Index: testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc |
diff --git a/testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc b/testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc |
new file mode 100644 |
index 0000000000000000000000000000000000000000..e7ece0228f1482639c17d583381014bc40fc9c5d |
--- /dev/null |
+++ b/testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc |
@@ -0,0 +1,47 @@ |
+// Copyright 2016 The Chromium Authors. All rights reserved. |
+// Use of this source code is governed by a BSD-style license that can be |
+// found in the LICENSE file. |
+ |
+#include <stddef.h> |
+#include <stdint.h> |
+ |
+#include <random> |
+#include <string> |
+ |
+#include "components/search_engines/search_terms_data.h" |
+#include "components/search_engines/template_url_parser.h" |
+ |
+class PseudoRandomFilter : public TemplateURLParser::ParameterFilter { |
+public: |
+ PseudoRandomFilter(uint32_t seed) |
+ : generator_(seed) |
+ , bool_pool_(0, 1) {} |
+ ~PseudoRandomFilter() override = default; |
+ |
+ bool KeepParameter(const std::string&, const std::string&) override { |
+ return bool_pool_(generator_); |
+ } |
+ |
+private: |
+ std::mt19937 generator_; |
+ std::uniform_int_distribution<bool> bool_pool_; |
+}; |
+ |
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
aizatsky
2016/07/06 18:45:53
Let's add
struct FuzzerFixedParams {
bool show_
|
+ if (size < 5) { |
aizatsky
2016/07/06 18:45:53
should be sizeof(FuzzerFixedParams)
|
+ // This fuzzer needs five bytes for required parameters. |
+ return 0; |
+ } |
+ |
+ bool show_in_default_list = data[0] & 1; |
aizatsky
2016/07/06 18:45:53
use bit field in params struct.
|
+ data++; |
+ size--; |
+ |
+ PseudoRandomFilter filter(*reinterpret_cast<const int32_t*>(data)); |
aizatsky
2016/07/06 18:45:53
these 4 bytes would go into rng and which doesn't
|
+ data += sizeof(int32_t); |
+ size -= sizeof(int32_t); |
+ |
+ TemplateURLParser::Parse(SearchTermsData(), show_in_default_list, |
+ reinterpret_cast<const char*>(data), size, &filter); |
+ return 0; |
+} |