| OLD | NEW |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/http/http_stream_parser.h" | 5 #include "net/http/http_stream_parser.h" |
| 6 | 6 |
| 7 #include <stddef.h> | 7 #include <stddef.h> |
| 8 #include <stdint.h> | 8 #include <stdint.h> |
| 9 | 9 |
| 10 #include <algorithm> | 10 #include <algorithm> |
| 11 #include <memory> | 11 #include <memory> |
| 12 #include <string> | 12 #include <string> |
| 13 #include <vector> | 13 #include <vector> |
| 14 | 14 |
| 15 #include "base/fuzzed_data_provider.h" |
| 15 #include "base/logging.h" | 16 #include "base/logging.h" |
| 16 #include "base/macros.h" | 17 #include "base/macros.h" |
| 17 #include "base/memory/ref_counted.h" | 18 #include "base/memory/ref_counted.h" |
| 18 #include "net/base/fuzzed_data_provider.h" | |
| 19 #include "net/base/io_buffer.h" | 19 #include "net/base/io_buffer.h" |
| 20 #include "net/base/net_errors.h" | 20 #include "net/base/net_errors.h" |
| 21 #include "net/base/test_completion_callback.h" | 21 #include "net/base/test_completion_callback.h" |
| 22 #include "net/http/http_request_headers.h" | 22 #include "net/http/http_request_headers.h" |
| 23 #include "net/http/http_request_info.h" | 23 #include "net/http/http_request_info.h" |
| 24 #include "net/http/http_response_info.h" | 24 #include "net/http/http_response_info.h" |
| 25 #include "net/log/net_log.h" | 25 #include "net/log/net_log.h" |
| 26 #include "net/log/test_net_log.h" | 26 #include "net/log/test_net_log.h" |
| 27 #include "net/socket/client_socket_handle.h" | 27 #include "net/socket/client_socket_handle.h" |
| 28 #include "net/socket/fuzzed_socket.h" | 28 #include "net/socket/fuzzed_socket.h" |
| 29 #include "url/gurl.h" | 29 #include "url/gurl.h" |
| 30 | 30 |
| 31 // Fuzzer for HttpStreamParser. | 31 // Fuzzer for HttpStreamParser. |
| 32 // | 32 // |
| 33 // |data| is used to create a FuzzedSocket. | 33 // |data| is used to create a FuzzedSocket. |
| 34 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | 34 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
| 35 net::TestCompletionCallback callback; | 35 net::TestCompletionCallback callback; |
| 36 net::BoundTestNetLog bound_test_net_log; | 36 net::BoundTestNetLog bound_test_net_log; |
| 37 net::FuzzedDataProvider data_provider(data, size); | 37 base::FuzzedDataProvider data_provider(data, size); |
| 38 std::unique_ptr<net::FuzzedSocket> fuzzed_socket(new net::FuzzedSocket( | 38 std::unique_ptr<net::FuzzedSocket> fuzzed_socket(new net::FuzzedSocket( |
| 39 &data_provider, bound_test_net_log.bound().net_log())); | 39 &data_provider, bound_test_net_log.bound().net_log())); |
| 40 CHECK_EQ(net::OK, fuzzed_socket->Connect(callback.callback())); | 40 CHECK_EQ(net::OK, fuzzed_socket->Connect(callback.callback())); |
| 41 | 41 |
| 42 net::ClientSocketHandle socket_handle; | 42 net::ClientSocketHandle socket_handle; |
| 43 socket_handle.SetSocket(std::move(fuzzed_socket)); | 43 socket_handle.SetSocket(std::move(fuzzed_socket)); |
| 44 | 44 |
| 45 net::HttpRequestInfo request_info; | 45 net::HttpRequestInfo request_info; |
| 46 request_info.method = "GET"; | 46 request_info.method = "GET"; |
| 47 request_info.url = GURL("http://localhost/"); | 47 request_info.url = GURL("http://localhost/"); |
| (...skipping 26 matching lines...) Expand all Loading... |
| 74 | 74 |
| 75 // Releasing the pointer to IOBuffer immediately is more likely to lead to a | 75 // Releasing the pointer to IOBuffer immediately is more likely to lead to a |
| 76 // use-after-free. | 76 // use-after-free. |
| 77 io_buffer = nullptr; | 77 io_buffer = nullptr; |
| 78 if (callback.GetResult(result) <= 0) | 78 if (callback.GetResult(result) <= 0) |
| 79 break; | 79 break; |
| 80 } | 80 } |
| 81 | 81 |
| 82 return 0; | 82 return 0; |
| 83 } | 83 } |
| OLD | NEW |