| OLD | NEW |
| 1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // Fuzz testing for EncodedProgram serialized format and assembly. | 5 // Fuzz testing for EncodedProgram serialized format and assembly. |
| 6 // | 6 // |
| 7 // We would like some assurance that if an EncodedProgram is malformed we will | 7 // We would like some assurance that if an EncodedProgram is malformed we will |
| 8 // not crash. The EncodedProgram could be malformed either due to malicious | 8 // not crash. The EncodedProgram could be malformed either due to malicious |
| 9 // attack to due to an error in patch generation. | 9 // attack to due to an error in patch generation. |
| 10 // | 10 // |
| (...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 88 | 88 |
| 89 courgette::SinkStream sink; | 89 courgette::SinkStream sink; |
| 90 bool can_collect = sinks.CopyTo(&sink); | 90 bool can_collect = sinks.CopyTo(&sink); |
| 91 EXPECT_TRUE(can_collect); | 91 EXPECT_TRUE(can_collect); |
| 92 | 92 |
| 93 size_t length = sink.Length(); | 93 size_t length = sink.Length(); |
| 94 | 94 |
| 95 std::string base_buffer(reinterpret_cast<const char*>(sink.Buffer()), length); | 95 std::string base_buffer(reinterpret_cast<const char*>(sink.Buffer()), length); |
| 96 std::string base_output; | 96 std::string base_output; |
| 97 bool ok = TryAssemble(base_buffer, &base_output); | 97 bool ok = TryAssemble(base_buffer, &base_output); |
| 98 EXPECT_EQ(true, ok); | 98 EXPECT_TRUE(ok); |
| 99 | 99 |
| 100 // Now we have a good serialized EncodedProgram in |base_buffer|. Time to | 100 // Now we have a good serialized EncodedProgram in |base_buffer|. Time to |
| 101 // fuzz. | 101 // fuzz. |
| 102 | 102 |
| 103 // More intense fuzzing on the first part because it contains more control | 103 // More intense fuzzing on the first part because it contains more control |
| 104 // information like substeam lengths. | 104 // information like substeam lengths. |
| 105 size_t position = 0; | 105 size_t position = 0; |
| 106 for ( ; position < 100 && position < length; position += 1) { | 106 for ( ; position < 100 && position < length; position += 1) { |
| 107 FuzzByte(base_buffer, base_output, position); | 107 FuzzByte(base_buffer, base_output, position); |
| 108 } | 108 } |
| (...skipping 117 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 226 return result; | 226 return result; |
| 227 } | 227 } |
| 228 | 228 |
| 229 TEST_F(DecodeFuzzTest, All) { | 229 TEST_F(DecodeFuzzTest, All) { |
| 230 FuzzExe("setup1.exe"); | 230 FuzzExe("setup1.exe"); |
| 231 } | 231 } |
| 232 | 232 |
| 233 int main(int argc, char** argv) { | 233 int main(int argc, char** argv) { |
| 234 return base::TestSuite(argc, argv).Run(); | 234 return base::TestSuite(argc, argv).Run(); |
| 235 } | 235 } |
| OLD | NEW |