| OLD | NEW |
| 1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // Fuzz testing for EncodedProgram serialized format and assembly. | 5 // Fuzz testing for EncodedProgram serialized format and assembly. |
| 6 // | 6 // |
| 7 // We would like some assurance that if an EncodedProgram is malformed we will | 7 // We would like some assurance that if an EncodedProgram is malformed we will |
| 8 // not crash. The EncodedProgram could be malformed either due to malicious | 8 // not crash. The EncodedProgram could be malformed either due to malicious |
| 9 // attack to due to an error in patch generation. | 9 // attack to due to an error in patch generation. |
| 10 // | 10 // |
| 11 // We try a lot of arbitrary modifications to the serialized form and make sure | 11 // We try a lot of arbitrary modifications to the serialized form and make sure |
| 12 // that the outcome is not a crash. | 12 // that the outcome is not a crash. |
| 13 | 13 |
| 14 #include <string> | |
| 15 | |
| 16 #include "base/path_service.h" | |
| 17 #include "base/file_util.h" | |
| 18 #include "base/string_util.h" | |
| 19 #include "base/test/test_suite.h" | 14 #include "base/test/test_suite.h" |
| 20 | 15 |
| 16 #include "courgette/base_test_unittest.h" |
| 21 #include "courgette/courgette.h" | 17 #include "courgette/courgette.h" |
| 22 #include "courgette/streams.h" | 18 #include "courgette/streams.h" |
| 23 | 19 |
| 24 #include "testing/gtest/include/gtest/gtest.h" | 20 class DecodeFuzzTest : public BaseTest { |
| 25 | |
| 26 class DecodeFuzzTest : public testing::Test { | |
| 27 public: | 21 public: |
| 28 void FuzzExe(const char *) const; | 22 void FuzzExe(const char *) const; |
| 29 | 23 |
| 30 private: | 24 private: |
| 31 virtual void SetUp() { | |
| 32 PathService::Get(base::DIR_SOURCE_ROOT, &testdata_dir_); | |
| 33 testdata_dir_ = testdata_dir_.AppendASCII("courgette"); | |
| 34 testdata_dir_ = testdata_dir_.AppendASCII("testdata"); | |
| 35 } | |
| 36 | |
| 37 virtual void TearDown() { } | |
| 38 | |
| 39 void FuzzByte(const std::string& buffer, const std::string& output, | 25 void FuzzByte(const std::string& buffer, const std::string& output, |
| 40 size_t index) const; | 26 size_t index) const; |
| 41 void FuzzBits(const std::string& buffer, const std::string& output, | 27 void FuzzBits(const std::string& buffer, const std::string& output, |
| 42 size_t index, int bits_to_flip) const; | 28 size_t index, int bits_to_flip) const; |
| 43 | 29 |
| 44 // Returns true if could assemble, false if rejected. | 30 // Returns true if could assemble, false if rejected. |
| 45 bool TryAssemble(const std::string& buffer, std::string* output) const; | 31 bool TryAssemble(const std::string& buffer, std::string* output) const; |
| 46 | |
| 47 // Returns contents of |file_name| as uninterprested bytes stored in a string. | |
| 48 std::string FileContents(const char* file_name) const; | |
| 49 | |
| 50 // Full path name of testdata directory | |
| 51 FilePath testdata_dir_; | |
| 52 }; | 32 }; |
| 53 | 33 |
| 54 // Reads a test file into a string. | |
| 55 std::string DecodeFuzzTest::FileContents(const char* file_name) const { | |
| 56 FilePath file_path = testdata_dir_.AppendASCII(file_name); | |
| 57 std::string file_contents; | |
| 58 if (!file_util::ReadFileToString(file_path, &file_contents)) { | |
| 59 EXPECT_TRUE(!"Could not read test data"); | |
| 60 } | |
| 61 return file_contents; | |
| 62 } | |
| 63 | |
| 64 // Loads an executable and does fuzz testing in the serialized format. | 34 // Loads an executable and does fuzz testing in the serialized format. |
| 65 void DecodeFuzzTest::FuzzExe(const char* file_name) const { | 35 void DecodeFuzzTest::FuzzExe(const char* file_name) const { |
| 66 std::string file1 = FileContents(file_name); | 36 std::string file1 = FileContents(file_name); |
| 67 | 37 |
| 68 const void* original_buffer = file1.c_str(); | 38 const void* original_buffer = file1.c_str(); |
| 69 size_t original_length = file1.size(); | 39 size_t original_length = file1.size(); |
| 70 | 40 |
| 71 courgette::AssemblyProgram* program = NULL; | 41 courgette::AssemblyProgram* program = NULL; |
| 72 const courgette::Status parse_status = | 42 const courgette::Status parse_status = |
| 73 courgette::ParseWin32X86PE(original_buffer, original_length, &program); | 43 courgette::ParseWin32X86PE(original_buffer, original_length, &program); |
| (...skipping 152 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 226 return result; | 196 return result; |
| 227 } | 197 } |
| 228 | 198 |
| 229 TEST_F(DecodeFuzzTest, All) { | 199 TEST_F(DecodeFuzzTest, All) { |
| 230 FuzzExe("setup1.exe"); | 200 FuzzExe("setup1.exe"); |
| 231 } | 201 } |
| 232 | 202 |
| 233 int main(int argc, char** argv) { | 203 int main(int argc, char** argv) { |
| 234 return base::TestSuite(argc, argv).Run(); | 204 return base::TestSuite(argc, argv).Run(); |
| 235 } | 205 } |
| OLD | NEW |