| OLD | NEW |
| (Empty) |
| 1 // Copyright 2017 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "base/logging.h" | |
| 6 #include "base/macros.h" | |
| 7 #include "base/memory/ptr_util.h" | |
| 8 #include "base/run_loop.h" | |
| 9 #include "base/test/fuzzed_data_provider.h" | |
| 10 #include "net/base/net_errors.h" | |
| 11 #include "net/base/request_priority.h" | |
| 12 #include "net/log/net_log_source.h" | |
| 13 #include "net/log/test_net_log.h" | |
| 14 #include "net/socket/fuzzed_socket_factory.h" | |
| 15 #include "net/spdy/spdy_test_util_common.h" | |
| 16 | |
| 17 namespace { | |
| 18 | |
| 19 class FuzzerDelegate : public net::SpdyStream::Delegate { | |
| 20 public: | |
| 21 explicit FuzzerDelegate(const base::Closure& done_closure) | |
| 22 : done_closure_(done_closure) {} | |
| 23 | |
| 24 void OnHeadersSent() override {} | |
| 25 void OnHeadersReceived( | |
| 26 const net::SpdyHeaderBlock& response_headers) override {} | |
| 27 void OnDataReceived(std::unique_ptr<net::SpdyBuffer> buffer) override {} | |
| 28 void OnDataSent() override {} | |
| 29 void OnTrailers(const net::SpdyHeaderBlock& trailers) override {} | |
| 30 | |
| 31 void OnClose(int status) override { done_closure_.Run(); } | |
| 32 | |
| 33 net::NetLogSource source_dependency() const override { | |
| 34 return net::NetLogSource(); | |
| 35 } | |
| 36 | |
| 37 private: | |
| 38 base::Closure done_closure_; | |
| 39 DISALLOW_COPY_AND_ASSIGN(FuzzerDelegate); | |
| 40 }; | |
| 41 | |
| 42 } // namespace | |
| 43 | |
| 44 // Fuzzer for SpdySession | |
| 45 // | |
| 46 // |data| is used to create a FuzzedServerSocket. | |
| 47 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | |
| 48 net::BoundTestNetLog bound_test_net_log; | |
| 49 base::FuzzedDataProvider data_provider(data, size); | |
| 50 net::FuzzedSocketFactory socket_factory(&data_provider); | |
| 51 socket_factory.set_fuzz_connect_result(false); | |
| 52 net::SpdySessionDependencies deps; | |
| 53 std::unique_ptr<net::HttpNetworkSession> http_session( | |
| 54 net::SpdySessionDependencies::SpdyCreateSessionWithSocketFactory( | |
| 55 &deps, &socket_factory)); | |
| 56 | |
| 57 net::ProxyServer direct_connect(net::ProxyServer::Direct()); | |
| 58 net::SpdySessionKey session_key(net::HostPortPair("127.0.0.1", 80), | |
| 59 direct_connect, net::PRIVACY_MODE_DISABLED); | |
| 60 base::WeakPtr<net::SpdySession> spdy_session(net::CreateInsecureSpdySession( | |
| 61 http_session.get(), session_key, bound_test_net_log.bound())); | |
| 62 | |
| 63 net::SpdyStreamRequest stream_request; | |
| 64 base::WeakPtr<net::SpdyStream> stream; | |
| 65 | |
| 66 net::TestCompletionCallback wait_for_start; | |
| 67 int rv = stream_request.StartRequest( | |
| 68 net::SPDY_REQUEST_RESPONSE_STREAM, spdy_session, | |
| 69 GURL("http://www.example.invalid/"), net::DEFAULT_PRIORITY, | |
| 70 bound_test_net_log.bound(), wait_for_start.callback()); | |
| 71 | |
| 72 if (rv == net::ERR_IO_PENDING) { | |
| 73 rv = wait_for_start.WaitForResult(); | |
| 74 } | |
| 75 | |
| 76 // Re-check the status after potential event loop. | |
| 77 if (rv != net::OK) { | |
| 78 LOG(WARNING) << "StartRequest failed with result=" << rv; | |
| 79 return 0; | |
| 80 } | |
| 81 | |
| 82 stream = stream_request.ReleaseStream(); | |
| 83 stream->SendRequestHeaders( | |
| 84 net::SpdyTestUtil::ConstructGetHeaderBlock("http://www.example.invalid"), | |
| 85 net::NO_MORE_DATA_TO_SEND); | |
| 86 | |
| 87 base::RunLoop run_loop; | |
| 88 FuzzerDelegate delegate(run_loop.QuitClosure()); | |
| 89 stream->SetDelegate(&delegate); | |
| 90 run_loop.Run(); | |
| 91 | |
| 92 // Give a chance for GOING_AWAY sessions to wrap up. | |
| 93 base::RunLoop().RunUntilIdle(); | |
| 94 | |
| 95 return 0; | |
| 96 } | |
| OLD | NEW |