| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdint.h> | 5 #include <stdint.h> |
| 6 #include <stdio.h> | 6 #include <stdio.h> |
| 7 | 7 |
| 8 #include <limits> | 8 #include <limits> |
| 9 #include <memory> | 9 #include <memory> |
| 10 #include <sstream> | 10 #include <sstream> |
| (...skipping 240 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 251 if (FUZZER_ROUTING_ID != last_msg_->routing_id()) | 251 if (FUZZER_ROUTING_ID != last_msg_->routing_id()) |
| 252 return false; | 252 return false; |
| 253 return (type_id == last_msg_->type()); | 253 return (type_id == last_msg_->type()); |
| 254 } | 254 } |
| 255 | 255 |
| 256 IPC::Message* last_msg_; | 256 IPC::Message* last_msg_; |
| 257 }; | 257 }; |
| 258 | 258 |
| 259 // Runs the fuzzing server child mode. Returns when the preset number of | 259 // Runs the fuzzing server child mode. Returns when the preset number of |
| 260 // messages have been received. | 260 // messages have been received. |
| 261 DEFINE_IPC_CHANNEL_MOJO_TEST_CLIENT(FuzzServerClient) { | 261 MULTIPROCESS_IPC_TEST_CLIENT_MAIN(FuzzServerClient) { |
| 262 base::MessageLoopForIO main_message_loop; |
| 262 FuzzerServerListener listener; | 263 FuzzerServerListener listener; |
| 263 Connect(&listener); | 264 std::unique_ptr<IPC::Channel> channel(IPC::Channel::CreateClient( |
| 264 listener.Init(channel()); | 265 IPCTestBase::GetChannelName("FuzzServerClient"), &listener, |
| 266 main_message_loop.task_runner())); |
| 267 CHECK(channel->Connect()); |
| 268 listener.Init(channel.get()); |
| 265 base::RunLoop().Run(); | 269 base::RunLoop().Run(); |
| 266 Close(); | 270 return 0; |
| 267 } | 271 } |
| 268 | 272 |
| 269 using IPCFuzzingTest = IPCChannelMojoTestBase; | 273 class IPCFuzzingTest : public IPCTestBase { |
| 274 }; |
| 270 | 275 |
| 271 // This test makes sure that the FuzzerClientListener and FuzzerServerListener | 276 // This test makes sure that the FuzzerClientListener and FuzzerServerListener |
| 272 // are working properly by generating two well formed IPC calls. | 277 // are working properly by generating two well formed IPC calls. |
| 273 TEST_F(IPCFuzzingTest, SanityTest) { | 278 TEST_F(IPCFuzzingTest, SanityTest) { |
| 274 Init("FuzzServerClient"); | 279 Init("FuzzServerClient"); |
| 275 | 280 |
| 276 FuzzerClientListener listener; | 281 FuzzerClientListener listener; |
| 277 CreateChannel(&listener); | 282 CreateChannel(&listener); |
| 278 listener.Init(channel()); | 283 listener.Init(channel()); |
| 279 ASSERT_TRUE(ConnectChannel()); | 284 ASSERT_TRUE(ConnectChannel()); |
| 285 ASSERT_TRUE(StartClient()); |
| 280 | 286 |
| 281 IPC::Message* msg = NULL; | 287 IPC::Message* msg = NULL; |
| 282 int value = 43; | 288 int value = 43; |
| 283 msg = new MsgClassIS(value, base::ASCIIToUTF16("expect 43")); | 289 msg = new MsgClassIS(value, base::ASCIIToUTF16("expect 43")); |
| 284 sender()->Send(msg); | 290 sender()->Send(msg); |
| 285 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID)); | 291 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID)); |
| 286 | 292 |
| 287 msg = new MsgClassSI(base::ASCIIToUTF16("expect 44"), ++value); | 293 msg = new MsgClassSI(base::ASCIIToUTF16("expect 44"), ++value); |
| 288 sender()->Send(msg); | 294 sender()->Send(msg); |
| 289 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID)); | 295 EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID)); |
| 290 | 296 |
| 291 EXPECT_TRUE(WaitForClientShutdown()); | 297 EXPECT_TRUE(WaitForClientShutdown()); |
| 292 DestroyChannel(); | 298 DestroyChannel(); |
| 293 } | 299 } |
| 294 | 300 |
| 295 // This test uses a payload that is smaller than expected. This generates an | 301 // This test uses a payload that is smaller than expected. This generates an |
| 296 // error while unpacking the IPC buffer which in debug trigger an assertion and | 302 // error while unpacking the IPC buffer which in debug trigger an assertion and |
| 297 // in release is ignored (!). Right after we generate another valid IPC to make | 303 // in release is ignored (!). Right after we generate another valid IPC to make |
| 298 // sure framing is working properly. | 304 // sure framing is working properly. |
| 299 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) | 305 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) |
| 300 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { | 306 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { |
| 301 Init("FuzzServerClient"); | 307 Init("FuzzServerClient"); |
| 302 | 308 |
| 303 FuzzerClientListener listener; | 309 FuzzerClientListener listener; |
| 304 CreateChannel(&listener); | 310 CreateChannel(&listener); |
| 305 listener.Init(channel()); | 311 listener.Init(channel()); |
| 306 ASSERT_TRUE(ConnectChannel()); | 312 ASSERT_TRUE(ConnectChannel()); |
| 313 ASSERT_TRUE(StartClient()); |
| 307 | 314 |
| 308 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, | 315 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, |
| 309 IPC::Message::PRIORITY_NORMAL); | 316 IPC::Message::PRIORITY_NORMAL); |
| 310 msg->WriteInt(666); | 317 msg->WriteInt(666); |
| 311 sender()->Send(msg); | 318 sender()->Send(msg); |
| 312 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); | 319 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); |
| 313 | 320 |
| 314 msg = new MsgClassSI(base::ASCIIToUTF16("expect one"), 1); | 321 msg = new MsgClassSI(base::ASCIIToUTF16("expect one"), 1); |
| 315 sender()->Send(msg); | 322 sender()->Send(msg); |
| 316 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); | 323 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); |
| 317 | 324 |
| 318 EXPECT_TRUE(WaitForClientShutdown()); | 325 EXPECT_TRUE(WaitForClientShutdown()); |
| 319 DestroyChannel(); | 326 DestroyChannel(); |
| 320 } | 327 } |
| 321 #endif | 328 #endif |
| 322 | 329 |
| 323 // This test uses a payload that has too many arguments, but so the payload size | 330 // This test uses a payload that has too many arguments, but so the payload size |
| 324 // is big enough so the unpacking routine does not generate an error as in the | 331 // is big enough so the unpacking routine does not generate an error as in the |
| 325 // case of MsgBadPayloadShort test. This test does not pinpoint a flaw (per se) | 332 // case of MsgBadPayloadShort test. This test does not pinpoint a flaw (per se) |
| 326 // as by design we don't carry type information on the IPC message. | 333 // as by design we don't carry type information on the IPC message. |
| 327 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { | 334 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { |
| 328 Init("FuzzServerClient"); | 335 Init("FuzzServerClient"); |
| 329 | 336 |
| 330 FuzzerClientListener listener; | 337 FuzzerClientListener listener; |
| 331 CreateChannel(&listener); | 338 CreateChannel(&listener); |
| 332 listener.Init(channel()); | 339 listener.Init(channel()); |
| 333 ASSERT_TRUE(ConnectChannel()); | 340 ASSERT_TRUE(ConnectChannel()); |
| 341 ASSERT_TRUE(StartClient()); |
| 334 | 342 |
| 335 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, | 343 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, |
| 336 IPC::Message::PRIORITY_NORMAL); | 344 IPC::Message::PRIORITY_NORMAL); |
| 337 msg->WriteString16(base::ASCIIToUTF16("d")); | 345 msg->WriteString16(base::ASCIIToUTF16("d")); |
| 338 msg->WriteInt(0); | 346 msg->WriteInt(0); |
| 339 msg->WriteInt(0x65); // Extra argument. | 347 msg->WriteInt(0x65); // Extra argument. |
| 340 | 348 |
| 341 sender()->Send(msg); | 349 sender()->Send(msg); |
| 342 EXPECT_TRUE(listener.ExpectMessage(0, MsgClassSI::ID)); | 350 EXPECT_TRUE(listener.ExpectMessage(0, MsgClassSI::ID)); |
| 343 | 351 |
| 344 // Now send a well formed message to make sure the receiver wasn't | 352 // Now send a well formed message to make sure the receiver wasn't |
| 345 // thrown out of sync by the extra argument. | 353 // thrown out of sync by the extra argument. |
| 346 msg = new MsgClassIS(3, base::ASCIIToUTF16("expect three")); | 354 msg = new MsgClassIS(3, base::ASCIIToUTF16("expect three")); |
| 347 sender()->Send(msg); | 355 sender()->Send(msg); |
| 348 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); | 356 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); |
| 349 | 357 |
| 350 EXPECT_TRUE(WaitForClientShutdown()); | 358 EXPECT_TRUE(WaitForClientShutdown()); |
| 351 DestroyChannel(); | 359 DestroyChannel(); |
| 352 } | 360 } |
| 353 | 361 |
| 354 } // namespace | 362 } // namespace |
| OLD | NEW |