| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdint.h> |
| 5 #include <stdio.h> | 6 #include <stdio.h> |
| 7 |
| 8 #include <sstream> |
| 6 #include <string> | 9 #include <string> |
| 7 #include <sstream> | |
| 8 | 10 |
| 9 #include "base/message_loop/message_loop.h" | 11 #include "base/message_loop/message_loop.h" |
| 10 #include "base/strings/string16.h" | 12 #include "base/strings/string16.h" |
| 11 #include "base/strings/utf_string_conversions.h" | 13 #include "base/strings/utf_string_conversions.h" |
| 12 #include "base/threading/platform_thread.h" | 14 #include "base/threading/platform_thread.h" |
| 13 #include "ipc/ipc_test_base.h" | 15 #include "ipc/ipc_test_base.h" |
| 14 #include "testing/gtest/include/gtest/gtest.h" | 16 #include "testing/gtest/include/gtest/gtest.h" |
| 15 | 17 |
| 16 // IPC messages for testing ---------------------------------------------------- | 18 // IPC messages for testing ---------------------------------------------------- |
| 17 | 19 |
| (...skipping 13 matching lines...) Expand all Loading... |
| 31 | 33 |
| 32 // Used to generate an ID for a message that should not exist. | 34 // Used to generate an ID for a message that should not exist. |
| 33 IPC_MESSAGE_CONTROL0(MsgUnhandled) | 35 IPC_MESSAGE_CONTROL0(MsgUnhandled) |
| 34 | 36 |
| 35 // ----------------------------------------------------------------------------- | 37 // ----------------------------------------------------------------------------- |
| 36 | 38 |
| 37 namespace { | 39 namespace { |
| 38 | 40 |
| 39 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { | 41 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { |
| 40 // This was BUG 984408. | 42 // This was BUG 984408. |
| 41 uint32 v1 = kuint32max - 1; | 43 uint32_t v1 = kuint32max - 1; |
| 42 int v2 = 666; | 44 int v2 = 666; |
| 43 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 45 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
| 44 EXPECT_TRUE(m.WriteInt(v1)); | 46 EXPECT_TRUE(m.WriteInt(v1)); |
| 45 EXPECT_TRUE(m.WriteInt(v2)); | 47 EXPECT_TRUE(m.WriteInt(v2)); |
| 46 | 48 |
| 47 base::PickleIterator iter(m); | 49 base::PickleIterator iter(m); |
| 48 std::string vs; | 50 std::string vs; |
| 49 EXPECT_FALSE(iter.ReadString(&vs)); | 51 EXPECT_FALSE(iter.ReadString(&vs)); |
| 50 } | 52 } |
| 51 | 53 |
| 52 TEST(IPCMessageIntegrity, ReadBeyondBufferStr16) { | 54 TEST(IPCMessageIntegrity, ReadBeyondBufferStr16) { |
| 53 // This was BUG 984408. | 55 // This was BUG 984408. |
| 54 uint32 v1 = kuint32max - 1; | 56 uint32_t v1 = kuint32max - 1; |
| 55 int v2 = 777; | 57 int v2 = 777; |
| 56 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 58 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
| 57 EXPECT_TRUE(m.WriteInt(v1)); | 59 EXPECT_TRUE(m.WriteInt(v1)); |
| 58 EXPECT_TRUE(m.WriteInt(v2)); | 60 EXPECT_TRUE(m.WriteInt(v2)); |
| 59 | 61 |
| 60 base::PickleIterator iter(m); | 62 base::PickleIterator iter(m); |
| 61 base::string16 vs; | 63 base::string16 vs; |
| 62 EXPECT_FALSE(iter.ReadString16(&vs)); | 64 EXPECT_FALSE(iter.ReadString16(&vs)); |
| 63 } | 65 } |
| 64 | 66 |
| (...skipping 29 matching lines...) Expand all Loading... |
| 94 #define MAYBE_ReadVectorTooLarge1 ReadVectorTooLarge1 | 96 #define MAYBE_ReadVectorTooLarge1 ReadVectorTooLarge1 |
| 95 #endif | 97 #endif |
| 96 TEST(IPCMessageIntegrity, MAYBE_ReadVectorTooLarge1) { | 98 TEST(IPCMessageIntegrity, MAYBE_ReadVectorTooLarge1) { |
| 97 // This was BUG 1006367. This is the large but positive length case. Again | 99 // This was BUG 1006367. This is the large but positive length case. Again |
| 98 // we try to hit the non-specialized case vector<P>. | 100 // we try to hit the non-specialized case vector<P>. |
| 99 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 101 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
| 100 EXPECT_TRUE(m.WriteInt(0x21000003)); // This is the count of elements. | 102 EXPECT_TRUE(m.WriteInt(0x21000003)); // This is the count of elements. |
| 101 EXPECT_TRUE(m.WriteInt64(1)); | 103 EXPECT_TRUE(m.WriteInt64(1)); |
| 102 EXPECT_TRUE(m.WriteInt64(2)); | 104 EXPECT_TRUE(m.WriteInt64(2)); |
| 103 | 105 |
| 104 std::vector<int64> vec; | 106 std::vector<int64_t> vec; |
| 105 base::PickleIterator iter(m); | 107 base::PickleIterator iter(m); |
| 106 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); | 108 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); |
| 107 } | 109 } |
| 108 | 110 |
| 109 TEST(IPCMessageIntegrity, ReadVectorTooLarge2) { | 111 TEST(IPCMessageIntegrity, ReadVectorTooLarge2) { |
| 110 // This was BUG 1006367. This is the large but positive with an additional | 112 // This was BUG 1006367. This is the large but positive with an additional |
| 111 // integer overflow when computing the actual byte size. Again we try to hit | 113 // integer overflow when computing the actual byte size. Again we try to hit |
| 112 // the non-specialized case vector<P>. | 114 // the non-specialized case vector<P>. |
| 113 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 115 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
| 114 EXPECT_TRUE(m.WriteInt(0x71000000)); // This is the count of elements. | 116 EXPECT_TRUE(m.WriteInt(0x71000000)); // This is the count of elements. |
| 115 EXPECT_TRUE(m.WriteInt64(1)); | 117 EXPECT_TRUE(m.WriteInt64(1)); |
| 116 EXPECT_TRUE(m.WriteInt64(2)); | 118 EXPECT_TRUE(m.WriteInt64(2)); |
| 117 | 119 |
| 118 std::vector<int64> vec; | 120 std::vector<int64_t> vec; |
| 119 base::PickleIterator iter(m); | 121 base::PickleIterator iter(m); |
| 120 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); | 122 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); |
| 121 } | 123 } |
| 122 | 124 |
| 123 class SimpleListener : public IPC::Listener { | 125 class SimpleListener : public IPC::Listener { |
| 124 public: | 126 public: |
| 125 SimpleListener() : other_(NULL) { | 127 SimpleListener() : other_(NULL) { |
| 126 } | 128 } |
| 127 void Init(IPC::Sender* s) { | 129 void Init(IPC::Sender* s) { |
| 128 other_ = s; | 130 other_ = s; |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 163 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassIS::ID, value); | 165 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassIS::ID, value); |
| 164 Cleanup(); | 166 Cleanup(); |
| 165 } | 167 } |
| 166 | 168 |
| 167 void OnMsgClassSIMessage(const base::string16& text, int value) { | 169 void OnMsgClassSIMessage(const base::string16& text, int value) { |
| 168 UseData(MsgClassSI::ID, value, text); | 170 UseData(MsgClassSI::ID, value, text); |
| 169 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value); | 171 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value); |
| 170 Cleanup(); | 172 Cleanup(); |
| 171 } | 173 } |
| 172 | 174 |
| 173 bool RoundtripAckReply(int routing, uint32 type_id, int reply) { | 175 bool RoundtripAckReply(int routing, uint32_t type_id, int reply) { |
| 174 IPC::Message* message = new IPC::Message(routing, type_id, | 176 IPC::Message* message = new IPC::Message(routing, type_id, |
| 175 IPC::Message::PRIORITY_NORMAL); | 177 IPC::Message::PRIORITY_NORMAL); |
| 176 message->WriteInt(reply + 1); | 178 message->WriteInt(reply + 1); |
| 177 message->WriteInt(reply); | 179 message->WriteInt(reply); |
| 178 return other_->Send(message); | 180 return other_->Send(message); |
| 179 } | 181 } |
| 180 | 182 |
| 181 void Cleanup() { | 183 void Cleanup() { |
| 182 --message_count_; | 184 --message_count_; |
| 183 --pending_messages_; | 185 --pending_messages_; |
| 184 if (0 == message_count_) | 186 if (0 == message_count_) |
| 185 base::MessageLoop::current()->Quit(); | 187 base::MessageLoop::current()->Quit(); |
| 186 } | 188 } |
| 187 | 189 |
| 188 void ReplyMsgNotHandled(uint32 type_id) { | 190 void ReplyMsgNotHandled(uint32_t type_id) { |
| 189 RoundtripAckReply(FUZZER_ROUTING_ID, MsgUnhandled::ID, type_id); | 191 RoundtripAckReply(FUZZER_ROUTING_ID, MsgUnhandled::ID, type_id); |
| 190 Cleanup(); | 192 Cleanup(); |
| 191 } | 193 } |
| 192 | 194 |
| 193 void UseData(int caller, int value, const base::string16& text) { | 195 void UseData(int caller, int value, const base::string16& text) { |
| 194 std::ostringstream os; | 196 std::ostringstream os; |
| 195 os << "IPC fuzzer:" << caller << " [" << value << " " | 197 os << "IPC fuzzer:" << caller << " [" << value << " " |
| 196 << base::UTF16ToUTF8(text) << "]\n"; | 198 << base::UTF16ToUTF8(text) << "]\n"; |
| 197 std::string output = os.str(); | 199 std::string output = os.str(); |
| 198 LOG(WARNING) << output; | 200 LOG(WARNING) << output; |
| 199 } | 201 } |
| 200 | 202 |
| 201 int message_count_; | 203 int message_count_; |
| 202 int pending_messages_; | 204 int pending_messages_; |
| 203 }; | 205 }; |
| 204 | 206 |
| 205 class FuzzerClientListener : public SimpleListener { | 207 class FuzzerClientListener : public SimpleListener { |
| 206 public: | 208 public: |
| 207 FuzzerClientListener() : last_msg_(NULL) { | 209 FuzzerClientListener() : last_msg_(NULL) { |
| 208 } | 210 } |
| 209 | 211 |
| 210 bool OnMessageReceived(const IPC::Message& msg) override { | 212 bool OnMessageReceived(const IPC::Message& msg) override { |
| 211 last_msg_ = new IPC::Message(msg); | 213 last_msg_ = new IPC::Message(msg); |
| 212 base::MessageLoop::current()->Quit(); | 214 base::MessageLoop::current()->Quit(); |
| 213 return true; | 215 return true; |
| 214 } | 216 } |
| 215 | 217 |
| 216 bool ExpectMessage(int value, uint32 type_id) { | 218 bool ExpectMessage(int value, uint32_t type_id) { |
| 217 if (!MsgHandlerInternal(type_id)) | 219 if (!MsgHandlerInternal(type_id)) |
| 218 return false; | 220 return false; |
| 219 int msg_value1 = 0; | 221 int msg_value1 = 0; |
| 220 int msg_value2 = 0; | 222 int msg_value2 = 0; |
| 221 base::PickleIterator iter(*last_msg_); | 223 base::PickleIterator iter(*last_msg_); |
| 222 if (!iter.ReadInt(&msg_value1)) | 224 if (!iter.ReadInt(&msg_value1)) |
| 223 return false; | 225 return false; |
| 224 if (!iter.ReadInt(&msg_value2)) | 226 if (!iter.ReadInt(&msg_value2)) |
| 225 return false; | 227 return false; |
| 226 if ((msg_value2 + 1) != msg_value1) | 228 if ((msg_value2 + 1) != msg_value1) |
| 227 return false; | 229 return false; |
| 228 if (msg_value2 != value) | 230 if (msg_value2 != value) |
| 229 return false; | 231 return false; |
| 230 | 232 |
| 231 delete last_msg_; | 233 delete last_msg_; |
| 232 last_msg_ = NULL; | 234 last_msg_ = NULL; |
| 233 return true; | 235 return true; |
| 234 } | 236 } |
| 235 | 237 |
| 236 bool ExpectMsgNotHandled(uint32 type_id) { | 238 bool ExpectMsgNotHandled(uint32_t type_id) { |
| 237 return ExpectMessage(type_id, MsgUnhandled::ID); | 239 return ExpectMessage(type_id, MsgUnhandled::ID); |
| 238 } | 240 } |
| 239 | 241 |
| 240 private: | 242 private: |
| 241 bool MsgHandlerInternal(uint32 type_id) { | 243 bool MsgHandlerInternal(uint32_t type_id) { |
| 242 base::MessageLoop::current()->Run(); | 244 base::MessageLoop::current()->Run(); |
| 243 if (NULL == last_msg_) | 245 if (NULL == last_msg_) |
| 244 return false; | 246 return false; |
| 245 if (FUZZER_ROUTING_ID != last_msg_->routing_id()) | 247 if (FUZZER_ROUTING_ID != last_msg_->routing_id()) |
| 246 return false; | 248 return false; |
| 247 return (type_id == last_msg_->type()); | 249 return (type_id == last_msg_->type()); |
| 248 } | 250 } |
| 249 | 251 |
| 250 IPC::Message* last_msg_; | 252 IPC::Message* last_msg_; |
| 251 }; | 253 }; |
| (...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 361 // thrown out of sync by the extra argument. | 363 // thrown out of sync by the extra argument. |
| 362 msg = new MsgClassIS(3, base::ASCIIToUTF16("expect three")); | 364 msg = new MsgClassIS(3, base::ASCIIToUTF16("expect three")); |
| 363 sender()->Send(msg); | 365 sender()->Send(msg); |
| 364 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); | 366 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); |
| 365 | 367 |
| 366 EXPECT_TRUE(WaitForClientShutdown()); | 368 EXPECT_TRUE(WaitForClientShutdown()); |
| 367 DestroyChannel(); | 369 DestroyChannel(); |
| 368 } | 370 } |
| 369 | 371 |
| 370 } // namespace | 372 } // namespace |
| OLD | NEW |