| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ | 5 #ifndef TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ |
| 6 #define TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ | 6 #define TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ |
| 7 | 7 |
| 8 #include <stddef.h> |
| 9 #include <stdint.h> |
| 10 |
| 8 #include <string> | 11 #include <string> |
| 9 #include <vector> | 12 #include <vector> |
| 10 | 13 |
| 11 #include "base/basictypes.h" | |
| 12 #include "base/strings/string_util.h" | 14 #include "base/strings/string_util.h" |
| 13 #include "ipc/ipc_message.h" | 15 #include "ipc/ipc_message.h" |
| 14 | 16 |
| 15 namespace ipc_fuzzer { | 17 namespace ipc_fuzzer { |
| 16 | 18 |
| 17 // Interface implemented by those who generate basic types. The types all | 19 // Interface implemented by those who generate basic types. The types all |
| 18 // correspond to the types which a pickle from base/pickle.h can pickle, | 20 // correspond to the types which a pickle from base/pickle.h can pickle, |
| 19 // plus the floating point types. | 21 // plus the floating point types. |
| 20 class Fuzzer { | 22 class Fuzzer { |
| 21 public: | 23 public: |
| 22 // Functions for various data types. | 24 // Functions for various data types. |
| 23 virtual void FuzzBool(bool* value) = 0; | 25 virtual void FuzzBool(bool* value) = 0; |
| 24 virtual void FuzzInt(int* value) = 0; | 26 virtual void FuzzInt(int* value) = 0; |
| 25 virtual void FuzzLong(long* value) = 0; | 27 virtual void FuzzLong(long* value) = 0; |
| 26 virtual void FuzzSize(size_t* value) = 0; | 28 virtual void FuzzSize(size_t* value) = 0; |
| 27 virtual void FuzzUChar(unsigned char* value) = 0; | 29 virtual void FuzzUChar(unsigned char* value) = 0; |
| 28 virtual void FuzzWChar(wchar_t* value) = 0; | 30 virtual void FuzzWChar(wchar_t* value) = 0; |
| 29 virtual void FuzzUInt16(uint16* value) = 0; | 31 virtual void FuzzUInt16(uint16_t* value) = 0; |
| 30 virtual void FuzzUInt32(uint32* value) = 0; | 32 virtual void FuzzUInt32(uint32_t* value) = 0; |
| 31 virtual void FuzzInt64(int64* value) = 0; | 33 virtual void FuzzInt64(int64_t* value) = 0; |
| 32 virtual void FuzzUInt64(uint64* value) = 0; | 34 virtual void FuzzUInt64(uint64_t* value) = 0; |
| 33 virtual void FuzzFloat(float* value) = 0; | 35 virtual void FuzzFloat(float* value) = 0; |
| 34 virtual void FuzzDouble(double *value) = 0; | 36 virtual void FuzzDouble(double *value) = 0; |
| 35 virtual void FuzzString(std::string* value) = 0; | 37 virtual void FuzzString(std::string* value) = 0; |
| 36 virtual void FuzzString16(base::string16* value) = 0; | 38 virtual void FuzzString16(base::string16* value) = 0; |
| 37 virtual void FuzzData(char* data, int length) = 0; | 39 virtual void FuzzData(char* data, int length) = 0; |
| 38 virtual void FuzzBytes(void* data, int data_len) = 0; | 40 virtual void FuzzBytes(void* data, int data_len) = 0; |
| 39 | 41 |
| 40 // Used to determine if a completely new value should be generated for | 42 // Used to determine if a completely new value should be generated for |
| 41 // certain types instead of attempting to modify the existing one. | 43 // certain types instead of attempting to modify the existing one. |
| 42 virtual bool ShouldGenerate(); | 44 virtual bool ShouldGenerate(); |
| 43 }; | 45 }; |
| 44 | 46 |
| 45 class NoOpFuzzer : public Fuzzer { | 47 class NoOpFuzzer : public Fuzzer { |
| 46 public: | 48 public: |
| 47 NoOpFuzzer() {} | 49 NoOpFuzzer() {} |
| 48 virtual ~NoOpFuzzer() {} | 50 virtual ~NoOpFuzzer() {} |
| 49 | 51 |
| 50 void FuzzBool(bool* value) override {} | 52 void FuzzBool(bool* value) override {} |
| 51 void FuzzInt(int* value) override {} | 53 void FuzzInt(int* value) override {} |
| 52 void FuzzLong(long* value) override {} | 54 void FuzzLong(long* value) override {} |
| 53 void FuzzSize(size_t* value) override {} | 55 void FuzzSize(size_t* value) override {} |
| 54 void FuzzUChar(unsigned char* value) override {} | 56 void FuzzUChar(unsigned char* value) override {} |
| 55 void FuzzWChar(wchar_t* value) override {} | 57 void FuzzWChar(wchar_t* value) override {} |
| 56 void FuzzUInt16(uint16* value) override {} | 58 void FuzzUInt16(uint16_t* value) override {} |
| 57 void FuzzUInt32(uint32* value) override {} | 59 void FuzzUInt32(uint32_t* value) override {} |
| 58 void FuzzInt64(int64* value) override {} | 60 void FuzzInt64(int64_t* value) override {} |
| 59 void FuzzUInt64(uint64* value) override {} | 61 void FuzzUInt64(uint64_t* value) override {} |
| 60 void FuzzFloat(float* value) override {} | 62 void FuzzFloat(float* value) override {} |
| 61 void FuzzDouble(double* value) override {} | 63 void FuzzDouble(double* value) override {} |
| 62 void FuzzString(std::string* value) override {} | 64 void FuzzString(std::string* value) override {} |
| 63 void FuzzString16(base::string16* value) override {} | 65 void FuzzString16(base::string16* value) override {} |
| 64 void FuzzData(char* data, int length) override {} | 66 void FuzzData(char* data, int length) override {} |
| 65 void FuzzBytes(void* data, int data_len) override {} | 67 void FuzzBytes(void* data, int data_len) override {} |
| 66 }; | 68 }; |
| 67 | 69 |
| 68 typedef IPC::Message* (*FuzzerFunction)(IPC::Message*, Fuzzer*); | 70 typedef IPC::Message* (*FuzzerFunction)(IPC::Message*, Fuzzer*); |
| 69 | 71 |
| 70 // Used for mutating messages. Once populated, the map associates a message ID | 72 // Used for mutating messages. Once populated, the map associates a message ID |
| 71 // with a FuzzerFunction used for mutation of that message type. | 73 // with a FuzzerFunction used for mutation of that message type. |
| 72 typedef base::hash_map<uint32, FuzzerFunction> FuzzerFunctionMap; | 74 typedef base::hash_map<uint32_t, FuzzerFunction> FuzzerFunctionMap; |
| 73 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map); | 75 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map); |
| 74 | 76 |
| 75 // Used for generating new messages. Once populated, the vector contains | 77 // Used for generating new messages. Once populated, the vector contains |
| 76 // FuzzerFunctions for all message types that we know how to generate. | 78 // FuzzerFunctions for all message types that we know how to generate. |
| 77 typedef std::vector<FuzzerFunction> FuzzerFunctionVector; | 79 typedef std::vector<FuzzerFunction> FuzzerFunctionVector; |
| 78 void PopulateFuzzerFunctionVector(FuzzerFunctionVector* function_vector); | 80 void PopulateFuzzerFunctionVector(FuzzerFunctionVector* function_vector); |
| 79 | 81 |
| 80 // Since IPC::Message can be serialized, we also track a global function vector | 82 // Since IPC::Message can be serialized, we also track a global function vector |
| 81 // to handle generation of new messages while fuzzing. | 83 // to handle generation of new messages while fuzzing. |
| 82 extern FuzzerFunctionVector g_function_vector; | 84 extern FuzzerFunctionVector g_function_vector; |
| 83 | 85 |
| 84 } // namespace ipc_fuzzer | 86 } // namespace ipc_fuzzer |
| 85 | 87 |
| 86 #endif // TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ | 88 #endif // TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ |
| OLD | NEW |