@ -0,0 +1,72 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("Imagefwkencodeext2FuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer" + + cflags = [ + "-DIMAGE_COLORSPACE_FLAG", + "-frtti" + ] + + cflags_cc = [ + "-DIMAGE_COLORSPACE_FLAG", + "-frtti" + ] + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include/jpeg_yuv_decoder", + "$image_subsystem/plugins/common/libs/image/libsvgplugin/include", + "$image_subsystem/plugins/common/libs/image/libbmpplugin/include", + ] + + defines = [ + "JPEG_HW_DECODE_ENABLE", + "HEIF_HW_DECODE_ENABLE", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_fwk_decode_ext_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/frameworks/innerkitsimpl/utils:image_utils", + "$image_subsystem/plugins/common/libs/image/libextplugin:extplugin", + "$image_subsystem/plugins/common/libs/image/libsvgplugin:svgplugin", + "$image_subsystem/plugins/common/libs/image/libbmpplugin:bmpplugin", + ] + + external_deps = [ + "c_utils:utils", + "drivers_interface_codec:image_idl_headers", + "drivers_interface_codec:libimage_proxy_2.1", + "drivers_interface_display:display_buffer_idl_headers", + "drivers_interface_display:display_composer_idl_headers", + "drivers_interface_display:libdisplay_buffer_hdi_impl", + "drivers_interface_display:libdisplay_composer_hdi_impl", + "graphic_2d:color_manager", + "hilog:libhilog", + "libexif:libexif", + "libjpeg-turbo:turbojpeg", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/project.xml new file mode 100644 index 000000000..f364c579a --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 2000 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/src/image_fwk_decode_ext_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/src/image_fwk_decode_ext_fuzzer.cpp new file mode 100644 index 000000000..f905fcaa6 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodeext2_fuzzer/src/image_fwk_decode_ext_fuzzer.cpp @@ -0,0 +1,110 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include "image_fwk_decode_ext_fuzzer.h" + +#define private public +#define protected public +#include +#include +#include +#include +#include +#include + +#include "image_utils.h" +#include "common_fuzztest_function.h" +#include "image_source.h" +#include "ext_decoder.h" +#include "ext_encoder.h" +#include "svg_decoder.h" +#include "bmp_decoder.h" +#include "image_log.h" +#include "pixel_yuv.h" +#include "file_source_stream.h" +#include "image_mime_type.h" +#include "buffer_packer_stream.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "IMAGE_FWK_DECODE_EXT_FUZZ" + +namespace OHOS { +namespace Media { +using namespace OHOS::ImagePlugin; +FuzzedDataProvider* FDP; +std::string optformat[13] = {IMAGE_BMP_FORMAT, IMAGE_GIF_FORMAT, IMAGE_ICO_FORMAT, IMAGE_JPEG_FORMAT, IMAGE_PNG_FORMAT, IMAGE_WBMP_FORMAT, IMAGE_WEBP_FORMAT, IMAGE_HEIF_FORMAT, IMAGE_HEIC_FORMAT, "image/sdr_sut_superfast_4x4", "image/sdr_astc_4x4", "image/astc/4*4", "image/astc/7*7"}; + +void ExtDecoderFuncTest001() +{ + IMAGE_LOGI("%{public}s IN", __func__); + InitializationOptions opts; + opts.size.width = FDP->ConsumeIntegral() & 0xfff; + opts.size.height = FDP->ConsumeIntegral() & 0xfff; + opts.pixelFormat = static_cast(FDP->ConsumeIntegral()); + opts.alphaType = static_cast(FDP->ConsumeIntegral()); + opts.scaleMode = static_cast(FDP->ConsumeIntegral()); + opts.editable = FDP->ConsumeBool(); + opts.useSourceIfMatch = FDP->ConsumeBool(); + + PlEncodeOptions plOpts; + uint8_t optformat_id = FDP->ConsumeIntegral() % 13; + plOpts.format = optformat[optformat_id]; + if(optformat_id == 9) + plOpts.quality = 92; + else if(optformat_id == 10) + plOpts.quality = FDP->ConsumeBool() ? 92 : 85; + else + plOpts.quality = FDP->ConsumeIntegral(); + plOpts.numberHint = FDP->ConsumeIntegral(); + plOpts.desiredDynamicRange = static_cast(FDP->ConsumeIntegral()); + plOpts.needsPackProperties = FDP->ConsumeBool(); + plOpts.isEditScene = FDP->ConsumeBool(); + plOpts.loop = FDP->ConsumeIntegral(); + //plOpts.delayTimes = opts.delayTimes; + //plOpts.disposalTypes = opts.disposalTypes; + int32_t pixelbytes = Media::ImageUtils::GetPixelBytes(opts.srcPixelFormat); + size_t datalength = opts.size.width * opts.size.height * pixelbytes; + std::unique_ptr colorData = std::make_unique(datalength); + if(colorData == nullptr) + return; + FDP->ConsumeData(colorData.get(), datalength); + std::shared_ptr pixelmap = Media::PixelMap::Create(reinterpret_cast(colorData.get()), datalength, opts); + if (pixelmap.get() == nullptr) { + return; + } + + auto extEncoder = std::make_shared(); + auto outputData = std::make_unique(pixelmap->GetByteCount()); + auto stream = std::make_shared(outputData.get(), pixelmap->GetByteCount()); + auto result = extEncoder->StartEncode(*stream.get(), plOpts); + result = extEncoder->AddImage(*pixelmap.get()); + result = extEncoder->FinalizeEncode(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + FuzzedDataProvider fdp(data, size); + OHOS::Media::FDP = &fdp; + OHOS::Media::ExtDecoderFuncTest001(); + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/BUILD.gn new file mode 100644 index 000000000..41a24283c --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("Imagefwkencodegif2FuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer" + + cflags = [ "-DIMAGE_COLORSPACE_FLAG" ] + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include/jpeg_yuv_decoder", + "$image_subsystem/plugins/common/libs/image/libsvgplugin/include", + "$image_subsystem/plugins/common/libs/image/libbmpplugin/include", + "$image_subsystem/plugins/common/libs/image/libgifplugin/include", + ] + + defines = [ + "JPEG_HW_DECODE_ENABLE", + "HEIF_HW_DECODE_ENABLE", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_fwk_decode_gif_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/frameworks/innerkitsimpl/utils:image_utils", + "$image_subsystem/plugins/common/libs/image/libextplugin:extplugin", + "$image_subsystem/plugins/common/libs/image/libsvgplugin:svgplugin", + "$image_subsystem/plugins/common/libs/image/libbmpplugin:bmpplugin", + "$image_subsystem/plugins/common/libs/image/libgifplugin:gifplugin", + ] + + external_deps = [ + "c_utils:utils", + "drivers_interface_codec:image_idl_headers", + "drivers_interface_codec:libimage_proxy_2.1", + "drivers_interface_display:display_buffer_idl_headers", + "drivers_interface_display:display_composer_idl_headers", + "drivers_interface_display:libdisplay_buffer_hdi_impl", + "drivers_interface_display:libdisplay_composer_hdi_impl", + "graphic_2d:color_manager", + "hilog:libhilog", + "libexif:libexif", + "libjpeg-turbo:turbojpeg", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/project.xml new file mode 100644 index 000000000..8b63c0e57 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 4096 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/src/image_fwk_decode_gif_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/src/image_fwk_decode_gif_fuzzer.cpp new file mode 100644 index 000000000..68af7aab9 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodegif2_fuzzer/src/image_fwk_decode_gif_fuzzer.cpp @@ -0,0 +1,105 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include "image_fwk_decode_gif_fuzzer.h" + +#define private public +#define protected public +#include +#include +#include +#include +#include + +#include "image_utils.h" +#include "common_fuzztest_function.h" +#include "image_source.h" +#include "ext_decoder.h" +#include "svg_decoder.h" +#include "bmp_decoder.h" +#include "image_log.h" +#include "pixel_yuv.h" +#include "gif_encoder.h" +#include "buffer_packer_stream.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "IMAGE_FWK_DECODE_GIF_FUZZ" + +namespace OHOS { +namespace Media { +using namespace OHOS::ImagePlugin; +FuzzedDataProvider* FDP; + +void GifTest001() +{ + IMAGE_LOGI("%{public}s IN", __func__); + InitializationOptions opts; + opts.size.width = FDP->ConsumeIntegral() & 0xfff; + opts.size.height = FDP->ConsumeIntegral() & 0xfff; + opts.pixelFormat = static_cast(FDP->ConsumeIntegral()); + opts.alphaType = static_cast(FDP->ConsumeIntegral()); + opts.scaleMode = static_cast(FDP->ConsumeIntegral()); + opts.editable = FDP->ConsumeBool(); + opts.useSourceIfMatch = FDP->ConsumeBool(); + + PlEncodeOptions plOpts; + //plOpts.format = optformat[FDP->ConsumeIntegral() % 9]; + plOpts.quality = FDP->ConsumeIntegral(); + plOpts.numberHint = FDP->ConsumeIntegral(); + plOpts.desiredDynamicRange = static_cast(FDP->ConsumeIntegral()); + plOpts.needsPackProperties = FDP->ConsumeBool(); + plOpts.isEditScene = FDP->ConsumeBool(); + plOpts.loop = FDP->ConsumeIntegral(); + plOpts.disposalTypes = FDP->ConsumeBytes(FDP->ConsumeIntegral()); + uint8_t delaytimessize = FDP->ConsumeIntegral(); + std::vector delaytimes(delaytimessize); + FDP->ConsumeData(delaytimes.data(), delaytimessize*2); + plOpts.delayTimes = delaytimes; + + int32_t pixelbytes = Media::ImageUtils::GetPixelBytes(opts.srcPixelFormat); + size_t datalength = opts.size.width * opts.size.height * pixelbytes; + std::unique_ptr colorData = std::make_unique(datalength); + if(colorData == nullptr) + return; + FDP->ConsumeData(colorData.get(), datalength); + std::shared_ptr pixelmap = Media::PixelMap::Create(reinterpret_cast(colorData.get()), datalength, opts); + if (pixelmap.get() == nullptr) { + return; + } + + auto gifEncoder = std::make_shared(); + auto outputData = std::make_unique(pixelmap->GetByteCount()); + size_t stream_size = pixelmap->GetByteCount(); + auto stream = std::make_shared(outputData.get(), stream_size); + auto result = gifEncoder->StartEncode(*stream.get(), plOpts); + result = gifEncoder->AddImage(*pixelmap.get()); + result = gifEncoder->FinalizeEncode(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + FuzzedDataProvider fdp(data, size); + OHOS::Media::FDP = &fdp; + OHOS::Media::GifTest001(); + return 0; +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/BUILD.gn b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/BUILD.gn new file mode 100644 index 000000000..32ef83b07 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +import("//foundation/multimedia/image_framework/ide/image_decode_config.gni") + +ohos_fuzztest("Imagefwkencodejpeg2FuzzTest") { + module_out_path = "multimedia_image/image_framework" + fuzz_config_file = "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer" + + cflags = [ "-DIMAGE_COLORSPACE_FLAG" ] + + include_dirs = [ + "./include", + "$image_subsystem/interfaces/innerkits/include", + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include", + "$image_subsystem/plugins/common/libs/image/libextplugin/include/jpeg_yuv_decoder", + "$image_subsystem/plugins/common/libs/image/libsvgplugin/include", + "$image_subsystem/plugins/common/libs/image/libjpegplugin/include", + ] + + defines = [ + "JPEG_HW_DECODE_ENABLE", + "HEIF_HW_DECODE_ENABLE", + ] + + sources = [ + "$image_subsystem/frameworks/innerkitsimpl/test/fuzztest/common/src/common_fuzztest_function.cpp", + "src/image_fwk_decode_jpeg_fuzzer.cpp", + ] + + deps = [ + "$image_subsystem/interfaces/innerkits:image_native", + "$image_subsystem/frameworks/innerkitsimpl/utils:image_utils", + "$image_subsystem/plugins/common/libs/image/libextplugin:extplugin", + "$image_subsystem/plugins/common/libs/image/libsvgplugin:svgplugin", + "$image_subsystem/plugins/common/libs/image/libjpegplugin:jpegplugin", + ] + + external_deps = [ + "c_utils:utils", + "drivers_interface_codec:image_idl_headers", + "drivers_interface_codec:libimage_proxy_2.1", + "drivers_interface_display:display_buffer_idl_headers", + "drivers_interface_display:display_composer_idl_headers", + "drivers_interface_display:libdisplay_buffer_hdi_impl", + "drivers_interface_display:libdisplay_composer_hdi_impl", + "graphic_2d:color_manager", + "hilog:libhilog", + "libexif:libexif", + "libjpeg-turbo:turbojpeg", + ] +} diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/project.xml b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/project.xml new file mode 100644 index 000000000..ad6129bbc --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 52428800 + + 300 + + 8192 + + diff --git a/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/src/image_fwk_decode_jpeg_fuzzer.cpp b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/src/image_fwk_decode_jpeg_fuzzer.cpp new file mode 100644 index 000000000..8fced7235 --- /dev/null +++ b/frameworks/innerkitsimpl/test/fuzztest/imagefwkencodejpeg2_fuzzer/src/image_fwk_decode_jpeg_fuzzer.cpp @@ -0,0 +1,99 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include "image_fwk_decode_jpeg_fuzzer.h" + +#define private public +#define protected public +#include +#include +#include +#include +#include + +#include "image_utils.h" +#include "common_fuzztest_function.h" +#include "image_source.h" +#include "ext_decoder.h" +#include "svg_decoder.h" +#include "image_log.h" +#include "pixel_yuv.h" +#include "jpeg_encoder.h" +#include "buffer_packer_stream.h" + +#undef LOG_DOMAIN +#define LOG_DOMAIN LOG_TAG_DOMAIN_ID_IMAGE + +#undef LOG_TAG +#define LOG_TAG "IMAGE_FWK_DECODE_JPEG_FUZZ" + +namespace OHOS { +namespace Media { +using namespace OHOS::ImagePlugin; +FuzzedDataProvider* FDP; + +void JpegTest001() +{ + IMAGE_LOGI("%{public}s IN", __func__); + InitializationOptions opts; + opts.size.width = FDP->ConsumeIntegral() & 0xfff; + opts.size.height = FDP->ConsumeIntegral() & 0xfff; + opts.pixelFormat = static_cast(FDP->ConsumeIntegral()); + opts.alphaType = static_cast(FDP->ConsumeIntegral()); + opts.scaleMode = static_cast(FDP->ConsumeIntegral()); + opts.editable = FDP->ConsumeBool(); + opts.useSourceIfMatch = FDP->ConsumeBool(); + + PlEncodeOptions plOpts; + //plOpts.format = optformat[FDP->ConsumeIntegral() % 9]; + plOpts.quality = FDP->ConsumeIntegral(); + plOpts.numberHint = FDP->ConsumeIntegral(); + plOpts.desiredDynamicRange = static_cast(FDP->ConsumeIntegral()); + plOpts.needsPackProperties = FDP->ConsumeBool(); + plOpts.isEditScene = FDP->ConsumeBool(); + plOpts.loop = FDP->ConsumeIntegral(); + //plOpts.delayTimes = opts.delayTimes; + //plOpts.disposalTypes = opts.disposalTypes; + int32_t pixelbytes = Media::ImageUtils::GetPixelBytes(opts.srcPixelFormat); + size_t datalength = opts.size.width * opts.size.height * pixelbytes; + std::unique_ptr colorData = std::make_unique(datalength); + if(colorData == nullptr) + return; + FDP->ConsumeData(colorData.get(), datalength); + std::shared_ptr pixelmap = Media::PixelMap::Create(reinterpret_cast(colorData.get()), datalength, opts); + if (pixelmap.get() == nullptr) { + return; + } + + auto jpegEncoder = std::make_shared(); + auto outputData = std::make_unique(pixelmap->GetByteCount()); + auto stream = std::make_shared(outputData.get(), pixelmap->GetByteCount()); + auto result = jpegEncoder->StartEncode(*stream.get(), plOpts); + result = jpegEncoder->AddImage(*pixelmap.get()); + result = jpegEncoder->FinalizeEncode(); + IMAGE_LOGI("%{public}s SUCCESS", __func__); +} +} // namespace Media +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + FuzzedDataProvider fdp(data, size); + OHOS::Media::FDP = &fdp; + OHOS::Media::JpegTest001(); + return 0; +} -- Gitee