Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(304)

Side by Side Diff: courgette/encoded_program_fuzz_unittest.cc

Issue 1629703002: [Courgette] Refactor: Manage AssemblyProgram and EncodedProgram with scoped_ptr. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Fix courgette_fuzzer in libfuzzer. Created 4 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « courgette/encoded_program.cc ('k') | courgette/encoded_program_unittest.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // Fuzz testing for EncodedProgram serialized format and assembly. 5 // Fuzz testing for EncodedProgram serialized format and assembly.
6 // 6 //
7 // We would like some assurance that if an EncodedProgram is malformed we will 7 // We would like some assurance that if an EncodedProgram is malformed we will
8 // not crash. The EncodedProgram could be malformed either due to malicious 8 // not crash. The EncodedProgram could be malformed either due to malicious
9 // attack to due to an error in patch generation. 9 // attack to due to an error in patch generation.
10 // 10 //
11 // We try a lot of arbitrary modifications to the serialized form and make sure 11 // We try a lot of arbitrary modifications to the serialized form and make sure
12 // that the outcome is not a crash. 12 // that the outcome is not a crash.
13 13 #include "courgette/encoded_program.h"
14 #include "base/test/test_suite.h"
15 14
16 #include <stddef.h> 15 #include <stddef.h>
17 16
17 #include "base/memory/scoped_ptr.h"
18 #include "base/test/test_suite.h"
19 #include "courgette/assembly_program.h"
18 #include "courgette/base_test_unittest.h" 20 #include "courgette/base_test_unittest.h"
19 #include "courgette/courgette.h" 21 #include "courgette/courgette.h"
22 #include "courgette/program_detector.h"
20 #include "courgette/streams.h" 23 #include "courgette/streams.h"
21 24
22 class DecodeFuzzTest : public BaseTest { 25 class DecodeFuzzTest : public BaseTest {
23 public: 26 public:
24 void FuzzExe(const char *) const; 27 void FuzzExe(const char *) const;
25 28
26 private: 29 private:
27 void FuzzByte(const std::string& buffer, const std::string& output, 30 void FuzzByte(const std::string& buffer, const std::string& output,
28 size_t index) const; 31 size_t index) const;
29 void FuzzBits(const std::string& buffer, const std::string& output, 32 void FuzzBits(const std::string& buffer, const std::string& output,
30 size_t index, int bits_to_flip) const; 33 size_t index, int bits_to_flip) const;
31 34
32 // Returns true if could assemble, false if rejected. 35 // Returns true if could assemble, false if rejected.
33 bool TryAssemble(const std::string& buffer, std::string* output) const; 36 bool TryAssemble(const std::string& buffer, std::string* output) const;
34 }; 37 };
35 38
36 // Loads an executable and does fuzz testing in the serialized format. 39 // Loads an executable and does fuzz testing in the serialized format.
37 void DecodeFuzzTest::FuzzExe(const char* file_name) const { 40 void DecodeFuzzTest::FuzzExe(const char* file_name) const {
38 std::string file1 = FileContents(file_name); 41 std::string file1 = FileContents(file_name);
39 42
40 const void* original_buffer = file1.c_str(); 43 const void* original_buffer = file1.c_str();
41 size_t original_length = file1.length(); 44 size_t original_length = file1.length();
42 45
43 courgette::AssemblyProgram* program = NULL; 46 scoped_ptr<courgette::AssemblyProgram> program;
44 const courgette::Status parse_status = 47 const courgette::Status parse_status =
45 courgette::ParseDetectedExecutable(original_buffer, original_length, 48 courgette::ParseDetectedExecutable(original_buffer, original_length,
46 &program); 49 &program);
47 EXPECT_EQ(courgette::C_OK, parse_status); 50 EXPECT_EQ(courgette::C_OK, parse_status);
48 51
49 courgette::EncodedProgram* encoded = NULL; 52 scoped_ptr<courgette::EncodedProgram> encoded;
50 53 const courgette::Status encode_status = Encode(*program, &encoded);
51 const courgette::Status encode_status = Encode(program, &encoded);
52 EXPECT_EQ(courgette::C_OK, encode_status); 54 EXPECT_EQ(courgette::C_OK, encode_status);
53 55
54 DeleteAssemblyProgram(program); 56 program.reset();
55 57
56 courgette::SinkStreamSet sinks; 58 courgette::SinkStreamSet sinks;
57 const courgette::Status write_status = WriteEncodedProgram(encoded, &sinks); 59 const courgette::Status write_status =
60 WriteEncodedProgram(encoded.get(), &sinks);
58 EXPECT_EQ(courgette::C_OK, write_status); 61 EXPECT_EQ(courgette::C_OK, write_status);
59 62
60 DeleteEncodedProgram(encoded); 63 encoded.reset();
61 64
62 courgette::SinkStream sink; 65 courgette::SinkStream sink;
63 bool can_collect = sinks.CopyTo(&sink); 66 bool can_collect = sinks.CopyTo(&sink);
64 EXPECT_TRUE(can_collect); 67 EXPECT_TRUE(can_collect);
65 68
66 size_t length = sink.Length(); 69 size_t length = sink.Length();
67 70
68 std::string base_buffer(reinterpret_cast<const char*>(sink.Buffer()), length); 71 std::string base_buffer(reinterpret_cast<const char*>(sink.Buffer()), length);
69 std::string base_output; 72 std::string base_output;
70 bool ok = TryAssemble(base_buffer, &base_output); 73 bool ok = TryAssemble(base_buffer, &base_output);
(...skipping 92 matching lines...) Expand 10 before | Expand all | Expand 10 after
163 if (index > 60) { // Beyond the origin addresses ... 166 if (index > 60) { // Beyond the origin addresses ...
164 EXPECT_NE(0U, changed_byte_count); // ... we expect some difference. 167 EXPECT_NE(0U, changed_byte_count); // ... we expect some difference.
165 } 168 }
166 // Currently all changes are smaller than this number: 169 // Currently all changes are smaller than this number:
167 EXPECT_GE(45000U, changed_byte_count); 170 EXPECT_GE(45000U, changed_byte_count);
168 } 171 }
169 } 172 }
170 173
171 bool DecodeFuzzTest::TryAssemble(const std::string& buffer, 174 bool DecodeFuzzTest::TryAssemble(const std::string& buffer,
172 std::string* output) const { 175 std::string* output) const {
173 courgette::EncodedProgram *encoded = NULL; 176 scoped_ptr<courgette::EncodedProgram> encoded;
174 bool result = false; 177 bool result = false;
175 178
176 courgette::SourceStreamSet sources; 179 courgette::SourceStreamSet sources;
177 bool can_get_source_streams = sources.Init(buffer.c_str(), buffer.length()); 180 bool can_get_source_streams = sources.Init(buffer.c_str(), buffer.length());
178 if (can_get_source_streams) { 181 if (can_get_source_streams) {
179 const courgette::Status read_status = 182 const courgette::Status read_status =
180 ReadEncodedProgram(&sources, &encoded); 183 ReadEncodedProgram(&sources, &encoded);
181 if (read_status == courgette::C_OK) { 184 if (read_status == courgette::C_OK) {
182 courgette::SinkStream assembled; 185 courgette::SinkStream assembled;
183 const courgette::Status assemble_status = Assemble(encoded, &assembled); 186 const courgette::Status assemble_status =
187 Assemble(encoded.get(), &assembled);
184 188
185 if (assemble_status == courgette::C_OK) { 189 if (assemble_status == courgette::C_OK) {
186 const void* assembled_buffer = assembled.Buffer(); 190 const void* assembled_buffer = assembled.Buffer();
187 size_t assembled_length = assembled.Length(); 191 size_t assembled_length = assembled.Length();
188 192
189 output->clear(); 193 output->clear();
190 output->assign(reinterpret_cast<const char*>(assembled_buffer), 194 output->assign(reinterpret_cast<const char*>(assembled_buffer),
191 assembled_length); 195 assembled_length);
192 result = true; 196 result = true;
193 } 197 }
194 } 198 }
195 } 199 }
196 200
197 DeleteEncodedProgram(encoded);
198
199 return result; 201 return result;
200 } 202 }
201 203
202 TEST_F(DecodeFuzzTest, All) { 204 TEST_F(DecodeFuzzTest, All) {
203 FuzzExe("setup1.exe"); 205 FuzzExe("setup1.exe");
204 FuzzExe("elf-32-1.exe"); 206 FuzzExe("elf-32-1.exe");
205 } 207 }
206 208
207 int main(int argc, char** argv) { 209 int main(int argc, char** argv) {
208 return base::TestSuite(argc, argv).Run(); 210 return base::TestSuite(argc, argv).Run();
209 } 211 }
OLDNEW
« no previous file with comments | « courgette/encoded_program.cc ('k') | courgette/encoded_program_unittest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698