OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <iostream> | 5 #include <iostream> |
6 #include <set> | 6 #include <set> |
7 #include <string> | 7 #include <string> |
8 #include <utility> | 8 #include <utility> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
(...skipping 1981 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1992 } \ | 1992 } \ |
1993 std::cerr << "failed to satisfy " << #condition << "\n"; \ | 1993 std::cerr << "failed to satisfy " << #condition << "\n"; \ |
1994 return false; \ | 1994 return false; \ |
1995 } \ | 1995 } \ |
1996 }; | 1996 }; |
1997 | 1997 |
1998 // Bring them into existence. | 1998 // Bring them into existence. |
1999 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 1999 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
2000 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 2000 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
2001 | 2001 |
2002 // Redefine macros to generate generating funtions | 2002 #define MAX_FAKE_ROUTING_ID 15 |
2003 #undef IPC_MESSAGE_DECL | |
2004 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ | |
2005 IPC_##kind##_##type##_FUZZ(name, in, out, ilist, olist) | |
2006 | 2003 |
2007 #define IPC_EMPTY_CONTROL_FUZZ(name, in, out, ilist, olist) \ | 2004 template <typename Message> |
2008 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | 2005 class FuzzerHelper; |
2009 if (msg) { \ | 2006 |
2010 return NULL; \ | 2007 template <uint32_t Id, const char* Name, typename... Ins> |
2011 } \ | 2008 class FuzzerHelper< |
2012 return new name(); \ | 2009 IPC::AsyncControlMessage<Id, Name, base::Tuple<Ins...>, base::Tuple<>>> { |
| 2010 public: |
| 2011 using Message = |
| 2012 IPC::AsyncControlMessage<Id, Name, base::Tuple<Ins...>, base::Tuple<>>; |
| 2013 |
| 2014 static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { |
| 2015 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); |
2013 } | 2016 } |
2014 | 2017 |
2015 #define IPC_EMPTY_ROUTED_FUZZ(name, in, out, ilist, olist) \ | 2018 private: |
2016 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | 2019 template <size_t... Ns> |
2017 if (msg) { \ | 2020 static IPC::Message* FuzzImpl(IPC::Message* msg, |
2018 return NULL; \ | 2021 Fuzzer* fuzzer, |
2019 } \ | 2022 base::IndexSequence<Ns...>) { |
2020 return new name(RandInRange(MAX_FAKE_ROUTING_ID)); \ | 2023 typename Message::Param p; |
| 2024 if (msg) { |
| 2025 Message::Read(static_cast<Message*>(msg), &p); |
| 2026 } |
| 2027 if (FuzzParam(&p, fuzzer)) { |
| 2028 return new Message(base::get<Ns>(p)...); |
| 2029 } |
| 2030 std::cerr << "Don't know how to handle " << Name << "\n"; |
| 2031 return nullptr; |
| 2032 } |
| 2033 }; |
| 2034 |
| 2035 template <uint32_t Id, const char* Name, typename... Ins> |
| 2036 class FuzzerHelper< |
| 2037 IPC::AsyncRoutedMessage<Id, Name, base::Tuple<Ins...>, base::Tuple<>>> { |
| 2038 public: |
| 2039 using Message = |
| 2040 IPC::AsyncRoutedMessage<Id, Name, base::Tuple<Ins...>, base::Tuple<>>; |
| 2041 |
| 2042 static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { |
| 2043 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); |
2021 } | 2044 } |
2022 | 2045 |
2023 #define IPC_ASYNC_CONTROL_FUZZ(name, in, out, ilist, olist) \ | 2046 private: |
2024 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | 2047 template <size_t... Ns> |
2025 IPC_TUPLE_IN_##in ilist p; \ | 2048 static IPC::Message* FuzzImpl(IPC::Message* msg, |
2026 if (msg) { \ | 2049 Fuzzer* fuzzer, |
2027 name::Read(static_cast<name*>(msg), &p); \ | 2050 base::IndexSequence<Ns...>) { |
2028 } \ | 2051 typename Message::Param p; |
2029 if (FuzzParam(&p, fuzzer)) { \ | 2052 if (msg) { |
2030 return new name(IPC_MEMBERS_IN_##in(p)); \ | 2053 Message::Read(static_cast<Message*>(msg), &p); |
2031 } \ | 2054 } |
2032 std::cerr << "Don't know how to handle " << #name << "\n"; \ | 2055 if (FuzzParam(&p, fuzzer)) { |
2033 return 0; \ | 2056 return new Message(RandInRange(MAX_FAKE_ROUTING_ID), base::get<Ns>(p)...); |
| 2057 } |
| 2058 std::cerr << "Don't know how to handle " << Name << "\n"; |
| 2059 return nullptr; |
| 2060 } |
| 2061 }; |
| 2062 |
| 2063 template <uint32_t Id, const char* Name, typename... Ins, typename... Outs> |
| 2064 class FuzzerHelper<IPC::SyncControlMessage<Id, |
| 2065 Name, |
| 2066 base::Tuple<Ins...>, |
| 2067 base::Tuple<Outs...>>> { |
| 2068 public: |
| 2069 using Message = IPC:: |
| 2070 SyncControlMessage<Id, Name, base::Tuple<Ins...>, base::Tuple<Outs...>>; |
| 2071 |
| 2072 static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { |
| 2073 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); |
2034 } | 2074 } |
2035 | 2075 |
2036 #define IPC_ASYNC_ROUTED_FUZZ(name, in, out, ilist, olist) \ | 2076 private: |
2037 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | 2077 template <size_t... Ns> |
2038 IPC_TUPLE_IN_##in ilist p; \ | 2078 static IPC::Message* FuzzImpl(IPC::Message* msg, |
2039 if (msg) { \ | 2079 Fuzzer* fuzzer, |
2040 name::Read(static_cast<name*>(msg), &p); \ | 2080 base::IndexSequence<Ns...>) { |
2041 } \ | 2081 typename Message::SendParam p; |
2042 if (FuzzParam(&p, fuzzer)) { \ | 2082 Message* real_msg = static_cast<Message*>(msg); |
2043 return new name(RandInRange(MAX_FAKE_ROUTING_ID) \ | 2083 Message* new_msg = nullptr; |
2044 IPC_COMMA_##in \ | 2084 if (real_msg) { |
2045 IPC_MEMBERS_IN_##in(p)); \ | 2085 Message::ReadSendParam(real_msg, &p); |
2046 } \ | 2086 } |
2047 std::cerr << "Don't know how to handle " << #name << "\n"; \ | 2087 if (FuzzParam(&p, fuzzer)) { |
2048 return 0; \ | 2088 new_msg = |
| 2089 new Message(base::get<Ns>(p)..., static_cast<Outs*>(nullptr)...); |
| 2090 } |
| 2091 if (real_msg && new_msg) { |
| 2092 MessageCracker::CopyMessageID(new_msg, real_msg); |
| 2093 } else if (!new_msg) { |
| 2094 std::cerr << "Don't know how to handle " << Name << "\n"; |
| 2095 } |
| 2096 return new_msg; |
| 2097 } |
| 2098 }; |
| 2099 |
| 2100 template <uint32_t Id, const char* Name, typename... Ins, typename... Outs> |
| 2101 class FuzzerHelper<IPC::SyncRoutedMessage<Id, |
| 2102 Name, |
| 2103 base::Tuple<Ins...>, |
| 2104 base::Tuple<Outs...>>> { |
| 2105 public: |
| 2106 using Message = IPC:: |
| 2107 SyncRoutedMessage<Id, Name, base::Tuple<Ins...>, base::Tuple<Outs...>>; |
| 2108 |
| 2109 static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { |
| 2110 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); |
2049 } | 2111 } |
2050 | 2112 |
2051 #define IPC_SYNC_CONTROL_FUZZ(name, in, out, ilist, olist) \ | 2113 private: |
2052 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | 2114 template <size_t... Ns> |
2053 IPC_TUPLE_IN_##in ilist p; \ | 2115 static IPC::Message* FuzzImpl(IPC::Message* msg, |
2054 name* real_msg = static_cast<name*>(msg); \ | 2116 Fuzzer* fuzzer, |
2055 name* new_msg = NULL; \ | 2117 base::IndexSequence<Ns...>) { |
2056 if (real_msg) { \ | 2118 typename Message::SendParam p; |
2057 name::ReadSendParam(real_msg, &p); \ | 2119 Message* real_msg = static_cast<Message*>(msg); |
2058 } \ | 2120 Message* new_msg = nullptr; |
2059 if (FuzzParam(&p, fuzzer)) { \ | 2121 if (real_msg) { |
2060 new_msg = new name(IPC_MEMBERS_IN_##in(p) \ | 2122 Message::ReadSendParam(real_msg, &p); |
2061 IPC_COMMA_AND_##out(IPC_COMMA_##in) \ | 2123 } |
2062 IPC_MEMBERS_OUT_##out()); \ | 2124 if (FuzzParam(&p, fuzzer)) { |
2063 } \ | 2125 new_msg = |
2064 if (real_msg && new_msg) { \ | 2126 new Message(RandInRange(MAX_FAKE_ROUTING_ID), base::get<Ns>(p)..., |
2065 MessageCracker::CopyMessageID(new_msg, real_msg); \ | 2127 static_cast<Outs*>(nullptr)...); |
2066 } \ | 2128 } |
2067 else if (!new_msg) { \ | 2129 if (real_msg && new_msg) { |
2068 std::cerr << "Don't know how to handle " << #name << "\n"; \ | 2130 MessageCracker::CopyMessageID(new_msg, real_msg); |
2069 } \ | 2131 } else if (!new_msg) { |
2070 return new_msg; \ | 2132 std::cerr << "Don't know how to handle " << Name << "\n"; |
| 2133 } |
| 2134 return new_msg; |
2071 } | 2135 } |
| 2136 }; |
2072 | 2137 |
2073 #define IPC_SYNC_ROUTED_FUZZ(name, in, out, ilist, olist) \ | |
2074 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | |
2075 IPC_TUPLE_IN_##in ilist p; \ | |
2076 name* real_msg = static_cast<name*>(msg); \ | |
2077 name* new_msg = NULL; \ | |
2078 if (real_msg) { \ | |
2079 name::ReadSendParam(real_msg, &p); \ | |
2080 } \ | |
2081 if (FuzzParam(&p, fuzzer)) { \ | |
2082 new_msg = new name(RandInRange(MAX_FAKE_ROUTING_ID) \ | |
2083 IPC_COMMA_OR_##out(IPC_COMMA_##in) \ | |
2084 IPC_MEMBERS_IN_##in(p) \ | |
2085 IPC_COMMA_AND_##out(IPC_COMMA_##in) \ | |
2086 IPC_MEMBERS_OUT_##out()); \ | |
2087 } \ | |
2088 if (real_msg && new_msg) { \ | |
2089 MessageCracker::CopyMessageID(new_msg, real_msg); \ | |
2090 } \ | |
2091 else if (!new_msg) { \ | |
2092 std::cerr << "Don't know how to handle " << #name << "\n"; \ | |
2093 } \ | |
2094 return new_msg; \ | |
2095 } | |
2096 | |
2097 #define MAX_FAKE_ROUTING_ID 15 | |
2098 | |
2099 #define IPC_MEMBERS_IN_0(p) | |
2100 #define IPC_MEMBERS_IN_1(p) base::get<0>(p) | |
2101 #define IPC_MEMBERS_IN_2(p) base::get<0>(p), base::get<1>(p) | |
2102 #define IPC_MEMBERS_IN_3(p) base::get<0>(p), base::get<1>(p), base::get<2>(p) | |
2103 #define IPC_MEMBERS_IN_4(p) base::get<0>(p), base::get<1>(p), base::get<2>(p), \ | |
2104 base::get<3>(p) | |
2105 #define IPC_MEMBERS_IN_5(p) base::get<0>(p), base::get<1>(p), base::get<2>(p), \ | |
2106 base::get<3>(p), base::get<4>(p) | |
2107 | |
2108 #define IPC_MEMBERS_OUT_0() | |
2109 #define IPC_MEMBERS_OUT_1() NULL | |
2110 #define IPC_MEMBERS_OUT_2() NULL, NULL | |
2111 #define IPC_MEMBERS_OUT_3() NULL, NULL, NULL | |
2112 #define IPC_MEMBERS_OUT_4() NULL, NULL, NULL, NULL | |
2113 #define IPC_MEMBERS_OUT_5() NULL, NULL, NULL, NULL, NULL | |
2114 | |
2115 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | |
2116 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 2138 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
2117 | 2139 |
2118 void PopulateFuzzerFunctionVector( | 2140 void PopulateFuzzerFunctionVector( |
2119 FuzzerFunctionVector* function_vector) { | 2141 FuzzerFunctionVector* function_vector) { |
2120 #undef IPC_MESSAGE_DECL | 2142 #undef IPC_MESSAGE_DECL |
2121 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ | 2143 #define IPC_MESSAGE_DECL(name, ...) \ |
2122 function_vector->push_back(fuzzer_for_##name); | 2144 function_vector->push_back(FuzzerHelper<name>::Fuzz); |
2123 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 2145 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
2124 } | 2146 } |
2125 | 2147 |
2126 // Redefine macros to register fuzzing functions into map. | 2148 // Redefine macros to register fuzzing functions into map. |
2127 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 2149 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
2128 #undef IPC_MESSAGE_DECL | 2150 #undef IPC_MESSAGE_DECL |
2129 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ | 2151 #define IPC_MESSAGE_DECL(name, ...) \ |
2130 (*map)[static_cast<uint32>(name::ID)] = fuzzer_for_##name; | 2152 (*map)[static_cast<uint32>(name::ID)] = FuzzerHelper<name>::Fuzz; |
2131 | 2153 |
2132 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { | 2154 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { |
2133 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 2155 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
2134 } | 2156 } |
2135 | 2157 |
2136 } // namespace ipc_fuzzer | 2158 } // namespace ipc_fuzzer |
OLD | NEW |