1 /*
2  * Copyright (c) 2022-2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "bitmap_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 #include <securec.h>
21 
22 #include "get_object.h"
23 #include "image/bitmap.h"
24 #include "draw/color.h"
25 
26 namespace OHOS {
27 namespace Rosen {
28 namespace {
29 constexpr size_t DATA_MIN_SIZE = 2;
30 constexpr size_t MAX_ARRAY_SIZE = 5000;
31 constexpr size_t ALPHATYPE_SIZE = 4;
32 constexpr size_t COLORTYPE_SIZE = 10;
33 } // namespace
34 
35 namespace Drawing {
BitmapFuzzTest001(const uint8_t * data,size_t size)36 bool BitmapFuzzTest001(const uint8_t* data, size_t size)
37 {
38     if (data == nullptr || size < DATA_MIN_SIZE) {
39         return false;
40     }
41     Bitmap bitmap;
42     int width = static_cast<int>(data[0]);
43     int height = static_cast<int>(data[1]);
44     BitmapFormat bitmapFormat = { COLORTYPE_ARGB_4444, ALPHATYPE_OPAQUE };
45     bitmap.Build(width, height, bitmapFormat);
46     if (bitmap.GetWidth() != width || bitmap.GetHeight() != height || bitmap.GetPixels() == nullptr) {
47         return false;
48     }
49     bitmap.ClearWithColor(COLORTYPE_UNKNOWN);
50     bitmap.Free();
51     return true;
52 }
53 
BitmapFuzzTest002(const uint8_t * data,size_t size)54 bool BitmapFuzzTest002(const uint8_t* data, size_t size)
55 {
56     if (data == nullptr || size < DATA_MIN_SIZE) {
57         return false;
58     }
59     Bitmap bitmap;
60     int imageInfoWidth = GetObject<int>();
61     int imageInfoHeight = GetObject<int>();
62     uint32_t colorType = GetObject<uint32_t>();
63     uint32_t alphaType = GetObject<uint32_t>();
64     ImageInfo imageInfo = ImageInfo(imageInfoWidth, imageInfoHeight,
65         static_cast<ColorType>(colorType % COLORTYPE_SIZE), static_cast<AlphaType>(alphaType % ALPHATYPE_SIZE));
66     int32_t stride = GetObject<int32_t>();
67     bitmap.Build(imageInfo, stride);
68     bitmap.GetRowBytes();
69     bitmap.GetColorType();
70     bitmap.GetAlphaType();
71     Bitmap dst;
72     float left = GetObject<float>();
73     float top = GetObject<float>();
74     float right = GetObject<float>();
75     float bottom = GetObject<float>();
76     Rect subset {
77         left,
78         top,
79         right,
80         bottom,
81     };
82     bitmap.ExtractSubset(dst, subset);
83     return true;
84 }
85 
BitmapFuzzTest003(const uint8_t * data,size_t size)86 bool BitmapFuzzTest003(const uint8_t* data, size_t size)
87 {
88     if (data == nullptr || size < DATA_MIN_SIZE) {
89         return false;
90     }
91     Bitmap bitmap;
92     int imageInfoWidth = GetObject<int>();
93     int imageInfoHeight = GetObject<int>();
94     uint32_t colorType = GetObject<uint32_t>();
95     uint32_t alphaType = GetObject<uint32_t>();
96     ImageInfo imageInfo = ImageInfo(imageInfoWidth, imageInfoHeight,
97         static_cast<ColorType>(colorType % COLORTYPE_SIZE), static_cast<AlphaType>(alphaType % ALPHATYPE_SIZE));
98     int32_t width = GetObject<int32_t>() % MAX_ARRAY_SIZE;
99     int32_t height = GetObject<int32_t>() % MAX_ARRAY_SIZE;
100     int32_t srcX = GetObject<int32_t>() % width;
101     int32_t srcY = GetObject<int32_t>() % height;
102     uint32_t size_pix = width * height;
103     uint32_t* pixels = new uint32_t[size_pix];
104     for (size_t i = 0; i < size_pix; i++) {
105         pixels[i] = GetObject<uint32_t>();
106     }
107     size_t dstRowBytes = GetObject<size_t>();
108     bitmap.ReadPixels(imageInfo, pixels, dstRowBytes, srcX, srcY);
109     if (pixels != nullptr) {
110         delete[]  pixels;
111         pixels = nullptr;
112     }
113     return true;
114 }
115 
BitmapFuzzTest004(const uint8_t * data,size_t size)116 bool BitmapFuzzTest004(const uint8_t* data, size_t size)
117 {
118     if (data == nullptr || size < DATA_MIN_SIZE) {
119         return false;
120     }
121     Bitmap bitmap;
122     bitmap.ComputeByteSize();
123     Pixmap pixmap;
124     bitmap.PeekPixels(pixmap);
125     int32_t width = GetObject<int32_t>() % MAX_ARRAY_SIZE;
126     int32_t height = GetObject<int32_t>() % MAX_ARRAY_SIZE;
127     uint32_t size_pix = width * height;
128     uint32_t* pixels = new uint32_t[size_pix];
129     for (size_t i = 0; i < size_pix; i++) {
130         pixels[i] = GetObject<uint32_t>();
131     }
132     bitmap.SetPixels(pixels);
133     bitmap.GetPixels();
134     if (pixels != nullptr) {
135         delete[]  pixels;
136         pixels = nullptr;
137     }
138     return true;
139 }
140 
BitmapFuzzTest005(const uint8_t * data,size_t size)141 bool BitmapFuzzTest005(const uint8_t* data, size_t size)
142 {
143     if (data == nullptr || size < DATA_MIN_SIZE) {
144         return false;
145     }
146     Bitmap bitmap;
147     Bitmap dst;
148     int srcLeft = GetObject<int>();
149     int srcTop = GetObject<int>();
150     bitmap.CopyPixels(dst, srcLeft, srcTop);
151     bitmap.SetImmutable();
152     bitmap.IsImmutable();
153     bitmap.IsValid();
154     bitmap.IsEmpty();
155     ColorQuad color = GetObject<ColorQuad>();
156     bitmap.ClearWithColor(color);
157     bitmap.GetColor(srcLeft, srcTop);
158     bitmap.Free();
159 
160     return true;
161 }
162 
BitmapFuzzTest006(const uint8_t * data,size_t size)163 bool BitmapFuzzTest006(const uint8_t* data, size_t size)
164 {
165     if (data == nullptr || size < DATA_MIN_SIZE) {
166         return false;
167     }
168     Bitmap bitmap;
169     BitmapFormat format;
170     bitmap.GetFormat();
171     bitmap.SetFormat(format);
172     int imageInfoWidth = GetObject<int>();
173     int imageInfoHeight = GetObject<int>();
174     uint32_t colorType = GetObject<uint32_t>();
175     uint32_t alphaType = GetObject<uint32_t>();
176     ImageInfo imageInfo = ImageInfo(imageInfoWidth, imageInfoHeight,
177         static_cast<ColorType>(colorType % COLORTYPE_SIZE), static_cast<AlphaType>(alphaType % ALPHATYPE_SIZE));
178     bitmap.SetInfo(imageInfo);
179     bitmap.GetImageInfo();
180     bitmap.GetPixmap();
181     bitmap.MakeImage();
182     bitmap.TryAllocPixels(imageInfo);
183     bitmap.Serialize();
184     bitmap.Deserialize(nullptr);
185     return true;
186 }
187 
BitmapFuzzTest007(const uint8_t * data,size_t size)188 bool BitmapFuzzTest007(const uint8_t* data, size_t size)
189 {
190     if (data == nullptr || size < DATA_MIN_SIZE) {
191         return false;
192     }
193     Bitmap bitmap;
194     int imageInfoWidth = GetObject<int>();
195     int imageInfoHeight = GetObject<int>();
196     uint32_t colorType = GetObject<uint32_t>();
197     uint32_t alphaType = GetObject<uint32_t>();
198     ImageInfo imageInfo = ImageInfo(imageInfoWidth, imageInfoHeight,
199         static_cast<ColorType>(colorType % COLORTYPE_SIZE), static_cast<AlphaType>(alphaType % ALPHATYPE_SIZE));
200     int32_t width = GetObject<int32_t>() % MAX_ARRAY_SIZE;
201     int32_t height = GetObject<int32_t>() % MAX_ARRAY_SIZE;
202     uint32_t size_pix = width * height;
203     uint32_t* pixels = new uint32_t[size_pix];
204     for (size_t i = 0; i < size_pix; i++) {
205         pixels[i] = GetObject<uint32_t>();
206     }
207     size_t rowBytes = GetObject<size_t>();
208     bitmap.InstallPixels(imageInfo, pixels, rowBytes, nullptr, nullptr);
209     if (pixels != nullptr) {
210         delete[] pixels;
211         pixels = nullptr;
212     }
213     return true;
214 }
215 } // namespace Drawing
216 } // namespace Rosen
217 } // namespace OHOS
218 
219 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)220 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
221 {
222     /* Run your code on data */
223     OHOS::Rosen::Drawing::BitmapFuzzTest001(data, size);
224     OHOS::Rosen::Drawing::BitmapFuzzTest002(data, size);
225     OHOS::Rosen::Drawing::BitmapFuzzTest003(data, size);
226     OHOS::Rosen::Drawing::BitmapFuzzTest004(data, size);
227     OHOS::Rosen::Drawing::BitmapFuzzTest005(data, size);
228     OHOS::Rosen::Drawing::BitmapFuzzTest006(data, size);
229     OHOS::Rosen::Drawing::BitmapFuzzTest007(data, size);
230     return 0;
231 }