| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdio.h> | 5 #include <stdio.h> |
| 6 #include <string> | 6 #include <string> |
| 7 #include <sstream> | 7 #include <sstream> |
| 8 | 8 |
| 9 #include "base/message_loop.h" | 9 #include "base/message_loop.h" |
| 10 #include "base/process_util.h" | 10 #include "base/process_util.h" |
| (...skipping 246 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 257 return 0; | 257 return 0; |
| 258 } | 258 } |
| 259 | 259 |
| 260 class IPCFuzzingTest : public IPCChannelTest { | 260 class IPCFuzzingTest : public IPCChannelTest { |
| 261 }; | 261 }; |
| 262 | 262 |
| 263 // This test makes sure that the FuzzerClientListener and FuzzerServerListener | 263 // This test makes sure that the FuzzerClientListener and FuzzerServerListener |
| 264 // are working properly by generating two well formed IPC calls. | 264 // are working properly by generating two well formed IPC calls. |
| 265 TEST_F(IPCFuzzingTest, SanityTest) { | 265 TEST_F(IPCFuzzingTest, SanityTest) { |
| 266 FuzzerClientListener listener; | 266 FuzzerClientListener listener; |
| 267 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, | 267 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, &listener); |
| 268 &listener); | |
| 269 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); | 268 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); |
| 270 ASSERT_TRUE(server_process); | 269 ASSERT_TRUE(server_process); |
| 271 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); | 270 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
| 272 ASSERT_TRUE(chan.Connect()); | 271 ASSERT_TRUE(chan.Connect()); |
| 273 listener.Init(&chan); | 272 listener.Init(&chan); |
| 274 | 273 |
| 275 IPC::Message* msg = NULL; | 274 IPC::Message* msg = NULL; |
| 276 int value = 43; | 275 int value = 43; |
| 277 msg = new MsgClassIS(value, L"expect 43"); | 276 msg = new MsgClassIS(value, L"expect 43"); |
| 278 chan.Send(msg); | 277 chan.Send(msg); |
| 279 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID)); | 278 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID)); |
| 280 | 279 |
| 281 msg = new MsgClassSI(L"expect 44", ++value); | 280 msg = new MsgClassSI(L"expect 44", ++value); |
| 282 chan.Send(msg); | 281 chan.Send(msg); |
| 283 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID)); | 282 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID)); |
| 284 | 283 |
| 285 EXPECT_TRUE(base::WaitForSingleProcess( | 284 EXPECT_TRUE(base::WaitForSingleProcess( |
| 286 server_process, base::TimeDelta::FromSeconds(5))); | 285 server_process, base::TimeDelta::FromSeconds(5))); |
| 287 base::CloseProcessHandle(server_process); | 286 base::CloseProcessHandle(server_process); |
| 288 } | 287 } |
| 289 | 288 |
| 290 // This test uses a payload that is smaller than expected. | 289 // This test uses a payload that is smaller than expected. |
| 291 // This generates an error while unpacking the IPC buffer which in | 290 // This generates an error while unpacking the IPC buffer which in |
| 292 // In debug this triggers an assertion and in release it is ignored(!!). Right | 291 // In debug this triggers an assertion and in release it is ignored(!!). Right |
| 293 // after we generate another valid IPC to make sure framing is working | 292 // after we generate another valid IPC to make sure framing is working |
| 294 // properly. | 293 // properly. |
| 295 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) | 294 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) |
| 296 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { | 295 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { |
| 297 FuzzerClientListener listener; | 296 FuzzerClientListener listener; |
| 298 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, | 297 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, &listener); |
| 299 &listener); | |
| 300 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); | 298 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); |
| 301 ASSERT_TRUE(server_process); | 299 ASSERT_TRUE(server_process); |
| 302 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); | 300 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
| 303 ASSERT_TRUE(chan.Connect()); | 301 ASSERT_TRUE(chan.Connect()); |
| 304 listener.Init(&chan); | 302 listener.Init(&chan); |
| 305 | 303 |
| 306 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, | 304 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, |
| 307 IPC::Message::PRIORITY_NORMAL); | 305 IPC::Message::PRIORITY_NORMAL); |
| 308 msg->WriteInt(666); | 306 msg->WriteInt(666); |
| 309 chan.Send(msg); | 307 chan.Send(msg); |
| 310 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); | 308 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); |
| 311 | 309 |
| 312 msg = new MsgClassSI(L"expect one", 1); | 310 msg = new MsgClassSI(L"expect one", 1); |
| 313 chan.Send(msg); | 311 chan.Send(msg); |
| 314 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); | 312 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); |
| 315 | 313 |
| 316 EXPECT_TRUE(base::WaitForSingleProcess( | 314 EXPECT_TRUE(base::WaitForSingleProcess( |
| 317 server_process, base::TimeDelta::FromSeconds(5))); | 315 server_process, base::TimeDelta::FromSeconds(5))); |
| 318 base::CloseProcessHandle(server_process); | 316 base::CloseProcessHandle(server_process); |
| 319 } | 317 } |
| 320 #endif | 318 #endif |
| 321 | 319 |
| 322 // This test uses a payload that has too many arguments, but so the payload | 320 // This test uses a payload that has too many arguments, but so the payload |
| 323 // size is big enough so the unpacking routine does not generate an error as | 321 // size is big enough so the unpacking routine does not generate an error as |
| 324 // in the case of MsgBadPayloadShort test. | 322 // in the case of MsgBadPayloadShort test. |
| 325 // This test does not pinpoint a flaw (per se) as by design we don't carry | 323 // This test does not pinpoint a flaw (per se) as by design we don't carry |
| 326 // type information on the IPC message. | 324 // type information on the IPC message. |
| 327 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { | 325 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { |
| 328 FuzzerClientListener listener; | 326 FuzzerClientListener listener; |
| 329 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, | 327 IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER, &listener); |
| 330 &listener); | |
| 331 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); | 328 base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan); |
| 332 ASSERT_TRUE(server_process); | 329 ASSERT_TRUE(server_process); |
| 333 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); | 330 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
| 334 ASSERT_TRUE(chan.Connect()); | 331 ASSERT_TRUE(chan.Connect()); |
| 335 listener.Init(&chan); | 332 listener.Init(&chan); |
| 336 | 333 |
| 337 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, | 334 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, |
| 338 IPC::Message::PRIORITY_NORMAL); | 335 IPC::Message::PRIORITY_NORMAL); |
| 339 msg->WriteWString(L"d"); | 336 msg->WriteWString(L"d"); |
| 340 msg->WriteInt(0); | 337 msg->WriteInt(0); |
| (...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 411 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, | 408 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, |
| 412 IPC::Message::PRIORITY_NORMAL); | 409 IPC::Message::PRIORITY_NORMAL); |
| 413 msg->WriteInt(0x64); | 410 msg->WriteInt(0x64); |
| 414 msg->WriteInt(0x32); | 411 msg->WriteInt(0x32); |
| 415 EXPECT_FALSE(server.OnMessageReceived(*msg)); | 412 EXPECT_FALSE(server.OnMessageReceived(*msg)); |
| 416 delete msg; | 413 delete msg; |
| 417 | 414 |
| 418 EXPECT_EQ(0, server.unhandled_msgs()); | 415 EXPECT_EQ(0, server.unhandled_msgs()); |
| 419 #endif | 416 #endif |
| 420 } | 417 } |
| OLD | NEW |