OLD | NEW |
(Empty) | |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 #include <stddef.h> |
| 6 #include <stdint.h> |
| 7 |
| 8 #include <memory> |
| 9 #include <string> |
| 10 #include <vector> |
| 11 |
| 12 #include "base/logging.h" |
| 13 #include "base/memory/ptr_util.h" |
| 14 #include "base/strings/string_piece.h" |
| 15 #include "base/test/fuzzed_data_provider.h" |
| 16 #include "net/base/completion_callback.h" |
| 17 #include "net/base/io_buffer.h" |
| 18 #include "net/base/net_errors.h" |
| 19 #include "net/websockets/websocket_deflate_parameters.h" |
| 20 #include "net/websockets/websocket_deflate_predictor.h" |
| 21 #include "net/websockets/websocket_deflate_predictor_impl.h" |
| 22 #include "net/websockets/websocket_deflate_stream.h" |
| 23 #include "net/websockets/websocket_extension.h" |
| 24 #include "net/websockets/websocket_frame.h" |
| 25 #include "net/websockets/websocket_stream.h" |
| 26 |
| 27 namespace net { |
| 28 |
| 29 namespace { |
| 30 |
| 31 class WebSocketFuzzedStream final : public WebSocketStream { |
| 32 public: |
| 33 WebSocketFuzzedStream(const uint8_t* data, size_t size) |
| 34 : fuzzed_data_provider_(data, size) {} |
| 35 |
| 36 int ReadFrames(std::vector<std::unique_ptr<WebSocketFrame>>* frames, |
| 37 const CompletionCallback& callback) override { |
| 38 if (fuzzed_data_provider_.remaining_bytes() == 0) |
| 39 return ERR_CONNECTION_CLOSED; |
| 40 while (fuzzed_data_provider_.remaining_bytes() > 0) |
| 41 frames->push_back(CreateFrame()); |
| 42 return OK; |
| 43 } |
| 44 |
| 45 int WriteFrames(std::vector<std::unique_ptr<WebSocketFrame>>* frames, |
| 46 const CompletionCallback& callback) override { |
| 47 return ERR_FILE_NOT_FOUND; |
| 48 } |
| 49 |
| 50 void Close() override {} |
| 51 std::string GetSubProtocol() const override { return std::string(); } |
| 52 std::string GetExtensions() const override { return std::string(); } |
| 53 |
| 54 private: |
| 55 std::unique_ptr<WebSocketFrame> CreateFrame() { |
| 56 WebSocketFrameHeader::OpCode opcode = |
| 57 fuzzed_data_provider_.ConsumeInt32InRange( |
| 58 WebSocketFrameHeader::kOpCodeContinuation, |
| 59 WebSocketFrameHeader::kOpCodeControlUnused); |
| 60 auto frame = base::MakeUnique<WebSocketFrame>(opcode); |
| 61 // Bad news: ConsumeBool actually consumes a whole byte per call, so do |
| 62 // something hacky to conserve precious bits. |
| 63 uint8_t flags = fuzzed_data_provider_.ConsumeUint8(); |
| 64 frame->header.final = flags & 0x1; |
| 65 frame->header.reserved1 = (flags >> 1) & 0x1; |
| 66 frame->header.reserved2 = (flags >> 2) & 0x1; |
| 67 frame->header.reserved3 = (flags >> 3) & 0x1; |
| 68 frame->header.masked = (flags >> 4) & 0x1; |
| 69 uint64_t payload_length = fuzzed_data_provider_.ConsumeInt32InRange(0, 64); |
| 70 base::StringPiece payload = |
| 71 fuzzed_data_provider_.ConsumeBytes(payload_length); |
| 72 frame->data = new WrappedIOBuffer(payload.data()); |
| 73 frame->header.payload_length = payload.size(); |
| 74 return frame; |
| 75 } |
| 76 |
| 77 base::FuzzedDataProvider fuzzed_data_provider_; |
| 78 }; |
| 79 |
| 80 void WebSocketDeflateStreamFuzz(const uint8_t* data, size_t size) { |
| 81 // WebSocketDeflateStream needs to be constructed on each call because it |
| 82 // has state. |
| 83 std::string failure_message; |
| 84 WebSocketDeflateParameters parameters; |
| 85 parameters.Initialize(WebSocketExtension("permessage-deflate"), |
| 86 &failure_message); |
| 87 WebSocketDeflateStream deflate_stream( |
| 88 base::MakeUnique<WebSocketFuzzedStream>(data, size), parameters, |
| 89 base::MakeUnique<WebSocketDeflatePredictorImpl>()); |
| 90 std::vector<std::unique_ptr<net::WebSocketFrame>> frames; |
| 91 deflate_stream.ReadFrames(&frames, CompletionCallback()); |
| 92 } |
| 93 |
| 94 } // namespace |
| 95 |
| 96 } // namespace net |
| 97 |
| 98 // Entry point for LibFuzzer. |
| 99 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
| 100 net::WebSocketDeflateStreamFuzz(data, size); |
| 101 |
| 102 return 0; |
| 103 } |
OLD | NEW |