| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <algorithm> | 5 #include <algorithm> |
| 6 #include <ostream> | 6 #include <ostream> |
| 7 #include <set> | 7 #include <set> |
| 8 #include <vector> | 8 #include <vector> |
| 9 | 9 |
| 10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
| 11 #include "base/hash_tables.h" | 11 #include "base/hash_tables.h" |
| 12 #include "base/memory/scoped_ptr.h" | 12 #include "base/memory/scoped_ptr.h" |
| 13 #include "base/memory/singleton.h" | 13 #include "base/memory/singleton.h" |
| 14 #include "base/message_loop.h" | 14 #include "base/message_loop.h" |
| 15 #include "base/pickle.h" | 15 #include "base/pickle.h" |
| 16 #include "base/process_util.h" | 16 #include "base/process_util.h" |
| 17 #include "base/string_number_conversions.h" | 17 #include "base/string_number_conversions.h" |
| 18 #include "base/string_util.h" | 18 #include "base/string_util.h" |
| 19 #include "base/threading/thread.h" | 19 #include "base/threading/thread.h" |
| 20 #include "base/time.h" | 20 #include "base/time.h" |
| 21 #include "base/utf_string_conversions.h" | 21 #include "base/utf_string_conversions.h" |
| 22 #include "chrome/common/all_messages.h" | 22 #include "chrome/common/all_messages.h" |
| 23 #include "content/common/all_messages.h" |
| 23 #include "ipc/ipc_message.h" | 24 #include "ipc/ipc_message.h" |
| 24 #include "ipc/ipc_message_utils.h" | 25 #include "ipc/ipc_message_utils.h" |
| 25 #include "ipc/ipc_switches.h" | 26 #include "ipc/ipc_switches.h" |
| 26 #include "ipc/ipc_sync_channel.h" | 27 #include "ipc/ipc_sync_channel.h" |
| 27 #include "ipc/ipc_sync_message.h" | 28 #include "ipc/ipc_sync_message.h" |
| 28 | 29 |
| 29 #if defined(OS_POSIX) | 30 #if defined(OS_POSIX) |
| 30 #include <unistd.h> | 31 #include <unistd.h> |
| 31 #endif | 32 #endif |
| 32 | 33 |
| (...skipping 510 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 543 #define IPC_ENUM_TRAITS(enum_name) \ | 544 #define IPC_ENUM_TRAITS(enum_name) \ |
| 544 template <> \ | 545 template <> \ |
| 545 struct FuzzTraits<enum_name> { \ | 546 struct FuzzTraits<enum_name> { \ |
| 546 static void Fuzz(enum_name* p, IPC::Fuzzer* fuzzer) { \ | 547 static void Fuzz(enum_name* p, IPC::Fuzzer* fuzzer) { \ |
| 547 FuzzParam(reinterpret_cast<int*>(p), fuzzer); \ | 548 FuzzParam(reinterpret_cast<int*>(p), fuzzer); \ |
| 548 } \ | 549 } \ |
| 549 }; | 550 }; |
| 550 | 551 |
| 551 // Bring them into existence. | 552 // Bring them into existence. |
| 552 #include "chrome/common/all_messages.h" | 553 #include "chrome/common/all_messages.h" |
| 554 #include "content/common/all_messages.h" |
| 553 | 555 |
| 554 // Redefine macros to generate fuzzing funtions | 556 // Redefine macros to generate fuzzing funtions |
| 555 #include "ipc/ipc_message_null_macros.h" | 557 #include "ipc/ipc_message_null_macros.h" |
| 556 #undef IPC_MESSAGE_DECL | 558 #undef IPC_MESSAGE_DECL |
| 557 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ | 559 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ |
| 558 IPC_##kind##_##type##_FUZZ(name, in, out, ilist, olist) | 560 IPC_##kind##_##type##_FUZZ(name, in, out, ilist, olist) |
| 559 | 561 |
| 560 #define IPC_EMPTY_CONTROL_FUZZ(name, in, out, ilist, olist) \ | 562 #define IPC_EMPTY_CONTROL_FUZZ(name, in, out, ilist, olist) \ |
| 561 IPC::Message* fuzzer_for_##name(IPC::Message *msg, IPC::Fuzzer* fuzzer) { \ | 563 IPC::Message* fuzzer_for_##name(IPC::Message *msg, IPC::Fuzzer* fuzzer) { \ |
| 562 return NULL; \ | 564 return NULL; \ |
| (...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 628 #define IPC_MEMBERS_IN_5(p) p.a, p.b, p.c, p.d, p.e | 630 #define IPC_MEMBERS_IN_5(p) p.a, p.b, p.c, p.d, p.e |
| 629 | 631 |
| 630 #define IPC_MEMBERS_OUT_0() | 632 #define IPC_MEMBERS_OUT_0() |
| 631 #define IPC_MEMBERS_OUT_1() NULL | 633 #define IPC_MEMBERS_OUT_1() NULL |
| 632 #define IPC_MEMBERS_OUT_2() NULL, NULL | 634 #define IPC_MEMBERS_OUT_2() NULL, NULL |
| 633 #define IPC_MEMBERS_OUT_3() NULL, NULL, NULL | 635 #define IPC_MEMBERS_OUT_3() NULL, NULL, NULL |
| 634 #define IPC_MEMBERS_OUT_4() NULL, NULL, NULL, NULL | 636 #define IPC_MEMBERS_OUT_4() NULL, NULL, NULL, NULL |
| 635 #define IPC_MEMBERS_OUT_5() NULL, NULL, NULL, NULL, NULL | 637 #define IPC_MEMBERS_OUT_5() NULL, NULL, NULL, NULL, NULL |
| 636 | 638 |
| 637 #include "chrome/common/all_messages.h" | 639 #include "chrome/common/all_messages.h" |
| 640 #include "content/common/all_messages.h" |
| 638 | 641 |
| 639 typedef IPC::Message* (*FuzzFunction)(IPC::Message*, IPC::Fuzzer*); | 642 typedef IPC::Message* (*FuzzFunction)(IPC::Message*, IPC::Fuzzer*); |
| 640 typedef base::hash_map<uint32, FuzzFunction> FuzzFunctionMap; | 643 typedef base::hash_map<uint32, FuzzFunction> FuzzFunctionMap; |
| 641 | 644 |
| 642 // Redefine macros to register fuzzing functions into map. | 645 // Redefine macros to register fuzzing functions into map. |
| 643 #include "ipc/ipc_message_null_macros.h" | 646 #include "ipc/ipc_message_null_macros.h" |
| 644 #undef IPC_MESSAGE_DECL | 647 #undef IPC_MESSAGE_DECL |
| 645 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ | 648 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ |
| 646 (*map)[static_cast<uint32>(name::ID)] = fuzzer_for_##name; | 649 (*map)[static_cast<uint32>(name::ID)] = fuzzer_for_##name; |
| 647 | 650 |
| 648 void PopulateFuzzFunctionMap(FuzzFunctionMap *map) { | 651 void PopulateFuzzFunctionMap(FuzzFunctionMap *map) { |
| 649 #include "chrome/common/all_messages.h" | 652 #include "chrome/common/all_messages.h" |
| 653 #include "content/common/all_messages.h" |
| 650 } | 654 } |
| 651 | 655 |
| 652 class ipcfuzz : public IPC::ChannelProxy::OutgoingMessageFilter { | 656 class ipcfuzz : public IPC::ChannelProxy::OutgoingMessageFilter { |
| 653 public: | 657 public: |
| 654 ipcfuzz() { | 658 ipcfuzz() { |
| 655 const char* env_var = getenv("CHROME_IPC_FUZZING_KIND"); | 659 const char* env_var = getenv("CHROME_IPC_FUZZING_KIND"); |
| 656 fuzzer_ = FuzzerFactory::NewFuzzer(env_var ? env_var : ""); | 660 fuzzer_ = FuzzerFactory::NewFuzzer(env_var ? env_var : ""); |
| 657 PopulateFuzzFunctionMap(&fuzz_function_map_); | 661 PopulateFuzzFunctionMap(&fuzz_function_map_); |
| 658 } | 662 } |
| 659 | 663 |
| (...skipping 20 matching lines...) Expand all Loading... |
| 680 | 684 |
| 681 // Entry point avoiding mangled names. | 685 // Entry point avoiding mangled names. |
| 682 extern "C" { | 686 extern "C" { |
| 683 __attribute__((visibility("default"))) | 687 __attribute__((visibility("default"))) |
| 684 IPC::ChannelProxy::OutgoingMessageFilter* GetFilter(void); | 688 IPC::ChannelProxy::OutgoingMessageFilter* GetFilter(void); |
| 685 } | 689 } |
| 686 | 690 |
| 687 IPC::ChannelProxy::OutgoingMessageFilter* GetFilter(void) { | 691 IPC::ChannelProxy::OutgoingMessageFilter* GetFilter(void) { |
| 688 return &g_ipcfuzz; | 692 return &g_ipcfuzz; |
| 689 } | 693 } |
| OLD | NEW |