/* * Copyright 2022 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include #include #include #include #include using namespace android; constexpr int32_t kMinBuffer = 0; constexpr int32_t kMaxBuffer = 100000; class ConsumerFuzzer { public: ConsumerFuzzer(const uint8_t* data, size_t size) : mFdp(data, size){}; void process(); private: FuzzedDataProvider mFdp; }; void ConsumerFuzzer::process() { sp core(new BufferQueueCore()); sp consumer(new BufferQueueConsumer(core)); uint64_t maxBuffers = mFdp.ConsumeIntegralInRange(kMinBuffer, kMaxBuffer); sp cpu( new CpuConsumer(consumer, maxBuffers, mFdp.ConsumeBool() /*controlledByApp*/)); CpuConsumer::LockedBuffer lockBuffer; cpu->lockNextBuffer(&lockBuffer); cpu->unlockBuffer(lockBuffer); cpu->abandon(); uint32_t tex = mFdp.ConsumeIntegral(); sp glComsumer(new GLConsumer(consumer, tex, GLConsumer::TEXTURE_EXTERNAL, mFdp.ConsumeBool() /*useFenceSync*/, mFdp.ConsumeBool() /*isControlledByApp*/)); sp releaseFence = new Fence(memfd_create("rfd", MFD_ALLOW_SEALING)); glComsumer->setReleaseFence(releaseFence); glComsumer->updateTexImage(); glComsumer->releaseTexImage(); sp buffer = new GraphicBuffer(mFdp.ConsumeIntegral(), mFdp.ConsumeIntegral(), mFdp.ConsumeIntegral(), mFdp.ConsumeIntegral(), mFdp.ConsumeIntegral()); float mtx[16]; glComsumer->getTransformMatrix(mtx); glComsumer->computeTransformMatrix(mtx, buffer, getRect(&mFdp), mFdp.ConsumeIntegral(), mFdp.ConsumeBool() /*filtering*/); glComsumer->scaleDownCrop(getRect(&mFdp), mFdp.ConsumeIntegral(), mFdp.ConsumeIntegral()); glComsumer->setDefaultBufferSize(mFdp.ConsumeIntegral(), mFdp.ConsumeIntegral()); glComsumer->setFilteringEnabled(mFdp.ConsumeBool() /*enabled*/); glComsumer->setConsumerUsageBits(mFdp.ConsumeIntegral()); glComsumer->attachToContext(tex); glComsumer->abandon(); } extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { ConsumerFuzzer consumerFuzzer(data, size); consumerFuzzer.process(); return 0; }