Fuzzing target for thumbnail-util.

Fuzzed functions:
 thumbnail_util_create
 thumbnail_util_destroy
 thumbnail_util_extract
 thumbnail_util_set_path

Change-Id: Idfaa78943241391a9bcbc39f566ef9f8ca8c3426
Signed-off-by: Vitaliy Cherepanov <v.cherepanov@samsung.com>

diff --git a/targets/thumbnail-util/README.md b/targets/thumbnail-util/README.md
new file mode 100644 (file)
index 0000000..e7aaea1
--- /dev/null
+++ b/targets/thumbnail-util/README.md
@@ -0,0 +1,7 @@
+Target functions for Multimedia package: Thumbnail Util
+
+Fuzzed functions:
+ * thumbnail_util_create
+ * thumbnail_util_destroy
+ * thumbnail_util_extract
+ * thumbnail_util_set_path

diff --git a/targets/thumbnail-util/build.sh b/targets/thumbnail-util/build.sh
new file mode 100755 (executable)
index 0000000..71a093b
--- /dev/null
+++ b/targets/thumbnail-util/build.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+CXX=g++
+LIBS=('glib-2.0' 'capi-media-thumbnail-util')
+CXXFLAGS="${COMMON_CXXFLAGS} $(pkg-config --cflags ${LIBS[@]})"
+LDFLAGS="${COMMON_LDFLAGS} $(pkg-config --libs ${LIBS[@]})"
+
+cd ${TARGET_DIR}
+for SOURCE in *.cpp; do
+      ${CXX} ${CXXFLAGS} ${SOURCE} ${LIBFUZZER} ${LDFLAGS} -o ${OUTPUT_DIR}/${SOURCE/.cpp/.out}
+done

diff --git a/targets/thumbnail-util/targetspec b/targets/thumbnail-util/targetspec
new file mode 100644 (file)
index 0000000..5a78528
--- /dev/null
+++ b/targets/thumbnail-util/targetspec
@@ -0,0 +1 @@
+main = 'git://git.tizen.org/platform/core/api/thumbnail-util$tizen'

diff --git a/targets/thumbnail-util/thumbnail-util.cpp b/targets/thumbnail-util/thumbnail-util.cpp
new file mode 100644 (file)
index 0000000..de307df
--- /dev/null
+++ b/targets/thumbnail-util/thumbnail-util.cpp
@@ -0,0 +1,113 @@
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+
+#include <thumbnail_util.h>
+
+#define array_len(arr) (sizeof(arr)/sizeof(arr[0]))
+
+#define file_num ( input_data->file_n % (array_len(file_name_arr)) )
+#define file_name file_name_arr[file_num]
+
+struct input {
+    unsigned int file_n;
+
+    const uint8_t data[0];
+};
+
+static inline struct input *input_data_init(const uint8_t *data, size_t *size)
+{
+    struct input *res = NULL;
+    if (*size < sizeof(struct input))
+        return res;
+    *size = *size - sizeof(*res);
+    res = (struct input*)data;
+    return res;
+}
+
+
+const char *file_name_arr[] = {
+      "/tmp/%d.3gp",
+      "/tmp/%d.asf",
+      "/tmp/%d.avi",
+      "/tmp/%d.mkv",
+      "/tmp/%d.mp4",
+      "/tmp/%d.ogg",
+      "/tmp/%d.mmf",
+      "/tmp/%d.mpeg",
+      "",
+};
+
+void make_file(const char *file, const uint8_t *data, size_t size)
+{
+    FILE *f;
+    char file_line[256];
+    sprintf(file_line, file, getpid());
+    f = fopen(file_line, "w+");
+    if (f == NULL)
+        return;
+    fwrite(data, size, 1, f);
+    fclose(f);
+}
+
+void rm_file(const char *file)
+{
+    char file_line[256];
+    sprintf(file_line, file, getpid());
+    remove(file_line);
+}
+
+
+static thumbnail_h g_thumb_h;
+static int thumbnail_completed = 0;
+
+static void thumbnail_completed_cb(thumbnail_util_error_e error, const char *request_id,
+                            int raw_width, int raw_height, unsigned char *raw_data,
+                            int raw_size, void *user_data)
+{
+    thumbnail_completed = 1;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    struct input *input_data = NULL;
+    char *request_id = NULL;
+    int error_code;
+
+    input_data = input_data_init(data, &size);
+    if (input_data == NULL)
+        goto Exception;
+
+    make_file(file_name, input_data->data, size);
+
+    // Start test
+    thumbnail_completed = 0;
+
+    // Create thumbnail instance.
+    error_code = thumbnail_util_create(&g_thumb_h);
+    if (THUMBNAIL_UTIL_ERROR_NONE != error_code)
+        goto file_rm;
+
+    error_code = thumbnail_util_set_path(g_thumb_h, file_name);
+    if (THUMBNAIL_UTIL_ERROR_NONE != error_code)
+        goto th_destroy;
+
+    // Extract the thumbnail from the given file.
+
+    error_code = thumbnail_util_extract(g_thumb_h, thumbnail_completed_cb, NULL, &request_id);
+    if (THUMBNAIL_UTIL_ERROR_NONE != error_code)
+        goto th_destroy;
+
+    while(!thumbnail_completed);
+
+th_destroy:
+    free(request_id);
+    error_code = thumbnail_util_destroy(g_thumb_h);
+file_rm:
+    rm_file(file_name);
+Exception:
+    return 0;
+}