| OLD | NEW |
| 1 #!/usr/bin/env python | 1 #!/usr/bin/env python |
| 2 # Copyright 2014 The Chromium Authors. All rights reserved. | 2 # Copyright 2014 The Chromium Authors. All rights reserved. |
| 3 # Use of this source code is governed by a BSD-style license that can be | 3 # Use of this source code is governed by a BSD-style license that can be |
| 4 # found in the LICENSE file. | 4 # found in the LICENSE file. |
| 5 | 5 |
| 6 """Mutational ClusterFuzz fuzzer. A pre-built corpus of ipcdump files has | 6 """Mutational ClusterFuzz fuzzer. A pre-built corpus of ipcdump files has |
| 7 to be uploaded to ClusterFuzz along with this script. As chrome is being | 7 to be uploaded to ClusterFuzz along with this script. As chrome is being |
| 8 developed, the corpus will become out-of-date and needs to be updated. | 8 developed, the corpus will become out-of-date and needs to be updated. |
| 9 | 9 |
| 10 This fuzzer will pick some ipcdumps from the corpus, concatenate them with | 10 This fuzzer will pick some ipcdumps from the corpus, concatenate them with |
| 11 ipc_message_util and mutate the result with ipc_fuzzer_mutate. | 11 ipc_message_util and mutate the result with ipc_fuzzer_mutate. |
| 12 """ | 12 """ |
| 13 | 13 |
| 14 import os | 14 import os |
| 15 import random | 15 import random |
| 16 import subprocess | 16 import subprocess |
| 17 import sys | 17 import sys |
| 18 import utils | 18 import utils |
| 19 | 19 |
| 20 FUZZER_NAME_OPTION = '--fuzzer-name=mutate' | 20 FUZZER_NAME_OPTION = '--fuzzer-name=mutate' |
| 21 IPC_MESSAGE_UTIL_APPLICATION = 'ipc_message_util' | 21 IPC_MESSAGE_UTIL_APPLICATION = 'ipc_message_util' |
| 22 IPCDUMP_MERGE_LIMIT = 50 | 22 IPCDUMP_MERGE_LIMIT = 50 |
| 23 | 23 |
| 24 class MutationalFuzzer: | 24 class MutationalFuzzer: |
| 25 def parse_arguments(self): | 25 def __init__(self): |
| 26 self.args = utils.parse_arguments() | 26 self.args = utils.parse_arguments() |
| 27 | 27 |
| 28 def set_application_paths(self): | |
| 29 chrome_application_path = utils.get_application_path() | 28 chrome_application_path = utils.get_application_path() |
| 30 chrome_application_directory = os.path.dirname(chrome_application_path) | 29 chrome_application_directory = os.path.dirname(chrome_application_path) |
| 31 | 30 |
| 32 self.ipc_message_util_binary = utils.application_name_for_platform( | 31 self.ipc_message_util_binary = utils.application_name_for_platform( |
| 33 IPC_MESSAGE_UTIL_APPLICATION) | 32 IPC_MESSAGE_UTIL_APPLICATION) |
| 34 self.ipc_fuzzer_binary = utils.get_fuzzer_application_name() | 33 self.ipc_fuzzer_binary = utils.get_fuzzer_application_name() |
| 35 self.ipc_replay_binary = utils.get_replay_application_name() | |
| 36 self.ipc_message_util_binary_path = os.path.join( | 34 self.ipc_message_util_binary_path = os.path.join( |
| 37 chrome_application_directory, self.ipc_message_util_binary) | 35 chrome_application_directory, self.ipc_message_util_binary) |
| 38 self.ipc_fuzzer_binary_path = os.path.join( | 36 self.ipc_fuzzer_binary_path = os.path.join( |
| 39 chrome_application_directory, self.ipc_fuzzer_binary) | 37 chrome_application_directory, self.ipc_fuzzer_binary) |
| 40 self.ipc_replay_binary_path = os.path.join( | |
| 41 chrome_application_directory, self.ipc_replay_binary) | |
| 42 | 38 |
| 43 def set_corpus(self): | 39 def set_corpus(self): |
| 44 # Corpus should be set per job as a fuzzer-specific environment variable. | 40 # Corpus should be set per job as a fuzzer-specific environment variable. |
| 45 corpus = os.getenv('IPC_CORPUS_DIR', 'default') | 41 corpus = os.getenv('IPC_CORPUS_DIR', 'default') |
| 46 corpus_directory = os.path.join(self.args.input_dir, corpus) | 42 corpus_directory = os.path.join(self.args.input_dir, corpus) |
| 47 if not os.path.exists(corpus_directory): | 43 if not os.path.exists(corpus_directory): |
| 48 sys.exit('Corpus directory "%s" not found.' % corpus_directory) | 44 sys.exit('Corpus directory "%s" not found.' % corpus_directory) |
| 49 | 45 |
| 50 entries = os.listdir(corpus_directory) | 46 entries = os.listdir(corpus_directory) |
| 51 entries = [i for i in entries if i.endswith(utils.IPCDUMP_EXTENSION)] | 47 entries = [i for i in entries if i.endswith(utils.IPCDUMP_EXTENSION)] |
| (...skipping 17 matching lines...) Expand all Loading... |
| 69 # Mutate tmp_ipcdump -> mutated_ipcdump. | 65 # Mutate tmp_ipcdump -> mutated_ipcdump. |
| 70 cmd = [ | 66 cmd = [ |
| 71 self.ipc_fuzzer_binary_path, | 67 self.ipc_fuzzer_binary_path, |
| 72 FUZZER_NAME_OPTION, | 68 FUZZER_NAME_OPTION, |
| 73 tmp_ipcdump_testcase, | 69 tmp_ipcdump_testcase, |
| 74 mutated_ipcdump_testcase, | 70 mutated_ipcdump_testcase, |
| 75 ] | 71 ] |
| 76 if subprocess.call(cmd): | 72 if subprocess.call(cmd): |
| 77 sys.exit('%s failed.' % self.ipc_fuzzer_binary) | 73 sys.exit('%s failed.' % self.ipc_fuzzer_binary) |
| 78 | 74 |
| 79 utils.create_flags_file( | 75 utils.create_flags_file(mutated_ipcdump_testcase) |
| 80 mutated_ipcdump_testcase, self.ipc_replay_binary_path) | |
| 81 os.remove(tmp_ipcdump_testcase) | 76 os.remove(tmp_ipcdump_testcase) |
| 82 | 77 |
| 83 def main(self): | 78 def main(self): |
| 84 self.parse_arguments() | |
| 85 self.set_application_paths() | |
| 86 self.set_corpus() | 79 self.set_corpus() |
| 87 for _ in xrange(self.args.no_of_files): | 80 for _ in xrange(self.args.no_of_files): |
| 88 self.create_mutated_ipcdump_testcase() | 81 self.create_mutated_ipcdump_testcase() |
| 89 | 82 |
| 90 return 0 | 83 return 0 |
| 91 | 84 |
| 85 |
| 92 if __name__ == "__main__": | 86 if __name__ == "__main__": |
| 93 fuzzer = MutationalFuzzer() | 87 fuzzer = MutationalFuzzer() |
| 94 sys.exit(fuzzer.main()) | 88 sys.exit(fuzzer.main()) |
| OLD | NEW |