| OLD | NEW |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdio.h> | 5 #include <stdio.h> |
| 6 #include <string> | 6 #include <string> |
| 7 #include <sstream> | 7 #include <sstream> |
| 8 | 8 |
| 9 #include "base/message_loop.h" | 9 #include "base/message_loop.h" |
| 10 #include "base/process_util.h" | 10 #include "base/process_util.h" |
| (...skipping 249 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 260 }; | 260 }; |
| 261 | 261 |
| 262 // This test makes sure that the FuzzerClientListener and FuzzerServerListener | 262 // This test makes sure that the FuzzerClientListener and FuzzerServerListener |
| 263 // are working properly by generating two well formed IPC calls. | 263 // are working properly by generating two well formed IPC calls. |
| 264 TEST_F(IPCFuzzingTest, SanityTest) { | 264 TEST_F(IPCFuzzingTest, SanityTest) { |
| 265 FuzzerClientListener listener; | 265 FuzzerClientListener listener; |
| 266 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, | 266 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, |
| 267 &listener); | 267 &listener); |
| 268 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); | 268 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); |
| 269 ASSERT_TRUE(server_process); | 269 ASSERT_TRUE(server_process); |
| 270 base::PlatformThread::Sleep(1000); | 270 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
| 271 ASSERT_TRUE(chan.Connect()); | 271 ASSERT_TRUE(chan.Connect()); |
| 272 listener.Init(&chan); | 272 listener.Init(&chan); |
| 273 | 273 |
| 274 IPC::Message* msg = NULL; | 274 IPC::Message* msg = NULL; |
| 275 int value = 43; | 275 int value = 43; |
| 276 msg = new MsgClassIS(value, L"expect 43"); | 276 msg = new MsgClassIS(value, L"expect 43"); |
| 277 chan.Send(msg); | 277 chan.Send(msg); |
| 278 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID)); | 278 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID)); |
| 279 | 279 |
| 280 msg = new MsgClassSI(L"expect 44", ++value); | 280 msg = new MsgClassSI(L"expect 44", ++value); |
| 281 chan.Send(msg); | 281 chan.Send(msg); |
| 282 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID)); | 282 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID)); |
| 283 | 283 |
| 284 EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000)); | 284 EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000)); |
| 285 base::CloseProcessHandle(server_process); | 285 base::CloseProcessHandle(server_process); |
| 286 } | 286 } |
| 287 | 287 |
| 288 // This test uses a payload that is smaller than expected. | 288 // This test uses a payload that is smaller than expected. |
| 289 // This generates an error while unpacking the IPC buffer which in | 289 // This generates an error while unpacking the IPC buffer which in |
| 290 // In debug this triggers an assertion and in release it is ignored(!!). Right | 290 // In debug this triggers an assertion and in release it is ignored(!!). Right |
| 291 // after we generate another valid IPC to make sure framing is working | 291 // after we generate another valid IPC to make sure framing is working |
| 292 // properly. | 292 // properly. |
| 293 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) | 293 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) |
| 294 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { | 294 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { |
| 295 FuzzerClientListener listener; | 295 FuzzerClientListener listener; |
| 296 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, | 296 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, |
| 297 &listener); | 297 &listener); |
| 298 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); | 298 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); |
| 299 ASSERT_TRUE(server_process); | 299 ASSERT_TRUE(server_process); |
| 300 base::PlatformThread::Sleep(1000); | 300 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
| 301 ASSERT_TRUE(chan.Connect()); | 301 ASSERT_TRUE(chan.Connect()); |
| 302 listener.Init(&chan); | 302 listener.Init(&chan); |
| 303 | 303 |
| 304 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, | 304 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, |
| 305 IPC::Message::PRIORITY_NORMAL); | 305 IPC::Message::PRIORITY_NORMAL); |
| 306 msg->WriteInt(666); | 306 msg->WriteInt(666); |
| 307 chan.Send(msg); | 307 chan.Send(msg); |
| 308 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); | 308 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); |
| 309 | 309 |
| 310 msg = new MsgClassSI(L"expect one", 1); | 310 msg = new MsgClassSI(L"expect one", 1); |
| 311 chan.Send(msg); | 311 chan.Send(msg); |
| 312 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); | 312 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); |
| 313 | 313 |
| 314 EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000)); | 314 EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000)); |
| 315 base::CloseProcessHandle(server_process); | 315 base::CloseProcessHandle(server_process); |
| 316 } | 316 } |
| 317 #endif | 317 #endif |
| 318 | 318 |
| 319 // This test uses a payload that has too many arguments, but so the payload | 319 // This test uses a payload that has too many arguments, but so the payload |
| 320 // size is big enough so the unpacking routine does not generate an error as | 320 // size is big enough so the unpacking routine does not generate an error as |
| 321 // in the case of MsgBadPayloadShort test. | 321 // in the case of MsgBadPayloadShort test. |
| 322 // This test does not pinpoint a flaw (per se) as by design we don't carry | 322 // This test does not pinpoint a flaw (per se) as by design we don't carry |
| 323 // type information on the IPC message. | 323 // type information on the IPC message. |
| 324 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { | 324 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { |
| 325 FuzzerClientListener listener; | 325 FuzzerClientListener listener; |
| 326 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, | 326 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, |
| 327 &listener); | 327 &listener); |
| 328 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); | 328 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); |
| 329 ASSERT_TRUE(server_process); | 329 ASSERT_TRUE(server_process); |
| 330 base::PlatformThread::Sleep(1000); | 330 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
| 331 ASSERT_TRUE(chan.Connect()); | 331 ASSERT_TRUE(chan.Connect()); |
| 332 listener.Init(&chan); | 332 listener.Init(&chan); |
| 333 | 333 |
| 334 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, | 334 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, |
| 335 IPC::Message::PRIORITY_NORMAL); | 335 IPC::Message::PRIORITY_NORMAL); |
| 336 msg->WriteWString(L"d"); | 336 msg->WriteWString(L"d"); |
| 337 msg->WriteInt(0); | 337 msg->WriteInt(0); |
| 338 msg->WriteInt(0x65); // Extra argument. | 338 msg->WriteInt(0x65); // Extra argument. |
| 339 | 339 |
| 340 chan.Send(msg); | 340 chan.Send(msg); |
| (...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 407 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, | 407 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, |
| 408 IPC::Message::PRIORITY_NORMAL); | 408 IPC::Message::PRIORITY_NORMAL); |
| 409 msg->WriteInt(0x64); | 409 msg->WriteInt(0x64); |
| 410 msg->WriteInt(0x32); | 410 msg->WriteInt(0x32); |
| 411 EXPECT_FALSE(server.OnMessageReceived(*msg)); | 411 EXPECT_FALSE(server.OnMessageReceived(*msg)); |
| 412 delete msg; | 412 delete msg; |
| 413 | 413 |
| 414 EXPECT_EQ(0, server.unhandled_msgs()); | 414 EXPECT_EQ(0, server.unhandled_msgs()); |
| 415 #endif | 415 #endif |
| 416 } | 416 } |
| OLD | NEW |