OLD | NEW |
| (Empty) |
1 // Copyright 2017 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "base/logging.h" | |
6 #include "base/macros.h" | |
7 #include "base/memory/ptr_util.h" | |
8 #include "base/run_loop.h" | |
9 #include "base/test/fuzzed_data_provider.h" | |
10 #include "net/base/net_errors.h" | |
11 #include "net/base/request_priority.h" | |
12 #include "net/log/net_log_source.h" | |
13 #include "net/log/test_net_log.h" | |
14 #include "net/socket/fuzzed_socket_factory.h" | |
15 #include "net/spdy/spdy_test_util_common.h" | |
16 | |
17 namespace { | |
18 | |
19 class FuzzerDelegate : public net::SpdyStream::Delegate { | |
20 public: | |
21 explicit FuzzerDelegate(const base::Closure& done_closure) | |
22 : done_closure_(done_closure) {} | |
23 | |
24 void OnHeadersSent() override {} | |
25 void OnHeadersReceived( | |
26 const net::SpdyHeaderBlock& response_headers) override {} | |
27 void OnDataReceived(std::unique_ptr<net::SpdyBuffer> buffer) override {} | |
28 void OnDataSent() override {} | |
29 void OnTrailers(const net::SpdyHeaderBlock& trailers) override {} | |
30 | |
31 void OnClose(int status) override { done_closure_.Run(); } | |
32 | |
33 net::NetLogSource source_dependency() const override { | |
34 return net::NetLogSource(); | |
35 } | |
36 | |
37 private: | |
38 base::Closure done_closure_; | |
39 DISALLOW_COPY_AND_ASSIGN(FuzzerDelegate); | |
40 }; | |
41 | |
42 } // namespace | |
43 | |
44 // Fuzzer for SpdySession | |
45 // | |
46 // |data| is used to create a FuzzedServerSocket. | |
47 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | |
48 net::BoundTestNetLog bound_test_net_log; | |
49 base::FuzzedDataProvider data_provider(data, size); | |
50 net::FuzzedSocketFactory socket_factory(&data_provider); | |
51 socket_factory.set_fuzz_connect_result(false); | |
52 net::SpdySessionDependencies deps; | |
53 std::unique_ptr<net::HttpNetworkSession> http_session( | |
54 net::SpdySessionDependencies::SpdyCreateSessionWithSocketFactory( | |
55 &deps, &socket_factory)); | |
56 | |
57 net::ProxyServer direct_connect(net::ProxyServer::Direct()); | |
58 net::SpdySessionKey session_key(net::HostPortPair("127.0.0.1", 80), | |
59 direct_connect, net::PRIVACY_MODE_DISABLED); | |
60 base::WeakPtr<net::SpdySession> spdy_session(net::CreateInsecureSpdySession( | |
61 http_session.get(), session_key, bound_test_net_log.bound())); | |
62 | |
63 net::SpdyStreamRequest stream_request; | |
64 base::WeakPtr<net::SpdyStream> stream; | |
65 | |
66 net::TestCompletionCallback wait_for_start; | |
67 int rv = stream_request.StartRequest( | |
68 net::SPDY_REQUEST_RESPONSE_STREAM, spdy_session, | |
69 GURL("http://www.example.invalid/"), net::DEFAULT_PRIORITY, | |
70 bound_test_net_log.bound(), wait_for_start.callback()); | |
71 | |
72 if (rv == net::ERR_IO_PENDING) { | |
73 rv = wait_for_start.WaitForResult(); | |
74 } | |
75 | |
76 // Re-check the status after potential event loop. | |
77 if (rv != net::OK) { | |
78 LOG(WARNING) << "StartRequest failed with result=" << rv; | |
79 return 0; | |
80 } | |
81 | |
82 stream = stream_request.ReleaseStream(); | |
83 stream->SendRequestHeaders( | |
84 net::SpdyTestUtil::ConstructGetHeaderBlock("http://www.example.invalid"), | |
85 net::NO_MORE_DATA_TO_SEND); | |
86 | |
87 base::RunLoop run_loop; | |
88 FuzzerDelegate delegate(run_loop.QuitClosure()); | |
89 stream->SetDelegate(&delegate); | |
90 run_loop.Run(); | |
91 | |
92 // Give a chance for GOING_AWAY sessions to wrap up. | |
93 base::RunLoop().RunUntilIdle(); | |
94 | |
95 return 0; | |
96 } | |
OLD | NEW |