OLD | NEW |
| (Empty) |
1 // Copyright 2016 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef NET_BASE_FUZZED_DATA_PROVIDER_H | |
6 #define NET_BASE_FUZZED_DATA_PROVIDER_H | |
7 | |
8 #include <stdint.h> | |
9 | |
10 #include "base/macros.h" | |
11 #include "base/strings/string_piece.h" | |
12 | |
13 namespace net { | |
14 | |
15 // Utility class to break up fuzzer input for multiple consumers. Whenever run | |
16 // on the same input, provides the same output, as long as its methods are | |
17 // called in the same order, with the same arguments. | |
18 class FuzzedDataProvider { | |
19 public: | |
20 // |data| is an array of length |size| that the FuzzedDataProvider wraps to | |
21 // provide more granular access. |data| must outlive the FuzzedDataProvider. | |
22 FuzzedDataProvider(const uint8_t* data, size_t size); | |
23 ~FuzzedDataProvider(); | |
24 | |
25 // Returns a StringPiece containing |num_bytes| of input data. If fewer than | |
26 // |num_bytes| of data remain, returns a shorter StringPiece containing all | |
27 // of the data that's left. The data pointed at by the returned StringPiece | |
28 // must not be used after the FuzzedDataProvider is destroyed. | |
29 base::StringPiece ConsumeBytes(size_t num_bytes); | |
30 | |
31 // Returns a StringPiece containing all remaining bytes of the input data. | |
32 // The data pointed at by the returned StringPiece must not be used after the | |
33 // FuzzedDataProvider is destroyed. | |
34 base::StringPiece ConsumeRemainingBytes(); | |
35 | |
36 // Returns a number in the range [min, max] by consuming bytes from the input | |
37 // data. The value might not be uniformly distributed in the given range. If | |
38 // there's no input data left, always returns |min|. |min| must be less than | |
39 // or equal to |max|. | |
40 uint32_t ConsumeUint32InRange(uint32_t min, uint32_t max); | |
41 int ConsumeInt32InRange(int min, int max); | |
42 | |
43 // Returns a bool, or false when no data remains. | |
44 bool ConsumeBool(); | |
45 | |
46 // Returns a uint8_t from the input or 0 if nothing remains. This is | |
47 // equivalent to ConsumeUint32InRange(0, 0xFF). | |
48 uint8_t ConsumeUint8(); | |
49 | |
50 // Returns a uint16_t from the input. If fewer than 2 bytes of data remain | |
51 // will fill the most significant bytes with 0. This is equivalent to | |
52 // ConsumeUint32InRange(0, 0xFFFF). | |
53 uint16_t ConsumeUint16(); | |
54 | |
55 // Returns a value from |array|, consuming as many bytes as needed to do so. | |
56 // |array| must be a fixed-size array. Equivalent to | |
57 // array[ConsumeUint32InRange(sizeof(array)-1)]; | |
58 template <typename Type, size_t size> | |
59 Type PickValueInArray(Type (&array)[size]) { | |
60 return array[ConsumeUint32InRange(0, size - 1)]; | |
61 } | |
62 | |
63 // Reports the remaining bytes available for fuzzed input. | |
64 size_t remaining_bytes() { return remaining_data_.length(); } | |
65 | |
66 private: | |
67 base::StringPiece remaining_data_; | |
68 | |
69 DISALLOW_COPY_AND_ASSIGN(FuzzedDataProvider); | |
70 }; | |
71 | |
72 } // namespace net | |
73 | |
74 #endif // NET_BASE_FUZZED_DATA_PROVIDER_H | |
OLD | NEW |