OLD | NEW |
1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // Fuzz testing for EncodedProgram serialized format and assembly. | 5 // Fuzz testing for EncodedProgram serialized format and assembly. |
6 // | 6 // |
7 // We would like some assurance that if an EncodedProgram is malformed we will | 7 // We would like some assurance that if an EncodedProgram is malformed we will |
8 // not crash. The EncodedProgram could be malformed either due to malicious | 8 // not crash. The EncodedProgram could be malformed either due to malicious |
9 // attack to due to an error in patch generation. | 9 // attack to due to an error in patch generation. |
10 // | 10 // |
11 // We try a lot of arbitrary modifications to the serialized form and make sure | 11 // We try a lot of arbitrary modifications to the serialized form and make sure |
12 // that the outcome is not a crash. | 12 // that the outcome is not a crash. |
13 | 13 |
14 #include <string> | |
15 | |
16 #include "base/path_service.h" | |
17 #include "base/file_util.h" | |
18 #include "base/string_util.h" | |
19 #include "base/test/test_suite.h" | 14 #include "base/test/test_suite.h" |
20 | 15 |
| 16 #include "courgette/base_test_unittest.h" |
21 #include "courgette/courgette.h" | 17 #include "courgette/courgette.h" |
22 #include "courgette/streams.h" | 18 #include "courgette/streams.h" |
23 | 19 |
24 #include "testing/gtest/include/gtest/gtest.h" | 20 class DecodeFuzzTest : public BaseTest { |
25 | |
26 class DecodeFuzzTest : public testing::Test { | |
27 public: | 21 public: |
28 void FuzzExe(const char *) const; | 22 void FuzzExe(const char *) const; |
29 | 23 |
30 private: | 24 private: |
31 virtual void SetUp() { | |
32 PathService::Get(base::DIR_SOURCE_ROOT, &testdata_dir_); | |
33 testdata_dir_ = testdata_dir_.AppendASCII("courgette"); | |
34 testdata_dir_ = testdata_dir_.AppendASCII("testdata"); | |
35 } | |
36 | |
37 virtual void TearDown() { } | |
38 | |
39 void FuzzByte(const std::string& buffer, const std::string& output, | 25 void FuzzByte(const std::string& buffer, const std::string& output, |
40 size_t index) const; | 26 size_t index) const; |
41 void FuzzBits(const std::string& buffer, const std::string& output, | 27 void FuzzBits(const std::string& buffer, const std::string& output, |
42 size_t index, int bits_to_flip) const; | 28 size_t index, int bits_to_flip) const; |
43 | 29 |
44 // Returns true if could assemble, false if rejected. | 30 // Returns true if could assemble, false if rejected. |
45 bool TryAssemble(const std::string& buffer, std::string* output) const; | 31 bool TryAssemble(const std::string& buffer, std::string* output) const; |
46 | |
47 // Returns contents of |file_name| as uninterprested bytes stored in a string. | |
48 std::string FileContents(const char* file_name) const; | |
49 | |
50 // Full path name of testdata directory | |
51 FilePath testdata_dir_; | |
52 }; | 32 }; |
53 | 33 |
54 // Reads a test file into a string. | |
55 std::string DecodeFuzzTest::FileContents(const char* file_name) const { | |
56 FilePath file_path = testdata_dir_.AppendASCII(file_name); | |
57 std::string file_contents; | |
58 if (!file_util::ReadFileToString(file_path, &file_contents)) { | |
59 EXPECT_TRUE(!"Could not read test data"); | |
60 } | |
61 return file_contents; | |
62 } | |
63 | |
64 // Loads an executable and does fuzz testing in the serialized format. | 34 // Loads an executable and does fuzz testing in the serialized format. |
65 void DecodeFuzzTest::FuzzExe(const char* file_name) const { | 35 void DecodeFuzzTest::FuzzExe(const char* file_name) const { |
66 std::string file1 = FileContents(file_name); | 36 std::string file1 = FileContents(file_name); |
67 | 37 |
68 const void* original_buffer = file1.c_str(); | 38 const void* original_buffer = file1.c_str(); |
69 size_t original_length = file1.size(); | 39 size_t original_length = file1.size(); |
70 | 40 |
71 courgette::AssemblyProgram* program = NULL; | 41 courgette::AssemblyProgram* program = NULL; |
72 const courgette::Status parse_status = | 42 const courgette::Status parse_status = |
73 courgette::ParseWin32X86PE(original_buffer, original_length, &program); | 43 courgette::ParseWin32X86PE(original_buffer, original_length, &program); |
(...skipping 152 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
226 return result; | 196 return result; |
227 } | 197 } |
228 | 198 |
229 TEST_F(DecodeFuzzTest, All) { | 199 TEST_F(DecodeFuzzTest, All) { |
230 FuzzExe("setup1.exe"); | 200 FuzzExe("setup1.exe"); |
231 } | 201 } |
232 | 202 |
233 int main(int argc, char** argv) { | 203 int main(int argc, char** argv) { |
234 return base::TestSuite(argc, argv).Run(); | 204 return base::TestSuite(argc, argv).Run(); |
235 } | 205 } |
OLD | NEW |