OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <stdio.h> | 5 #include <stdio.h> |
6 #include <string> | 6 #include <string> |
7 #include <sstream> | 7 #include <sstream> |
8 | 8 |
9 #include "base/message_loop.h" | 9 #include "base/message_loop.h" |
10 #include "base/process_util.h" | 10 #include "base/process_util.h" |
(...skipping 246 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
257 return 0; | 257 return 0; |
258 } | 258 } |
259 | 259 |
260 class IPCFuzzingTest : public IPCChannelTest { | 260 class IPCFuzzingTest : public IPCChannelTest { |
261 }; | 261 }; |
262 | 262 |
263 // This test makes sure that the FuzzerClientListener and FuzzerServerListener | 263 // This test makes sure that the FuzzerClientListener and FuzzerServerListener |
264 // are working properly by generating two well formed IPC calls. | 264 // are working properly by generating two well formed IPC calls. |
265 TEST_F(IPCFuzzingTest, SanityTest) { | 265 TEST_F(IPCFuzzingTest, SanityTest) { |
266 FuzzerClientListener listener; | 266 FuzzerClientListener listener; |
267 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, | 267 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, &listener); |
268 &listener); | |
269 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); | 268 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); |
270 ASSERT_TRUE(server_process); | 269 ASSERT_TRUE(server_process); |
271 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); | 270 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
272 ASSERT_TRUE(chan.Connect()); | 271 ASSERT_TRUE(chan.Connect()); |
273 listener.Init(&chan); | 272 listener.Init(&chan); |
274 | 273 |
275 IPC::Message* msg = NULL; | 274 IPC::Message* msg = NULL; |
276 int value = 43; | 275 int value = 43; |
277 msg = new MsgClassIS(value, L"expect 43"); | 276 msg = new MsgClassIS(value, L"expect 43"); |
278 chan.Send(msg); | 277 chan.Send(msg); |
279 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID)); | 278 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID)); |
280 | 279 |
281 msg = new MsgClassSI(L"expect 44", ++value); | 280 msg = new MsgClassSI(L"expect 44", ++value); |
282 chan.Send(msg); | 281 chan.Send(msg); |
283 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID)); | 282 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID)); |
284 | 283 |
285 EXPECT_TRUE(base::WaitForSingleProcess( | 284 EXPECT_TRUE(base::WaitForSingleProcess( |
286 server_process, base::TimeDelta::FromSeconds(5))); | 285 server_process, base::TimeDelta::FromSeconds(5))); |
287 base::CloseProcessHandle(server_process); | 286 base::CloseProcessHandle(server_process); |
288 } | 287 } |
289 | 288 |
290 // This test uses a payload that is smaller than expected. | 289 // This test uses a payload that is smaller than expected. |
291 // This generates an error while unpacking the IPC buffer which in | 290 // This generates an error while unpacking the IPC buffer which in |
292 // In debug this triggers an assertion and in release it is ignored(!!). Right | 291 // In debug this triggers an assertion and in release it is ignored(!!). Right |
293 // after we generate another valid IPC to make sure framing is working | 292 // after we generate another valid IPC to make sure framing is working |
294 // properly. | 293 // properly. |
295 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) | 294 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) |
296 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { | 295 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { |
297 FuzzerClientListener listener; | 296 FuzzerClientListener listener; |
298 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, | 297 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, &listener); |
299 &listener); | |
300 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); | 298 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); |
301 ASSERT_TRUE(server_process); | 299 ASSERT_TRUE(server_process); |
302 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); | 300 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
303 ASSERT_TRUE(chan.Connect()); | 301 ASSERT_TRUE(chan.Connect()); |
304 listener.Init(&chan); | 302 listener.Init(&chan); |
305 | 303 |
306 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, | 304 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, |
307 IPC::Message::PRIORITY_NORMAL); | 305 IPC::Message::PRIORITY_NORMAL); |
308 msg->WriteInt(666); | 306 msg->WriteInt(666); |
309 chan.Send(msg); | 307 chan.Send(msg); |
310 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); | 308 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); |
311 | 309 |
312 msg = new MsgClassSI(L"expect one", 1); | 310 msg = new MsgClassSI(L"expect one", 1); |
313 chan.Send(msg); | 311 chan.Send(msg); |
314 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); | 312 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); |
315 | 313 |
316 EXPECT_TRUE(base::WaitForSingleProcess( | 314 EXPECT_TRUE(base::WaitForSingleProcess( |
317 server_process, base::TimeDelta::FromSeconds(5))); | 315 server_process, base::TimeDelta::FromSeconds(5))); |
318 base::CloseProcessHandle(server_process); | 316 base::CloseProcessHandle(server_process); |
319 } | 317 } |
320 #endif | 318 #endif |
321 | 319 |
322 // This test uses a payload that has too many arguments, but so the payload | 320 // This test uses a payload that has too many arguments, but so the payload |
323 // size is big enough so the unpacking routine does not generate an error as | 321 // size is big enough so the unpacking routine does not generate an error as |
324 // in the case of MsgBadPayloadShort test. | 322 // in the case of MsgBadPayloadShort test. |
325 // This test does not pinpoint a flaw (per se) as by design we don't carry | 323 // This test does not pinpoint a flaw (per se) as by design we don't carry |
326 // type information on the IPC message. | 324 // type information on the IPC message. |
327 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { | 325 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { |
328 FuzzerClientListener listener; | 326 FuzzerClientListener listener; |
329 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, | 327 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, &listener); |
330 &listener); | |
331 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); | 328 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); |
332 ASSERT_TRUE(server_process); | 329 ASSERT_TRUE(server_process); |
333 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); | 330 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
334 ASSERT_TRUE(chan.Connect()); | 331 ASSERT_TRUE(chan.Connect()); |
335 listener.Init(&chan); | 332 listener.Init(&chan); |
336 | 333 |
337 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, | 334 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, |
338 IPC::Message::PRIORITY_NORMAL); | 335 IPC::Message::PRIORITY_NORMAL); |
339 msg->WriteWString(L"d"); | 336 msg->WriteWString(L"d"); |
340 msg->WriteInt(0); | 337 msg->WriteInt(0); |
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
411 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, | 408 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, |
412 IPC::Message::PRIORITY_NORMAL); | 409 IPC::Message::PRIORITY_NORMAL); |
413 msg->WriteInt(0x64); | 410 msg->WriteInt(0x64); |
414 msg->WriteInt(0x32); | 411 msg->WriteInt(0x32); |
415 EXPECT_FALSE(server.OnMessageReceived(*msg)); | 412 EXPECT_FALSE(server.OnMessageReceived(*msg)); |
416 delete msg; | 413 delete msg; |
417 | 414 |
418 EXPECT_EQ(0, server.unhandled_msgs()); | 415 EXPECT_EQ(0, server.unhandled_msgs()); |
419 #endif | 416 #endif |
420 } | 417 } |
OLD | NEW |