Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(294)

Side by Side Diff: courgette/encoded_program_fuzz_unittest.cc

Issue 1629703002: [Courgette] Refactor: Manage AssemblyProgram and EncodedProgram with scoped_ptr. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Fix comments and includes. Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // Fuzz testing for EncodedProgram serialized format and assembly. 5 // Fuzz testing for EncodedProgram serialized format and assembly.
6 // 6 //
7 // We would like some assurance that if an EncodedProgram is malformed we will 7 // We would like some assurance that if an EncodedProgram is malformed we will
8 // not crash. The EncodedProgram could be malformed either due to malicious 8 // not crash. The EncodedProgram could be malformed either due to malicious
9 // attack to due to an error in patch generation. 9 // attack to due to an error in patch generation.
10 // 10 //
11 // We try a lot of arbitrary modifications to the serialized form and make sure 11 // We try a lot of arbitrary modifications to the serialized form and make sure
12 // that the outcome is not a crash. 12 // that the outcome is not a crash.
13 13 #include "courgette/encoded_program.h"
14 #include "base/test/test_suite.h"
15 14
16 #include <stddef.h> 15 #include <stddef.h>
17 16
17 #include "base/memory/scoped_ptr.h"
18 #include "base/test/test_suite.h"
18 #include "courgette/base_test_unittest.h" 19 #include "courgette/base_test_unittest.h"
19 #include "courgette/courgette.h" 20 #include "courgette/courgette.h"
21 #include "courgette/program_detector.h"
20 #include "courgette/streams.h" 22 #include "courgette/streams.h"
21 23
22 class DecodeFuzzTest : public BaseTest { 24 class DecodeFuzzTest : public BaseTest {
23 public: 25 public:
24 void FuzzExe(const char *) const; 26 void FuzzExe(const char *) const;
25 27
26 private: 28 private:
27 void FuzzByte(const std::string& buffer, const std::string& output, 29 void FuzzByte(const std::string& buffer, const std::string& output,
28 size_t index) const; 30 size_t index) const;
29 void FuzzBits(const std::string& buffer, const std::string& output, 31 void FuzzBits(const std::string& buffer, const std::string& output,
30 size_t index, int bits_to_flip) const; 32 size_t index, int bits_to_flip) const;
31 33
32 // Returns true if could assemble, false if rejected. 34 // Returns true if could assemble, false if rejected.
33 bool TryAssemble(const std::string& buffer, std::string* output) const; 35 bool TryAssemble(const std::string& buffer, std::string* output) const;
34 }; 36 };
35 37
36 // Loads an executable and does fuzz testing in the serialized format. 38 // Loads an executable and does fuzz testing in the serialized format.
37 void DecodeFuzzTest::FuzzExe(const char* file_name) const { 39 void DecodeFuzzTest::FuzzExe(const char* file_name) const {
38 std::string file1 = FileContents(file_name); 40 std::string file1 = FileContents(file_name);
39 41
40 const void* original_buffer = file1.c_str(); 42 const void* original_buffer = file1.c_str();
41 size_t original_length = file1.length(); 43 size_t original_length = file1.length();
42 44
43 courgette::AssemblyProgram* program = NULL; 45 scoped_ptr<courgette::AssemblyProgram> program;
44 const courgette::Status parse_status = 46 const courgette::Status parse_status =
45 courgette::ParseDetectedExecutable(original_buffer, original_length, 47 courgette::ParseDetectedExecutable(original_buffer, original_length,
46 &program); 48 &program);
47 EXPECT_EQ(courgette::C_OK, parse_status); 49 EXPECT_EQ(courgette::C_OK, parse_status);
48 50
49 courgette::EncodedProgram* encoded = NULL; 51 scoped_ptr<courgette::EncodedProgram> encoded;
50 52 const courgette::Status encode_status = Encode(*program, &encoded);
51 const courgette::Status encode_status = Encode(program, &encoded);
52 EXPECT_EQ(courgette::C_OK, encode_status); 53 EXPECT_EQ(courgette::C_OK, encode_status);
53 54
54 DeleteAssemblyProgram(program); 55 program.reset(nullptr);
55 56
56 courgette::SinkStreamSet sinks; 57 courgette::SinkStreamSet sinks;
57 const courgette::Status write_status = WriteEncodedProgram(encoded, &sinks); 58 const courgette::Status write_status =
59 WriteEncodedProgram(encoded.get(), &sinks);
58 EXPECT_EQ(courgette::C_OK, write_status); 60 EXPECT_EQ(courgette::C_OK, write_status);
59 61
60 DeleteEncodedProgram(encoded); 62 encoded.reset(nullptr);
61 63
62 courgette::SinkStream sink; 64 courgette::SinkStream sink;
63 bool can_collect = sinks.CopyTo(&sink); 65 bool can_collect = sinks.CopyTo(&sink);
64 EXPECT_TRUE(can_collect); 66 EXPECT_TRUE(can_collect);
65 67
66 size_t length = sink.Length(); 68 size_t length = sink.Length();
67 69
68 std::string base_buffer(reinterpret_cast<const char*>(sink.Buffer()), length); 70 std::string base_buffer(reinterpret_cast<const char*>(sink.Buffer()), length);
69 std::string base_output; 71 std::string base_output;
70 bool ok = TryAssemble(base_buffer, &base_output); 72 bool ok = TryAssemble(base_buffer, &base_output);
(...skipping 92 matching lines...) Expand 10 before | Expand all | Expand 10 after
163 if (index > 60) { // Beyond the origin addresses ... 165 if (index > 60) { // Beyond the origin addresses ...
164 EXPECT_NE(0U, changed_byte_count); // ... we expect some difference. 166 EXPECT_NE(0U, changed_byte_count); // ... we expect some difference.
165 } 167 }
166 // Currently all changes are smaller than this number: 168 // Currently all changes are smaller than this number:
167 EXPECT_GE(45000U, changed_byte_count); 169 EXPECT_GE(45000U, changed_byte_count);
168 } 170 }
169 } 171 }
170 172
171 bool DecodeFuzzTest::TryAssemble(const std::string& buffer, 173 bool DecodeFuzzTest::TryAssemble(const std::string& buffer,
172 std::string* output) const { 174 std::string* output) const {
173 courgette::EncodedProgram *encoded = NULL; 175 scoped_ptr<courgette::EncodedProgram> encoded;
174 bool result = false; 176 bool result = false;
175 177
176 courgette::SourceStreamSet sources; 178 courgette::SourceStreamSet sources;
177 bool can_get_source_streams = sources.Init(buffer.c_str(), buffer.length()); 179 bool can_get_source_streams = sources.Init(buffer.c_str(), buffer.length());
178 if (can_get_source_streams) { 180 if (can_get_source_streams) {
179 const courgette::Status read_status = 181 const courgette::Status read_status =
180 ReadEncodedProgram(&sources, &encoded); 182 ReadEncodedProgram(&sources, &encoded);
181 if (read_status == courgette::C_OK) { 183 if (read_status == courgette::C_OK) {
182 courgette::SinkStream assembled; 184 courgette::SinkStream assembled;
183 const courgette::Status assemble_status = Assemble(encoded, &assembled); 185 const courgette::Status assemble_status =
186 Assemble(encoded.get(), &assembled);
184 187
185 if (assemble_status == courgette::C_OK) { 188 if (assemble_status == courgette::C_OK) {
186 const void* assembled_buffer = assembled.Buffer(); 189 const void* assembled_buffer = assembled.Buffer();
187 size_t assembled_length = assembled.Length(); 190 size_t assembled_length = assembled.Length();
188 191
189 output->clear(); 192 output->clear();
190 output->assign(reinterpret_cast<const char*>(assembled_buffer), 193 output->assign(reinterpret_cast<const char*>(assembled_buffer),
191 assembled_length); 194 assembled_length);
192 result = true; 195 result = true;
193 } 196 }
194 } 197 }
195 } 198 }
196 199
197 DeleteEncodedProgram(encoded);
198
199 return result; 200 return result;
200 } 201 }
201 202
202 TEST_F(DecodeFuzzTest, All) { 203 TEST_F(DecodeFuzzTest, All) {
203 FuzzExe("setup1.exe"); 204 FuzzExe("setup1.exe");
204 FuzzExe("elf-32-1.exe"); 205 FuzzExe("elf-32-1.exe");
205 } 206 }
206 207
207 int main(int argc, char** argv) { 208 int main(int argc, char** argv) {
208 return base::TestSuite(argc, argv).Run(); 209 return base::TestSuite(argc, argv).Run();
209 } 210 }
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698