OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <iostream> | 5 #include <iostream> |
6 #include <set> | 6 #include <set> |
7 #include <string> | 7 #include <string> |
8 #include <utility> | 8 #include <utility> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
(...skipping 1983 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1994 } \ | 1994 } \ |
1995 std::cerr << "failed to satisfy " << #condition << "\n"; \ | 1995 std::cerr << "failed to satisfy " << #condition << "\n"; \ |
1996 return false; \ | 1996 return false; \ |
1997 } \ | 1997 } \ |
1998 }; | 1998 }; |
1999 | 1999 |
2000 // Bring them into existence. | 2000 // Bring them into existence. |
2001 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 2001 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
2002 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 2002 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
2003 | 2003 |
2004 // Redefine macros to generate generating funtions | 2004 #define MAX_FAKE_ROUTING_ID 15 |
2005 #undef IPC_MESSAGE_DECL | |
2006 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ | |
2007 IPC_##kind##_##type##_FUZZ(name, in, out, ilist, olist) | |
2008 | 2005 |
2009 #define IPC_EMPTY_CONTROL_FUZZ(name, in, out, ilist, olist) \ | 2006 // MessageFactory abstracts away constructing control/routed messages by |
2010 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | 2007 // providing an additional random routing ID argument when necessary. |
2011 if (msg) { \ | 2008 template <typename Message, IPC::MessageKind> |
2012 return NULL; \ | 2009 class MessageFactory; |
2013 } \ | 2010 |
2014 return new name(); \ | 2011 template <typename Message> |
| 2012 class MessageFactory<Message, IPC::MessageKind::CONTROL> { |
| 2013 public: |
| 2014 template <typename... Args> |
| 2015 static Message* New(const Args&... args) { |
| 2016 return new Message(args...); |
| 2017 } |
| 2018 }; |
| 2019 |
| 2020 template <typename Message> |
| 2021 class MessageFactory<Message, IPC::MessageKind::ROUTED> { |
| 2022 public: |
| 2023 template <typename... Args> |
| 2024 static Message* New(const Args&... args) { |
| 2025 return new Message(RandInRange(MAX_FAKE_ROUTING_ID), args...); |
| 2026 } |
| 2027 }; |
| 2028 |
| 2029 template <typename Message> |
| 2030 class FuzzerHelper; |
| 2031 |
| 2032 template <typename Meta, typename... Ins> |
| 2033 class FuzzerHelper<IPC::MessageT<Meta, base::Tuple<Ins...>, void>> { |
| 2034 public: |
| 2035 using Message = IPC::MessageT<Meta, base::Tuple<Ins...>, void>; |
| 2036 |
| 2037 static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { |
| 2038 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); |
2015 } | 2039 } |
2016 | 2040 |
2017 #define IPC_EMPTY_ROUTED_FUZZ(name, in, out, ilist, olist) \ | 2041 private: |
2018 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | 2042 template <size_t... Ns> |
2019 if (msg) { \ | 2043 static IPC::Message* FuzzImpl(IPC::Message* msg, |
2020 return NULL; \ | 2044 Fuzzer* fuzzer, |
2021 } \ | 2045 base::IndexSequence<Ns...>) { |
2022 return new name(RandInRange(MAX_FAKE_ROUTING_ID)); \ | 2046 typename Message::Param p; |
| 2047 if (msg) { |
| 2048 Message::Read(static_cast<Message*>(msg), &p); |
| 2049 } |
| 2050 if (FuzzParam(&p, fuzzer)) { |
| 2051 return MessageFactory<Message, Meta::kKind>::New(base::get<Ns>(p)...); |
| 2052 } |
| 2053 std::cerr << "Don't know how to handle " << Meta::kName << "\n"; |
| 2054 return nullptr; |
| 2055 } |
| 2056 }; |
| 2057 |
| 2058 template <typename Meta, typename... Ins, typename... Outs> |
| 2059 class FuzzerHelper< |
| 2060 IPC::MessageT<Meta, base::Tuple<Ins...>, base::Tuple<Outs...>>> { |
| 2061 public: |
| 2062 using Message = |
| 2063 IPC::MessageT<Meta, base::Tuple<Ins...>, base::Tuple<Outs...>>; |
| 2064 |
| 2065 static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { |
| 2066 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); |
2023 } | 2067 } |
2024 | 2068 |
2025 #define IPC_ASYNC_CONTROL_FUZZ(name, in, out, ilist, olist) \ | 2069 private: |
2026 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | 2070 template <size_t... Ns> |
2027 IPC_TUPLE_IN_##in ilist p; \ | 2071 static IPC::Message* FuzzImpl(IPC::Message* msg, |
2028 if (msg) { \ | 2072 Fuzzer* fuzzer, |
2029 name::Read(static_cast<name*>(msg), &p); \ | 2073 base::IndexSequence<Ns...>) { |
2030 } \ | 2074 typename Message::SendParam p; |
2031 if (FuzzParam(&p, fuzzer)) { \ | 2075 Message* real_msg = static_cast<Message*>(msg); |
2032 return new name(IPC_MEMBERS_IN_##in(p)); \ | 2076 Message* new_msg = nullptr; |
2033 } \ | 2077 if (real_msg) { |
2034 std::cerr << "Don't know how to handle " << #name << "\n"; \ | 2078 Message::ReadSendParam(real_msg, &p); |
2035 return 0; \ | 2079 } |
| 2080 if (FuzzParam(&p, fuzzer)) { |
| 2081 new_msg = MessageFactory<Message, Meta::kKind>::New( |
| 2082 base::get<Ns>(p)..., static_cast<Outs*>(nullptr)...); |
| 2083 } |
| 2084 if (real_msg && new_msg) { |
| 2085 MessageCracker::CopyMessageID(new_msg, real_msg); |
| 2086 } else if (!new_msg) { |
| 2087 std::cerr << "Don't know how to handle " << Meta::kName << "\n"; |
| 2088 } |
| 2089 return new_msg; |
2036 } | 2090 } |
| 2091 }; |
2037 | 2092 |
2038 #define IPC_ASYNC_ROUTED_FUZZ(name, in, out, ilist, olist) \ | |
2039 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | |
2040 IPC_TUPLE_IN_##in ilist p; \ | |
2041 if (msg) { \ | |
2042 name::Read(static_cast<name*>(msg), &p); \ | |
2043 } \ | |
2044 if (FuzzParam(&p, fuzzer)) { \ | |
2045 return new name(RandInRange(MAX_FAKE_ROUTING_ID) \ | |
2046 IPC_COMMA_##in \ | |
2047 IPC_MEMBERS_IN_##in(p)); \ | |
2048 } \ | |
2049 std::cerr << "Don't know how to handle " << #name << "\n"; \ | |
2050 return 0; \ | |
2051 } | |
2052 | |
2053 #define IPC_SYNC_CONTROL_FUZZ(name, in, out, ilist, olist) \ | |
2054 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | |
2055 IPC_TUPLE_IN_##in ilist p; \ | |
2056 name* real_msg = static_cast<name*>(msg); \ | |
2057 name* new_msg = NULL; \ | |
2058 if (real_msg) { \ | |
2059 name::ReadSendParam(real_msg, &p); \ | |
2060 } \ | |
2061 if (FuzzParam(&p, fuzzer)) { \ | |
2062 new_msg = new name(IPC_MEMBERS_IN_##in(p) \ | |
2063 IPC_COMMA_AND_##out(IPC_COMMA_##in) \ | |
2064 IPC_MEMBERS_OUT_##out()); \ | |
2065 } \ | |
2066 if (real_msg && new_msg) { \ | |
2067 MessageCracker::CopyMessageID(new_msg, real_msg); \ | |
2068 } \ | |
2069 else if (!new_msg) { \ | |
2070 std::cerr << "Don't know how to handle " << #name << "\n"; \ | |
2071 } \ | |
2072 return new_msg; \ | |
2073 } | |
2074 | |
2075 #define IPC_SYNC_ROUTED_FUZZ(name, in, out, ilist, olist) \ | |
2076 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \ | |
2077 IPC_TUPLE_IN_##in ilist p; \ | |
2078 name* real_msg = static_cast<name*>(msg); \ | |
2079 name* new_msg = NULL; \ | |
2080 if (real_msg) { \ | |
2081 name::ReadSendParam(real_msg, &p); \ | |
2082 } \ | |
2083 if (FuzzParam(&p, fuzzer)) { \ | |
2084 new_msg = new name(RandInRange(MAX_FAKE_ROUTING_ID) \ | |
2085 IPC_COMMA_OR_##out(IPC_COMMA_##in) \ | |
2086 IPC_MEMBERS_IN_##in(p) \ | |
2087 IPC_COMMA_AND_##out(IPC_COMMA_##in) \ | |
2088 IPC_MEMBERS_OUT_##out()); \ | |
2089 } \ | |
2090 if (real_msg && new_msg) { \ | |
2091 MessageCracker::CopyMessageID(new_msg, real_msg); \ | |
2092 } \ | |
2093 else if (!new_msg) { \ | |
2094 std::cerr << "Don't know how to handle " << #name << "\n"; \ | |
2095 } \ | |
2096 return new_msg; \ | |
2097 } | |
2098 | |
2099 #define MAX_FAKE_ROUTING_ID 15 | |
2100 | |
2101 #define IPC_MEMBERS_IN_0(p) | |
2102 #define IPC_MEMBERS_IN_1(p) base::get<0>(p) | |
2103 #define IPC_MEMBERS_IN_2(p) base::get<0>(p), base::get<1>(p) | |
2104 #define IPC_MEMBERS_IN_3(p) base::get<0>(p), base::get<1>(p), base::get<2>(p) | |
2105 #define IPC_MEMBERS_IN_4(p) base::get<0>(p), base::get<1>(p), base::get<2>(p), \ | |
2106 base::get<3>(p) | |
2107 #define IPC_MEMBERS_IN_5(p) base::get<0>(p), base::get<1>(p), base::get<2>(p), \ | |
2108 base::get<3>(p), base::get<4>(p) | |
2109 | |
2110 #define IPC_MEMBERS_OUT_0() | |
2111 #define IPC_MEMBERS_OUT_1() NULL | |
2112 #define IPC_MEMBERS_OUT_2() NULL, NULL | |
2113 #define IPC_MEMBERS_OUT_3() NULL, NULL, NULL | |
2114 #define IPC_MEMBERS_OUT_4() NULL, NULL, NULL, NULL | |
2115 #define IPC_MEMBERS_OUT_5() NULL, NULL, NULL, NULL, NULL | |
2116 | |
2117 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | |
2118 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 2093 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
2119 | 2094 |
2120 void PopulateFuzzerFunctionVector( | 2095 void PopulateFuzzerFunctionVector( |
2121 FuzzerFunctionVector* function_vector) { | 2096 FuzzerFunctionVector* function_vector) { |
2122 #undef IPC_MESSAGE_DECL | 2097 #undef IPC_MESSAGE_DECL |
2123 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ | 2098 #define IPC_MESSAGE_DECL(name, ...) \ |
2124 function_vector->push_back(fuzzer_for_##name); | 2099 function_vector->push_back(FuzzerHelper<name>::Fuzz); |
2125 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 2100 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
2126 } | 2101 } |
2127 | 2102 |
2128 // Redefine macros to register fuzzing functions into map. | 2103 // Redefine macros to register fuzzing functions into map. |
2129 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 2104 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
2130 #undef IPC_MESSAGE_DECL | 2105 #undef IPC_MESSAGE_DECL |
2131 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \ | 2106 #define IPC_MESSAGE_DECL(name, ...) \ |
2132 (*map)[static_cast<uint32_t>(name::ID)] = fuzzer_for_##name; | 2107 (*map)[static_cast<uint32_t>(name::ID)] = FuzzerHelper<name>::Fuzz; |
2133 | 2108 |
2134 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { | 2109 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { |
2135 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 2110 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
2136 } | 2111 } |
2137 | 2112 |
2138 } // namespace ipc_fuzzer | 2113 } // namespace ipc_fuzzer |
OLD | NEW |