OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
| 5 #include <stdint.h> |
5 #include <stdio.h> | 6 #include <stdio.h> |
| 7 |
| 8 #include <sstream> |
6 #include <string> | 9 #include <string> |
7 #include <sstream> | |
8 | 10 |
9 #include "base/message_loop/message_loop.h" | 11 #include "base/message_loop/message_loop.h" |
10 #include "base/strings/string16.h" | 12 #include "base/strings/string16.h" |
11 #include "base/strings/utf_string_conversions.h" | 13 #include "base/strings/utf_string_conversions.h" |
12 #include "base/threading/platform_thread.h" | 14 #include "base/threading/platform_thread.h" |
13 #include "ipc/ipc_test_base.h" | 15 #include "ipc/ipc_test_base.h" |
14 #include "testing/gtest/include/gtest/gtest.h" | 16 #include "testing/gtest/include/gtest/gtest.h" |
15 | 17 |
16 // IPC messages for testing ---------------------------------------------------- | 18 // IPC messages for testing ---------------------------------------------------- |
17 | 19 |
(...skipping 13 matching lines...) Expand all Loading... |
31 | 33 |
32 // Used to generate an ID for a message that should not exist. | 34 // Used to generate an ID for a message that should not exist. |
33 IPC_MESSAGE_CONTROL0(MsgUnhandled) | 35 IPC_MESSAGE_CONTROL0(MsgUnhandled) |
34 | 36 |
35 // ----------------------------------------------------------------------------- | 37 // ----------------------------------------------------------------------------- |
36 | 38 |
37 namespace { | 39 namespace { |
38 | 40 |
39 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { | 41 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { |
40 // This was BUG 984408. | 42 // This was BUG 984408. |
41 uint32 v1 = kuint32max - 1; | 43 uint32_t v1 = kuint32max - 1; |
42 int v2 = 666; | 44 int v2 = 666; |
43 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 45 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
44 EXPECT_TRUE(m.WriteInt(v1)); | 46 EXPECT_TRUE(m.WriteInt(v1)); |
45 EXPECT_TRUE(m.WriteInt(v2)); | 47 EXPECT_TRUE(m.WriteInt(v2)); |
46 | 48 |
47 base::PickleIterator iter(m); | 49 base::PickleIterator iter(m); |
48 std::string vs; | 50 std::string vs; |
49 EXPECT_FALSE(iter.ReadString(&vs)); | 51 EXPECT_FALSE(iter.ReadString(&vs)); |
50 } | 52 } |
51 | 53 |
52 TEST(IPCMessageIntegrity, ReadBeyondBufferStr16) { | 54 TEST(IPCMessageIntegrity, ReadBeyondBufferStr16) { |
53 // This was BUG 984408. | 55 // This was BUG 984408. |
54 uint32 v1 = kuint32max - 1; | 56 uint32_t v1 = kuint32max - 1; |
55 int v2 = 777; | 57 int v2 = 777; |
56 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 58 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
57 EXPECT_TRUE(m.WriteInt(v1)); | 59 EXPECT_TRUE(m.WriteInt(v1)); |
58 EXPECT_TRUE(m.WriteInt(v2)); | 60 EXPECT_TRUE(m.WriteInt(v2)); |
59 | 61 |
60 base::PickleIterator iter(m); | 62 base::PickleIterator iter(m); |
61 base::string16 vs; | 63 base::string16 vs; |
62 EXPECT_FALSE(iter.ReadString16(&vs)); | 64 EXPECT_FALSE(iter.ReadString16(&vs)); |
63 } | 65 } |
64 | 66 |
(...skipping 29 matching lines...) Expand all Loading... |
94 #define MAYBE_ReadVectorTooLarge1 ReadVectorTooLarge1 | 96 #define MAYBE_ReadVectorTooLarge1 ReadVectorTooLarge1 |
95 #endif | 97 #endif |
96 TEST(IPCMessageIntegrity, MAYBE_ReadVectorTooLarge1) { | 98 TEST(IPCMessageIntegrity, MAYBE_ReadVectorTooLarge1) { |
97 // This was BUG 1006367. This is the large but positive length case. Again | 99 // This was BUG 1006367. This is the large but positive length case. Again |
98 // we try to hit the non-specialized case vector<P>. | 100 // we try to hit the non-specialized case vector<P>. |
99 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 101 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
100 EXPECT_TRUE(m.WriteInt(0x21000003)); // This is the count of elements. | 102 EXPECT_TRUE(m.WriteInt(0x21000003)); // This is the count of elements. |
101 EXPECT_TRUE(m.WriteInt64(1)); | 103 EXPECT_TRUE(m.WriteInt64(1)); |
102 EXPECT_TRUE(m.WriteInt64(2)); | 104 EXPECT_TRUE(m.WriteInt64(2)); |
103 | 105 |
104 std::vector<int64> vec; | 106 std::vector<int64_t> vec; |
105 base::PickleIterator iter(m); | 107 base::PickleIterator iter(m); |
106 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); | 108 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); |
107 } | 109 } |
108 | 110 |
109 TEST(IPCMessageIntegrity, ReadVectorTooLarge2) { | 111 TEST(IPCMessageIntegrity, ReadVectorTooLarge2) { |
110 // This was BUG 1006367. This is the large but positive with an additional | 112 // This was BUG 1006367. This is the large but positive with an additional |
111 // integer overflow when computing the actual byte size. Again we try to hit | 113 // integer overflow when computing the actual byte size. Again we try to hit |
112 // the non-specialized case vector<P>. | 114 // the non-specialized case vector<P>. |
113 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 115 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
114 EXPECT_TRUE(m.WriteInt(0x71000000)); // This is the count of elements. | 116 EXPECT_TRUE(m.WriteInt(0x71000000)); // This is the count of elements. |
115 EXPECT_TRUE(m.WriteInt64(1)); | 117 EXPECT_TRUE(m.WriteInt64(1)); |
116 EXPECT_TRUE(m.WriteInt64(2)); | 118 EXPECT_TRUE(m.WriteInt64(2)); |
117 | 119 |
118 std::vector<int64> vec; | 120 std::vector<int64_t> vec; |
119 base::PickleIterator iter(m); | 121 base::PickleIterator iter(m); |
120 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); | 122 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); |
121 } | 123 } |
122 | 124 |
123 class SimpleListener : public IPC::Listener { | 125 class SimpleListener : public IPC::Listener { |
124 public: | 126 public: |
125 SimpleListener() : other_(NULL) { | 127 SimpleListener() : other_(NULL) { |
126 } | 128 } |
127 void Init(IPC::Sender* s) { | 129 void Init(IPC::Sender* s) { |
128 other_ = s; | 130 other_ = s; |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
163 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassIS::ID, value); | 165 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassIS::ID, value); |
164 Cleanup(); | 166 Cleanup(); |
165 } | 167 } |
166 | 168 |
167 void OnMsgClassSIMessage(const base::string16& text, int value) { | 169 void OnMsgClassSIMessage(const base::string16& text, int value) { |
168 UseData(MsgClassSI::ID, value, text); | 170 UseData(MsgClassSI::ID, value, text); |
169 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value); | 171 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value); |
170 Cleanup(); | 172 Cleanup(); |
171 } | 173 } |
172 | 174 |
173 bool RoundtripAckReply(int routing, uint32 type_id, int reply) { | 175 bool RoundtripAckReply(int routing, uint32_t type_id, int reply) { |
174 IPC::Message* message = new IPC::Message(routing, type_id, | 176 IPC::Message* message = new IPC::Message(routing, type_id, |
175 IPC::Message::PRIORITY_NORMAL); | 177 IPC::Message::PRIORITY_NORMAL); |
176 message->WriteInt(reply + 1); | 178 message->WriteInt(reply + 1); |
177 message->WriteInt(reply); | 179 message->WriteInt(reply); |
178 return other_->Send(message); | 180 return other_->Send(message); |
179 } | 181 } |
180 | 182 |
181 void Cleanup() { | 183 void Cleanup() { |
182 --message_count_; | 184 --message_count_; |
183 --pending_messages_; | 185 --pending_messages_; |
184 if (0 == message_count_) | 186 if (0 == message_count_) |
185 base::MessageLoop::current()->Quit(); | 187 base::MessageLoop::current()->Quit(); |
186 } | 188 } |
187 | 189 |
188 void ReplyMsgNotHandled(uint32 type_id) { | 190 void ReplyMsgNotHandled(uint32_t type_id) { |
189 RoundtripAckReply(FUZZER_ROUTING_ID, MsgUnhandled::ID, type_id); | 191 RoundtripAckReply(FUZZER_ROUTING_ID, MsgUnhandled::ID, type_id); |
190 Cleanup(); | 192 Cleanup(); |
191 } | 193 } |
192 | 194 |
193 void UseData(int caller, int value, const base::string16& text) { | 195 void UseData(int caller, int value, const base::string16& text) { |
194 std::ostringstream os; | 196 std::ostringstream os; |
195 os << "IPC fuzzer:" << caller << " [" << value << " " | 197 os << "IPC fuzzer:" << caller << " [" << value << " " |
196 << base::UTF16ToUTF8(text) << "]\n"; | 198 << base::UTF16ToUTF8(text) << "]\n"; |
197 std::string output = os.str(); | 199 std::string output = os.str(); |
198 LOG(WARNING) << output; | 200 LOG(WARNING) << output; |
199 } | 201 } |
200 | 202 |
201 int message_count_; | 203 int message_count_; |
202 int pending_messages_; | 204 int pending_messages_; |
203 }; | 205 }; |
204 | 206 |
205 class FuzzerClientListener : public SimpleListener { | 207 class FuzzerClientListener : public SimpleListener { |
206 public: | 208 public: |
207 FuzzerClientListener() : last_msg_(NULL) { | 209 FuzzerClientListener() : last_msg_(NULL) { |
208 } | 210 } |
209 | 211 |
210 bool OnMessageReceived(const IPC::Message& msg) override { | 212 bool OnMessageReceived(const IPC::Message& msg) override { |
211 last_msg_ = new IPC::Message(msg); | 213 last_msg_ = new IPC::Message(msg); |
212 base::MessageLoop::current()->Quit(); | 214 base::MessageLoop::current()->Quit(); |
213 return true; | 215 return true; |
214 } | 216 } |
215 | 217 |
216 bool ExpectMessage(int value, uint32 type_id) { | 218 bool ExpectMessage(int value, uint32_t type_id) { |
217 if (!MsgHandlerInternal(type_id)) | 219 if (!MsgHandlerInternal(type_id)) |
218 return false; | 220 return false; |
219 int msg_value1 = 0; | 221 int msg_value1 = 0; |
220 int msg_value2 = 0; | 222 int msg_value2 = 0; |
221 base::PickleIterator iter(*last_msg_); | 223 base::PickleIterator iter(*last_msg_); |
222 if (!iter.ReadInt(&msg_value1)) | 224 if (!iter.ReadInt(&msg_value1)) |
223 return false; | 225 return false; |
224 if (!iter.ReadInt(&msg_value2)) | 226 if (!iter.ReadInt(&msg_value2)) |
225 return false; | 227 return false; |
226 if ((msg_value2 + 1) != msg_value1) | 228 if ((msg_value2 + 1) != msg_value1) |
227 return false; | 229 return false; |
228 if (msg_value2 != value) | 230 if (msg_value2 != value) |
229 return false; | 231 return false; |
230 | 232 |
231 delete last_msg_; | 233 delete last_msg_; |
232 last_msg_ = NULL; | 234 last_msg_ = NULL; |
233 return true; | 235 return true; |
234 } | 236 } |
235 | 237 |
236 bool ExpectMsgNotHandled(uint32 type_id) { | 238 bool ExpectMsgNotHandled(uint32_t type_id) { |
237 return ExpectMessage(type_id, MsgUnhandled::ID); | 239 return ExpectMessage(type_id, MsgUnhandled::ID); |
238 } | 240 } |
239 | 241 |
240 private: | 242 private: |
241 bool MsgHandlerInternal(uint32 type_id) { | 243 bool MsgHandlerInternal(uint32_t type_id) { |
242 base::MessageLoop::current()->Run(); | 244 base::MessageLoop::current()->Run(); |
243 if (NULL == last_msg_) | 245 if (NULL == last_msg_) |
244 return false; | 246 return false; |
245 if (FUZZER_ROUTING_ID != last_msg_->routing_id()) | 247 if (FUZZER_ROUTING_ID != last_msg_->routing_id()) |
246 return false; | 248 return false; |
247 return (type_id == last_msg_->type()); | 249 return (type_id == last_msg_->type()); |
248 } | 250 } |
249 | 251 |
250 IPC::Message* last_msg_; | 252 IPC::Message* last_msg_; |
251 }; | 253 }; |
(...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
361 // thrown out of sync by the extra argument. | 363 // thrown out of sync by the extra argument. |
362 msg = new MsgClassIS(3, base::ASCIIToUTF16("expect three")); | 364 msg = new MsgClassIS(3, base::ASCIIToUTF16("expect three")); |
363 sender()->Send(msg); | 365 sender()->Send(msg); |
364 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); | 366 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); |
365 | 367 |
366 EXPECT_TRUE(WaitForClientShutdown()); | 368 EXPECT_TRUE(WaitForClientShutdown()); |
367 DestroyChannel(); | 369 DestroyChannel(); |
368 } | 370 } |
369 | 371 |
370 } // namespace | 372 } // namespace |
OLD | NEW |