Index: device/u2f/u2f_message_fuzzer.cc |
diff --git a/device/u2f/u2f_message_fuzzer.cc b/device/u2f/u2f_message_fuzzer.cc |
index 2d0c0d8cfaf8790fc60ae1cc69bc5600d20b0d15..bdc159d918db8de7631b6b6f05362a7bc6c1824c 100644 |
--- a/device/u2f/u2f_message_fuzzer.cc |
+++ b/device/u2f/u2f_message_fuzzer.cc |
@@ -5,17 +5,17 @@ |
#include <stddef.h> |
#include <stdint.h> |
#include <algorithm> |
+#include <vector> |
#include "net/base/io_buffer.h" |
#include "u2f_message.h" |
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
size_t packet_size = 65; |
size_t remaining_buffer = size; |
- uint8_t* start = const_cast<uint8_t*>(data); |
+ const uint8_t* start = data; |
- scoped_refptr<net::IOBufferWithSize> buf( |
- new net::IOBufferWithSize(packet_size)); |
- memcpy(buf->data(), start, std::min(packet_size, remaining_buffer)); |
+ std::vector<uint8_t> buf(start, |
+ start + std::min(packet_size, remaining_buffer)); |
std::unique_ptr<device::U2fMessage> msg = |
device::U2fMessage::CreateFromSerializedData(buf); |
@@ -24,9 +24,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
while (remaining_buffer > 0) { |
size_t buffer_size = std::min(packet_size, remaining_buffer); |
- scoped_refptr<net::IOBufferWithSize> tmp_buf( |
- new net::IOBufferWithSize(buffer_size)); |
- memcpy(tmp_buf->data(), start, buffer_size); |
+ std::vector<uint8_t> tmp_buf(start, start + buffer_size); |
msg->AddContinuationPacket(tmp_buf); |
remaining_buffer -= std::min(remaining_buffer, buffer_size); |
start += buffer_size; |