/** * Copyright (C) 2019 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include #include #include #include #include #include "OMX_Component.h" using namespace android; struct DummyOMXObserver : public BnOMXObserver { public: DummyOMXObserver() {} virtual void onMessages(const std::list &) {} protected: virtual ~DummyOMXObserver() {} }; bool fuzzIOMXQcomVpx() { const char *name = "OMX.qcom.video.decoder.vp8"; int fenceFd = -1; int inSize = 6230016 * 4; int outSize = 159744 * 4; sp memory; sp mOMXNode; sp mOmx; OMXClient client; if (client.connect() != OK) { ALOGE("OMXClient connect == NULL"); return false; } mOmx = client.interface(); if (mOmx == NULL) { ALOGE("OMXClient interface mOmx == NULL"); client.disconnect(); return false; } sp observerDec = new DummyOMXObserver(); ALOGI("-----------decode------------"); status_t err = mOmx->allocateNode(name, observerDec, &mOMXNode); if (err != OK) { ALOGE("%s node allocation failed", name); client.disconnect(); return false; } // change state from loaded to idle err = mOMXNode->sendCommand(OMX_CommandStateSet, OMX_StateIdle); if (err != OK) { ALOGE("sendCommand is failed in OMX_StateIdle, err: %d", err); mOMXNode->freeNode(); client.disconnect(); return false; } // Input sp dealerIn = new MemoryDealer(inSize); IOMX::buffer_id inBufferId = 0; memory = dealerIn->allocate(inSize); if (memory.get() == nullptr || memory->pointer() == nullptr) { ALOGE("memory allocate failed for port index 0, err: %d", err); mOMXNode->freeNode(); client.disconnect(); return false; } /* * keep running to check whether mediaserver crashes * Error conditions are not checked for usebuffer/emptybuffer/fillbuffer */ OMXBuffer omxInBuf(memory); memset(memory->pointer(), 0xCF, inSize); err = mOMXNode->useBuffer(0, omxInBuf, &inBufferId); ALOGI("useBuffer, port index 0, err: %d", err); sp inputFormat = new AMessage; sp codecDataIn; codecDataIn = new SharedMemoryBuffer(inputFormat, memory); OMXBuffer omxInBufShared(codecDataIn); // Output sp dealerOut = new MemoryDealer(outSize); IOMX::buffer_id outBufferId = 0; memory = dealerOut->allocate(outSize); if (memory.get() == nullptr || memory->pointer() == nullptr) { ALOGE("memory allocate failed for port index 1, err: %d", err); mOMXNode->freeNode(); client.disconnect(); return false; } OMXBuffer omxOutBuf(memory); err = mOMXNode->useBuffer(1, omxOutBuf, &outBufferId); ALOGI("useBuffer, port index 1, err: %d", err); sp outputFormat = new AMessage; sp codecDataOut; codecDataOut = new SharedMemoryBuffer(outputFormat, memory); OMXBuffer omxOutBufShared(codecDataOut); // change state from idle to executing err = mOMXNode->sendCommand(OMX_CommandStateSet, OMX_StateExecuting); if (err != OK) { ALOGE("sendCommand is failed in OMX_StateExecuting, err: %d", err); mOMXNode->freeNode(); client.disconnect(); return false; } // keep running to check whether mediaserver crashes err = mOMXNode->emptyBuffer(inBufferId, omxInBufShared, 0, 0, fenceFd); ALOGI("emptyBuffer, err: %d", err); err = mOMXNode->fillBuffer(outBufferId, omxOutBufShared, fenceFd); ALOGI("fillBuffer, err: %d", err); // free node err = mOMXNode->freeNode(); ALOGI("freeNode, err: %d", err); client.disconnect(); return true; } int main() { return (int)(!fuzzIOMXQcomVpx()); }