Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0e6752c9 authored by Keith Mok's avatar Keith Mok
Browse files

Fix fuzzer error for FormatConvertFuzzer 

The stride was not correct for the fuzzer.
And the FormatConvert have some restructions
on the width and height.

- YUYV
  width and height must be even nmber
- YU12
  width mush be divisible by 16
  height must be even number

Bug: 202641239
Test: FormatConvertFuzzer_copyYV12toBGR32
Change-Id: I45ebea3e22854bdad037abb742fbdbe364b19ec5
parent e0f7bd71

automotive/evs/common/utils/default/test/fuzz/FormatConvertFuzzer.cpp

+25 −17
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
 * limitations under the License.

 */



#include <fuzzer/FuzzedDataProvider.h>

#include <cmath>

#include <cstdlib>

#include <cstring>
@@ -21,36 +22,43 @@ 
#include "FormatConvert.h"



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, std::size_t size) {

    if (size < 256) {

    // 1 random value (4bytes) + min imagesize = 16*2 times bytes per pixel (worse case 2)

    if (size < (4 + 16 * 2 * 2)) {

        return 0;

    }

    FuzzedDataProvider fdp(data, size);

    std::size_t image_pixel_size = size - 4;

    image_pixel_size = (image_pixel_size & INT_MAX) / 2;



    std::srand(std::time(nullptr));  // use current time as seed for random generator

    int random_variable = std::rand() % 10;

    int width = (int)sqrt(size);

    int height = width * ((float)random_variable / 10.0);

    // API have a requirement that width must be divied by 16 except yuyvtorgb

    int min_height = 2;

    int max_height = (image_pixel_size / 16) & ~(1);  // must be even number

    int height = fdp.ConsumeIntegralInRange<uint32_t>(min_height, max_height);

    int width = (image_pixel_size / height) & ~(16);  // must be divisible by 16



    uint8_t* src = (uint8_t*)malloc(sizeof(uint8_t) * size);

    memcpy(src, data, sizeof(uint8_t) * (size));

    uint32_t* tgt = (uint32_t*)malloc(sizeof(uint32_t) * size);

    uint8_t* src = (uint8_t*)(data + 4);

    uint32_t* tgt = (uint32_t*)malloc(sizeof(uint32_t) * image_pixel_size);



#ifdef COPY_NV21_TO_RGB32

    android::hardware::automotive::evs::common::Utils::copyNV21toRGB32(width, height, src, tgt, 0);

    android::hardware::automotive::evs::common::Utils::copyNV21toRGB32(width, height, src, tgt,

                                                                       width);

#elif COPY_NV21_TO_BGR32

    android::hardware::automotive::evs::common::Utils::copyNV21toBGR32(width, height, src, tgt, 0);

    android::hardware::automotive::evs::common::Utils::copyNV21toBGR32(width, height, src, tgt,

                                                                       width);

#elif COPY_YV12_TO_RGB32

    android::hardware::automotive::evs::common::Utils::copyYV12toRGB32(width, height, src, tgt, 0);

    android::hardware::automotive::evs::common::Utils::copyYV12toRGB32(width, height, src, tgt,

                                                                       width);

#elif COPY_YV12_TO_BGR32

    android::hardware::automotive::evs::common::Utils::copyYV12toBGR32(width, height, src, tgt, 0);

    android::hardware::automotive::evs::common::Utils::copyYV12toBGR32(width, height, src, tgt,

                                                                       width);

#elif COPY_YUYV_TO_RGB32

    android::hardware::automotive::evs::common::Utils::copyYUYVtoRGB32(width, height, src, 0, tgt,

                                                                       0);

    android::hardware::automotive::evs::common::Utils::copyYUYVtoRGB32(width, height, src, width,

                                                                       tgt, width);

#elif COPY_YUYV_TO_BGR32

    android::hardware::automotive::evs::common::Utils::copyYUYVtoBGR32(width, height, src, 0, tgt,

                                                                       0);

    android::hardware::automotive::evs::common::Utils::copyYUYVtoBGR32(width, height, src, width,

                                                                       tgt, width);

#endif



    free(src);

    free(tgt);



    return 0;