Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(363)

Unified Diff: net/http/http_stream_parser_fuzzer.cc

Issue 1836573002: Add an HttpStreamParser fuzzer. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Oops Created 4 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « net/BUILD.gn ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: net/http/http_stream_parser_fuzzer.cc
diff --git a/net/http/http_stream_parser_fuzzer.cc b/net/http/http_stream_parser_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..ac856079b5645c9dd94c2b7117f24bdacd053136
--- /dev/null
+++ b/net/http/http_stream_parser_fuzzer.cc
@@ -0,0 +1,152 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/http/http_stream_parser.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <algorithm>
+#include <string>
+#include <vector>
+
+#include "base/logging.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/message_loop/message_loop.h"
+#include "base/numerics/safe_conversions.h"
+#include "net/base/address_list.h"
+#include "net/base/io_buffer.h"
+#include "net/base/net_errors.h"
+#include "net/base/test_completion_callback.h"
+#include "net/http/http_request_headers.h"
+#include "net/http/http_request_info.h"
+#include "net/http/http_response_info.h"
+#include "net/log/net_log.h"
+#include "net/log/test_net_log.h"
+#include "net/socket/client_socket_handle.h"
+#include "net/socket/socket_test_util.h"
+#include "url/gurl.h"
+
+// Fuzzer for HttpStreamParser.
+//
+// |data| is the data received over a mock HTTP connection through one or more
+// reads, along with metadata about the size of each read, and whether or not
+// the read completely synchronously.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ // Needed for thread checks and waits.
+ base::MessageLoopForIO message_loop;
+
+ net::MockWrite writes[] = {
+ net::MockWrite(net::ASYNC, 0, "GET / HTTP/1.1\r\n\r\n"),
+ };
+
+ // Break the buffer into a sequence of variable sized sync and async
+ // reads. Use the last bytes of |data| exclusively for determining
+ // the size and type of each read.
+ std::vector<net::MockRead> reads;
+ // Sequence number for socket operations.
+ int last_sequence_number = 0;
+
+ // IoMode for the final read, where the server closes the mock socket.
+ net::IoMode close_socket_io_mode = net::ASYNC;
+
+ // Break |data| up into reads. The test may or may not make to the final
+ // read, where the server closes the socket.
+
+ // Each read needs a one byte seed to determine read size and whether it
+ // should be sync or async, so if there's only one byte left unused, can't use
+ // it here. The bytes used to get this metadata are not used as over-the-wire
+ // bytes.
+ while (size > 0) {
+ size_t read_seed = data[size - 1];
+ size--;
+ net::IoMode io_mode = net::ASYNC;
+ // Low order bit determines IoMode.
+ if (read_seed & 0x1)
+ io_mode = net::SYNCHRONOUS;
+
+ // Use second bit to determine if the last read, when the socket is closed,
+ // is synchronous. The second bit only matters the last time this loop is
+ // runs.
+ if (read_seed & 0x2) {
+ close_socket_io_mode = net::SYNCHRONOUS;
+ } else {
+ close_socket_io_mode = net::ASYNC;
+ }
+
+ // If there are no more bytes in |data|, next read is the connection close.
+ if (size == 0)
+ break;
+
+ read_seed >>= 2;
+
+ // Last 6 bits determine how many bytes are returned by the read.
+ int read_size = static_cast<int>(std::min(1 + read_seed, size));
+ reads.push_back(net::MockRead(io_mode, reinterpret_cast<const char*>(data),
+ read_size, ++last_sequence_number));
+
+ data += read_size;
+ size -= read_size;
+ }
+
+ // Server closes the socket.
+ reads.push_back(net::MockRead(close_socket_io_mode,
+ net::ERR_CONNECTION_CLOSED,
+ ++last_sequence_number));
+ net::SequencedSocketData socket_data(reads.data(), reads.size(), writes,
+ arraysize(writes));
+ socket_data.set_connect_data(net::MockConnect(net::SYNCHRONOUS, net::OK));
+
+ scoped_ptr<net::MockTCPClientSocket> socket(
+ new net::MockTCPClientSocket(net::AddressList(), nullptr, &socket_data));
+
+ net::TestCompletionCallback callback;
+ CHECK_EQ(net::OK, socket->Connect(callback.callback()));
+
+ net::ClientSocketHandle socket_handle;
+ socket_handle.SetSocket(std::move(socket));
+
+ net::HttpRequestInfo request_info;
+ request_info.method = "GET";
+ request_info.url = GURL("http://localhost/");
+
+ scoped_refptr<net::GrowableIOBuffer> read_buffer(new net::GrowableIOBuffer());
+ // Use a NetLog that listens to events, to get coverage of logging
+ // callbacks.
+ net::BoundTestNetLog net_log;
+ net::HttpStreamParser parser(&socket_handle, &request_info, read_buffer.get(),
+ net_log.bound());
+
+ net::HttpResponseInfo response_info;
+ int result =
+ parser.SendRequest("GET / HTTP/1.1\r\n", net::HttpRequestHeaders(),
+ &response_info, callback.callback());
+ CHECK_EQ(net::OK, callback.GetResult(result));
+
+ result = parser.ReadResponseHeaders(callback.callback());
+ result = callback.GetResult(result);
+
+ if (result != net::OK)
+ return 0;
+
+ while (true) {
+ // 64 exactly matches the maximum amount of data returned by a single
+ // MockRead, as created above.
+ scoped_refptr<net::IOBufferWithSize> io_buffer(
+ new net::IOBufferWithSize(64));
+ result = parser.ReadResponseBody(io_buffer.get(), io_buffer->size(),
+ callback.callback());
+
+ // Releasing the pointer to IOBuffer immediately is more likely to lead to a
+ // use-after-free.
+ io_buffer = nullptr;
+
+ if (callback.GetResult(result) <= 0)
+ break;
+ }
+
+ return 0;
+}
« no previous file with comments | « net/BUILD.gn ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698