Snap for 11104212 from 23c2a37642889006afec55650169cb703927012b to 24Q1-release (2f64c8cc) · Commits · e / os / android_frameworks_av

camera/camera_platform.aconfig

+7 −0

Original line number	Diff line number	Diff line
		@@ -34,3 +34,10 @@ flag {
		description: "Enable measuring how much usage there is for zoom settings overrde"
		bug: "307409002"
		}

		flag {
		namespace: "camera_platform"
		name: "virtual_camera_service_discovery"
		description: "Enable discovery of the Virtual Camera HAL without a VINTF entry"
		bug: "305170199"
		}

camera/tests/fuzzer/Android.bp

+34 −2

Original line number	Diff line number	Diff line
		@@ -26,6 +26,7 @@ cc_defaults {
		name: "camera_defaults",
		static_libs: [
		"libcamera_client",
		"libbinder_random_parcel",
		],
		shared_libs: [
		"camera_platform_flags_c_lib",
		@@ -38,11 +39,22 @@ cc_defaults {
		"libcamera_metadata",
		"libnativewindow",
		],
		header_libs: [
		"libbinder_headers",
		],
		fuzz_config: {
		cc: [
		"android-media-fuzzing-reports@google.com",
		"android-camera-fwk-eng@google.com",
		],
		componentid: 41727,
		hotlists: [
		"4593311",
		],
		componentid: 155276,
		description: "The fuzzer targets the APIs of libcamera_client",
		vector: "local_no_privileges_required",
		service_privilege: "privileged",
		users: "multi_user",
		fuzzed_code_usage: "shipped",
		},
		}

		@@ -149,3 +161,23 @@ cc_fuzz {
		"camera_defaults",
		],
		}

		cc_fuzz {
		name: "camera_utils_fuzzer",
		srcs: [
		"camera_utils_fuzzer.cpp",
		],
		defaults: [
		"camera_defaults",
		],
		}

		cc_fuzz {
		name: "camera_metadata_fuzzer",
		srcs: [
		"camera_metadata_fuzzer.cpp",
		],
		defaults: [
		"camera_defaults",
		],
		}

camera/tests/fuzzer/README.md

+4 −0

Original line number	Diff line number	Diff line
		@@ -52,6 +52,8 @@ Build the fuzzer
		$ mm -j$(nproc) camera_Parameters_fuzzer
		$ mm -j$(nproc) camera_SessionStats_fuzzer
		$ mm -j$(nproc) camera_captureResult_fuzzer
		$ mm -j$(nproc) camera_utils_fuzzer
		$ mm -j$(nproc) camera_metadata_fuzzer
		```
		#### Steps to run
		To run on device
		@@ -67,6 +69,8 @@ To run on device
		$ adb shell /data/fuzz/${TARGET_ARCH}/camera_Parameters_fuzzer/camera_Parameters_fuzzer
		$ adb shell /data/fuzz/${TARGET_ARCH}/camera_SessionStats_fuzzer/camera_SessionStats_fuzzer
		$ adb shell /data/fuzz/${TARGET_ARCH}/camera_captureResult_fuzzer/camera_captureResult_fuzzer
		$ adb shell /data/fuzz/${TARGET_ARCH}/camera_utils_fuzzer/camera_utils_fuzzer
		$ adb shell /data/fuzz/${TARGET_ARCH}/camera_metadata_fuzzer/camera_metadata_fuzzer
		```

		## References:

camera/tests/fuzzer/camera2common.h

+103 −0

Original line number	Diff line number	Diff line
		@@ -16,10 +16,93 @@
		#ifndef CAMERA2COMMON_H
		#define CAMERA2COMMON_H

		#include <CameraSessionStats.h>
		#include <android-base/logging.h>
		#include <binder/IServiceManager.h>
		#include <binder/Parcel.h>
		#include <fuzzbinder/random_binder.h>
		#include <fuzzbinder/random_fd.h>
		#include <fuzzbinder/random_parcel.h>
		#include <fuzzer/FuzzedDataProvider.h>
		#include <utils/String16.h>

		using namespace android;

		const std::string kFetchCameraService = "media.camera";

		constexpr int8_t kMinIterations = 0;
		constexpr int8_t kMaxIterations = 20;
		constexpr int8_t kMinExtraFDs = 0;
		constexpr int8_t kMinExtraBinder = 0;
		constexpr int32_t kMaxFDs = 1000;
		constexpr int32_t kMinBytes = 0;
		constexpr int32_t kMaxBytes = 20;
		constexpr int32_t kMinCapacity = 1;
		constexpr int32_t kMaxCapacity = 1000;

		const int32_t kValidFacing[] = {android::hardware::CameraSessionStats::CAMERA_FACING_BACK,
		android::hardware::CameraSessionStats::CAMERA_FACING_FRONT};
		const int32_t kValidOrientation[] = {0, 90, 180, 270};

		void randomizeParcel(Parcel* parcel, FuzzedDataProvider& provider) {
		sp<IServiceManager> sm = defaultServiceManager();
		sp<IBinder> binder = sm->getService(String16(kFetchCameraService.c_str()));
		RandomParcelOptions options{
		.extraBinders = {binder},
		.extraFds = {},
		};

		auto retFds = parcel->debugReadAllFileDescriptors();
		for (size_t i = 0; i < retFds.size(); ++i) {
		options.extraFds.push_back(base::unique_fd(dup(retFds[i])));
		}
		int8_t iterations = provider.ConsumeIntegralInRange<int8_t>(kMinIterations, kMaxIterations);
		while (--iterations >= 0) {
		auto fillFunc = provider.PickValueInArray<const std::function<void()>>({
		// write data
		[&]() {
		size_t toWrite = provider.ConsumeIntegralInRange<size_t>(kMinBytes, kMaxBytes);
		std::vector<uint8_t> data = provider.ConsumeBytes<uint8_t>(toWrite);
		CHECK(OK == parcel->write(data.data(), data.size()));
		},
		// write FD
		[&]() {
		if (options.extraFds.size() > 0 && provider.ConsumeBool()) {
		const base::unique_fd& fd =
		options.extraFds.at(provider.ConsumeIntegralInRange<size_t>(
		kMinExtraFDs, options.extraFds.size() - 1));
		CHECK(OK == parcel->writeFileDescriptor(fd.get(), false /takeOwnership/));
		} else {
		// b/260119717 - Adding more FDs can eventually lead to FD limit exhaustion
		if (options.extraFds.size() > kMaxFDs) {
		return;
		}

		std::vector<base::unique_fd> fds = getRandomFds(&provider);
		CHECK(OK == parcel->writeFileDescriptor(fds.begin()->release(),
		true /takeOwnership/));

		options.extraFds.insert(options.extraFds.end(),
		std::make_move_iterator(fds.begin() + 1),
		std::make_move_iterator(fds.end()));
		}
		},
		// write binder
		[&]() {
		sp<IBinder> binder;
		if (options.extraBinders.size() > 0 && provider.ConsumeBool()) {
		binder = options.extraBinders.at(provider.ConsumeIntegralInRange<size_t>(
		kMinExtraBinder, options.extraBinders.size() - 1));
		} else {
		binder = getRandomBinder(&provider);
		}
		CHECK(OK == parcel->writeStrongBinder(binder));
		},
		});
		fillFunc();
		}
		}

		template <class type>
		void invokeReadWriteNullParcel(type* obj) {
		Parcel* parcelNull = nullptr;
		@@ -52,4 +135,24 @@ void invokeReadWriteParcelsp(sp<type> obj) {
		delete parcel;
		}

		template <class type>
		void invokeNewReadWriteParcel(type* obj, FuzzedDataProvider& provider) {
		Parcel* parcel = new Parcel();
		obj->writeToParcel(parcel);
		randomizeParcel(parcel, provider);
		parcel->setDataPosition(0);
		obj->readFromParcel(parcel);
		delete parcel;
		}

		template <class type>
		void invokeNewReadWriteParcelsp(sp<type> obj, FuzzedDataProvider& provider) {
		Parcel* parcel = new Parcel();
		obj->writeToParcel(parcel);
		randomizeParcel(parcel, provider);
		parcel->setDataPosition(0);
		obj->readFromParcel(parcel);
		delete parcel;
		}

		#endif // CAMERA2COMMON_H