OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <iostream> | 5 #include <iostream> |
6 #include <set> | 6 #include <set> |
7 #include <string> | 7 #include <string> |
8 #include <tuple> | 8 #include <tuple> |
9 #include <utility> | 9 #include <utility> |
10 #include <vector> | 10 #include <vector> |
(...skipping 486 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
497 static bool Fuzz(base::ListValue* p, Fuzzer* fuzzer) { | 497 static bool Fuzz(base::ListValue* p, Fuzzer* fuzzer) { |
498 // TODO(mbarbella): Support mutation. | 498 // TODO(mbarbella): Support mutation. |
499 if (!fuzzer->ShouldGenerate()) | 499 if (!fuzzer->ShouldGenerate()) |
500 return true; | 500 return true; |
501 | 501 |
502 ++g_depth; | 502 ++g_depth; |
503 size_t list_length = p->GetSize(); | 503 size_t list_length = p->GetSize(); |
504 if (fuzzer->ShouldGenerate()) | 504 if (fuzzer->ShouldGenerate()) |
505 list_length = g_depth > 3 ? 0 : RandInRange(8); | 505 list_length = g_depth > 3 ? 0 : RandInRange(8); |
506 for (size_t index = 0; index < list_length; ++index) { | 506 for (size_t index = 0; index < list_length; ++index) { |
507 switch (RandInRange(8)) { | 507 switch (static_cast<base::Value::Type>(RandInRange(8))) { |
508 case base::Value::TYPE_BOOLEAN: { | 508 case base::Value::Type::BOOLEAN: { |
509 bool tmp; | 509 bool tmp; |
510 p->GetBoolean(index, &tmp); | 510 p->GetBoolean(index, &tmp); |
511 fuzzer->FuzzBool(&tmp); | 511 fuzzer->FuzzBool(&tmp); |
512 p->Set(index, new base::FundamentalValue(tmp)); | 512 p->Set(index, new base::FundamentalValue(tmp)); |
513 break; | 513 break; |
514 } | 514 } |
515 case base::Value::TYPE_INTEGER: { | 515 case base::Value::Type::INTEGER: { |
516 int tmp; | 516 int tmp; |
517 p->GetInteger(index, &tmp); | 517 p->GetInteger(index, &tmp); |
518 fuzzer->FuzzInt(&tmp); | 518 fuzzer->FuzzInt(&tmp); |
519 p->Set(index, new base::FundamentalValue(tmp)); | 519 p->Set(index, new base::FundamentalValue(tmp)); |
520 break; | 520 break; |
521 } | 521 } |
522 case base::Value::TYPE_DOUBLE: { | 522 case base::Value::Type::DOUBLE: { |
523 double tmp; | 523 double tmp; |
524 p->GetDouble(index, &tmp); | 524 p->GetDouble(index, &tmp); |
525 fuzzer->FuzzDouble(&tmp); | 525 fuzzer->FuzzDouble(&tmp); |
526 p->Set(index, new base::FundamentalValue(tmp)); | 526 p->Set(index, new base::FundamentalValue(tmp)); |
527 break; | 527 break; |
528 } | 528 } |
529 case base::Value::TYPE_STRING: { | 529 case base::Value::Type::STRING: { |
530 std::string tmp; | 530 std::string tmp; |
531 p->GetString(index, &tmp); | 531 p->GetString(index, &tmp); |
532 fuzzer->FuzzString(&tmp); | 532 fuzzer->FuzzString(&tmp); |
533 p->Set(index, new base::StringValue(tmp)); | 533 p->Set(index, new base::StringValue(tmp)); |
534 break; | 534 break; |
535 } | 535 } |
536 case base::Value::TYPE_BINARY: { | 536 case base::Value::Type::BINARY: { |
537 char tmp[200]; | 537 char tmp[200]; |
538 size_t bin_length = RandInRange(sizeof(tmp)); | 538 size_t bin_length = RandInRange(sizeof(tmp)); |
539 fuzzer->FuzzData(tmp, bin_length); | 539 fuzzer->FuzzData(tmp, bin_length); |
540 p->Set(index, | 540 p->Set(index, |
541 base::BinaryValue::CreateWithCopiedBuffer(tmp, bin_length)); | 541 base::BinaryValue::CreateWithCopiedBuffer(tmp, bin_length)); |
542 break; | 542 break; |
543 } | 543 } |
544 case base::Value::TYPE_DICTIONARY: { | 544 case base::Value::Type::DICTIONARY: { |
545 base::DictionaryValue* tmp = new base::DictionaryValue(); | 545 base::DictionaryValue* tmp = new base::DictionaryValue(); |
546 p->GetDictionary(index, &tmp); | 546 p->GetDictionary(index, &tmp); |
547 FuzzParam(tmp, fuzzer); | 547 FuzzParam(tmp, fuzzer); |
548 p->Set(index, tmp); | 548 p->Set(index, tmp); |
549 break; | 549 break; |
550 } | 550 } |
551 case base::Value::TYPE_LIST: { | 551 case base::Value::Type::LIST: { |
552 base::ListValue* tmp = new base::ListValue(); | 552 base::ListValue* tmp = new base::ListValue(); |
553 p->GetList(index, &tmp); | 553 p->GetList(index, &tmp); |
554 FuzzParam(tmp, fuzzer); | 554 FuzzParam(tmp, fuzzer); |
555 p->Set(index, tmp); | 555 p->Set(index, tmp); |
556 break; | 556 break; |
557 } | 557 } |
558 case base::Value::TYPE_NULL: | 558 case base::Value::Type::NONE: |
559 default: | 559 default: |
560 break; | 560 break; |
561 } | 561 } |
562 } | 562 } |
563 --g_depth; | 563 --g_depth; |
564 return true; | 564 return true; |
565 } | 565 } |
566 }; | 566 }; |
567 | 567 |
568 template <> | 568 template <> |
569 struct FuzzTraits<base::DictionaryValue> { | 569 struct FuzzTraits<base::DictionaryValue> { |
570 static bool Fuzz(base::DictionaryValue* p, Fuzzer* fuzzer) { | 570 static bool Fuzz(base::DictionaryValue* p, Fuzzer* fuzzer) { |
571 // TODO(mbarbella): Support mutation. | 571 // TODO(mbarbella): Support mutation. |
572 if (!fuzzer->ShouldGenerate()) | 572 if (!fuzzer->ShouldGenerate()) |
573 return true; | 573 return true; |
574 | 574 |
575 ++g_depth; | 575 ++g_depth; |
576 size_t dict_length = g_depth > 3 ? 0 : RandInRange(8); | 576 size_t dict_length = g_depth > 3 ? 0 : RandInRange(8); |
577 for (size_t index = 0; index < dict_length; ++index) { | 577 for (size_t index = 0; index < dict_length; ++index) { |
578 std::string property; | 578 std::string property; |
579 fuzzer->FuzzString(&property); | 579 fuzzer->FuzzString(&property); |
580 switch (RandInRange(8)) { | 580 switch (static_cast<base::Value::Type>(RandInRange(8))) { |
581 case base::Value::TYPE_BOOLEAN: { | 581 case base::Value::Type::BOOLEAN: { |
582 bool tmp; | 582 bool tmp; |
583 fuzzer->FuzzBool(&tmp); | 583 fuzzer->FuzzBool(&tmp); |
584 p->SetWithoutPathExpansion(property, new base::FundamentalValue(tmp)); | 584 p->SetWithoutPathExpansion(property, new base::FundamentalValue(tmp)); |
585 break; | 585 break; |
586 } | 586 } |
587 case base::Value::TYPE_INTEGER: { | 587 case base::Value::Type::INTEGER: { |
588 int tmp; | 588 int tmp; |
589 fuzzer->FuzzInt(&tmp); | 589 fuzzer->FuzzInt(&tmp); |
590 p->SetWithoutPathExpansion(property, new base::FundamentalValue(tmp)); | 590 p->SetWithoutPathExpansion(property, new base::FundamentalValue(tmp)); |
591 break; | 591 break; |
592 } | 592 } |
593 case base::Value::TYPE_DOUBLE: { | 593 case base::Value::Type::DOUBLE: { |
594 double tmp; | 594 double tmp; |
595 fuzzer->FuzzDouble(&tmp); | 595 fuzzer->FuzzDouble(&tmp); |
596 p->SetWithoutPathExpansion(property, new base::FundamentalValue(tmp)); | 596 p->SetWithoutPathExpansion(property, new base::FundamentalValue(tmp)); |
597 break; | 597 break; |
598 } | 598 } |
599 case base::Value::TYPE_STRING: { | 599 case base::Value::Type::STRING: { |
600 std::string tmp; | 600 std::string tmp; |
601 fuzzer->FuzzString(&tmp); | 601 fuzzer->FuzzString(&tmp); |
602 p->SetWithoutPathExpansion(property, new base::StringValue(tmp)); | 602 p->SetWithoutPathExpansion(property, new base::StringValue(tmp)); |
603 break; | 603 break; |
604 } | 604 } |
605 case base::Value::TYPE_BINARY: { | 605 case base::Value::Type::BINARY: { |
606 char tmp[200]; | 606 char tmp[200]; |
607 size_t bin_length = RandInRange(sizeof(tmp)); | 607 size_t bin_length = RandInRange(sizeof(tmp)); |
608 fuzzer->FuzzData(tmp, bin_length); | 608 fuzzer->FuzzData(tmp, bin_length); |
609 p->SetWithoutPathExpansion( | 609 p->SetWithoutPathExpansion( |
610 property, | 610 property, |
611 base::BinaryValue::CreateWithCopiedBuffer(tmp, bin_length)); | 611 base::BinaryValue::CreateWithCopiedBuffer(tmp, bin_length)); |
612 break; | 612 break; |
613 } | 613 } |
614 case base::Value::TYPE_DICTIONARY: { | 614 case base::Value::Type::DICTIONARY: { |
615 base::DictionaryValue* tmp = new base::DictionaryValue(); | 615 base::DictionaryValue* tmp = new base::DictionaryValue(); |
616 FuzzParam(tmp, fuzzer); | 616 FuzzParam(tmp, fuzzer); |
617 p->SetWithoutPathExpansion(property, tmp); | 617 p->SetWithoutPathExpansion(property, tmp); |
618 break; | 618 break; |
619 } | 619 } |
620 case base::Value::TYPE_LIST: { | 620 case base::Value::Type::LIST: { |
621 base::ListValue* tmp = new base::ListValue(); | 621 base::ListValue* tmp = new base::ListValue(); |
622 FuzzParam(tmp, fuzzer); | 622 FuzzParam(tmp, fuzzer); |
623 p->SetWithoutPathExpansion(property, tmp); | 623 p->SetWithoutPathExpansion(property, tmp); |
624 break; | 624 break; |
625 } | 625 } |
626 case base::Value::TYPE_NULL: | 626 case base::Value::Type::NONE: |
627 default: | 627 default: |
628 break; | 628 break; |
629 } | 629 } |
630 } | 630 } |
631 --g_depth; | 631 --g_depth; |
632 return true; | 632 return true; |
633 } | 633 } |
634 }; | 634 }; |
635 | 635 |
636 template <> | 636 template <> |
(...skipping 1248 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1885 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 1885 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
1886 #undef IPC_MESSAGE_DECL | 1886 #undef IPC_MESSAGE_DECL |
1887 #define IPC_MESSAGE_DECL(name, ...) \ | 1887 #define IPC_MESSAGE_DECL(name, ...) \ |
1888 (*map)[static_cast<uint32_t>(name::ID)] = FuzzerHelper<name>::Fuzz; | 1888 (*map)[static_cast<uint32_t>(name::ID)] = FuzzerHelper<name>::Fuzz; |
1889 | 1889 |
1890 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { | 1890 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { |
1891 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 1891 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
1892 } | 1892 } |
1893 | 1893 |
1894 } // namespace ipc_fuzzer | 1894 } // namespace ipc_fuzzer |
OLD | NEW |