OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <iostream> | 5 #include <iostream> |
6 #include <set> | 6 #include <set> |
7 #include <string> | 7 #include <string> |
8 #include <tuple> | 8 #include <tuple> |
9 #include <utility> | 9 #include <utility> |
10 #include <vector> | 10 #include <vector> |
11 | 11 |
12 #include "base/macros.h" | 12 #include "base/macros.h" |
| 13 #include "base/memory/ptr_util.h" |
13 #include "base/memory/shared_memory_handle.h" | 14 #include "base/memory/shared_memory_handle.h" |
14 #include "base/strings/string_util.h" | 15 #include "base/strings/string_util.h" |
15 #include "base/values.h" | 16 #include "base/values.h" |
16 #include "build/build_config.h" | 17 #include "build/build_config.h" |
17 #include "ipc/ipc_message.h" | 18 #include "ipc/ipc_message.h" |
18 #include "ipc/ipc_message_utils.h" | 19 #include "ipc/ipc_message_utils.h" |
19 #include "ipc/ipc_sync_channel.h" | 20 #include "ipc/ipc_sync_channel.h" |
20 #include "ipc/ipc_sync_message.h" | 21 #include "ipc/ipc_sync_message.h" |
21 #include "tools/ipc_fuzzer/fuzzer/fuzzer.h" | 22 #include "tools/ipc_fuzzer/fuzzer/fuzzer.h" |
22 #include "tools/ipc_fuzzer/fuzzer/rand_util.h" | 23 #include "tools/ipc_fuzzer/fuzzer/rand_util.h" |
(...skipping 480 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
503 ++g_depth; | 504 ++g_depth; |
504 size_t list_length = p->GetSize(); | 505 size_t list_length = p->GetSize(); |
505 if (fuzzer->ShouldGenerate()) | 506 if (fuzzer->ShouldGenerate()) |
506 list_length = g_depth > 3 ? 0 : RandInRange(8); | 507 list_length = g_depth > 3 ? 0 : RandInRange(8); |
507 for (size_t index = 0; index < list_length; ++index) { | 508 for (size_t index = 0; index < list_length; ++index) { |
508 switch (static_cast<base::Value::Type>(RandInRange(8))) { | 509 switch (static_cast<base::Value::Type>(RandInRange(8))) { |
509 case base::Value::Type::BOOLEAN: { | 510 case base::Value::Type::BOOLEAN: { |
510 bool tmp; | 511 bool tmp; |
511 p->GetBoolean(index, &tmp); | 512 p->GetBoolean(index, &tmp); |
512 fuzzer->FuzzBool(&tmp); | 513 fuzzer->FuzzBool(&tmp); |
513 p->Set(index, new base::Value(tmp)); | 514 p->Set(index, base::MakeUnique<base::Value>(tmp)); |
514 break; | 515 break; |
515 } | 516 } |
516 case base::Value::Type::INTEGER: { | 517 case base::Value::Type::INTEGER: { |
517 int tmp; | 518 int tmp; |
518 p->GetInteger(index, &tmp); | 519 p->GetInteger(index, &tmp); |
519 fuzzer->FuzzInt(&tmp); | 520 fuzzer->FuzzInt(&tmp); |
520 p->Set(index, new base::Value(tmp)); | 521 p->Set(index, base::MakeUnique<base::Value>(tmp)); |
521 break; | 522 break; |
522 } | 523 } |
523 case base::Value::Type::DOUBLE: { | 524 case base::Value::Type::DOUBLE: { |
524 double tmp; | 525 double tmp; |
525 p->GetDouble(index, &tmp); | 526 p->GetDouble(index, &tmp); |
526 fuzzer->FuzzDouble(&tmp); | 527 fuzzer->FuzzDouble(&tmp); |
527 p->Set(index, new base::Value(tmp)); | 528 p->Set(index, base::MakeUnique<base::Value>(tmp)); |
528 break; | 529 break; |
529 } | 530 } |
530 case base::Value::Type::STRING: { | 531 case base::Value::Type::STRING: { |
531 std::string tmp; | 532 std::string tmp; |
532 p->GetString(index, &tmp); | 533 p->GetString(index, &tmp); |
533 fuzzer->FuzzString(&tmp); | 534 fuzzer->FuzzString(&tmp); |
534 p->Set(index, new base::Value(tmp)); | 535 p->Set(index, base::MakeUnique<base::Value>(tmp)); |
535 break; | 536 break; |
536 } | 537 } |
537 case base::Value::Type::BINARY: { | 538 case base::Value::Type::BINARY: { |
538 char tmp[200]; | 539 char tmp[200]; |
539 size_t bin_length = RandInRange(sizeof(tmp)); | 540 size_t bin_length = RandInRange(sizeof(tmp)); |
540 fuzzer->FuzzData(tmp, bin_length); | 541 fuzzer->FuzzData(tmp, bin_length); |
541 p->Set(index, base::Value::CreateWithCopiedBuffer(tmp, bin_length)); | 542 p->Set(index, base::Value::CreateWithCopiedBuffer(tmp, bin_length)); |
542 break; | 543 break; |
543 } | 544 } |
544 case base::Value::Type::DICTIONARY: { | 545 case base::Value::Type::DICTIONARY: { |
545 base::DictionaryValue* tmp = new base::DictionaryValue(); | 546 base::DictionaryValue* dict_weak = nullptr; |
546 p->GetDictionary(index, &tmp); | 547 if (p->GetDictionary(index, &dict_weak)) { |
547 FuzzParam(tmp, fuzzer); | 548 FuzzParam(dict_weak, fuzzer); |
548 p->Set(index, tmp); | 549 } else { |
| 550 auto dict = base::MakeUnique<base::DictionaryValue>(); |
| 551 FuzzParam(dict.get(), fuzzer); |
| 552 p->Set(index, std::move(dict)); |
| 553 } |
549 break; | 554 break; |
550 } | 555 } |
551 case base::Value::Type::LIST: { | 556 case base::Value::Type::LIST: { |
552 base::ListValue* tmp = new base::ListValue(); | 557 base::ListValue* list_weak = nullptr; |
553 p->GetList(index, &tmp); | 558 if (p->GetList(index, &list_weak)) { |
554 FuzzParam(tmp, fuzzer); | 559 FuzzParam(list_weak, fuzzer); |
555 p->Set(index, tmp); | 560 } else { |
| 561 auto list = base::MakeUnique<base::ListValue>(); |
| 562 FuzzParam(list.get(), fuzzer); |
| 563 p->Set(index, std::move(list)); |
| 564 } |
556 break; | 565 break; |
557 } | 566 } |
558 case base::Value::Type::NONE: | 567 case base::Value::Type::NONE: |
559 default: | 568 default: |
560 break; | 569 break; |
561 } | 570 } |
562 } | 571 } |
563 --g_depth; | 572 --g_depth; |
564 return true; | 573 return true; |
565 } | 574 } |
(...skipping 1247 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1813 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 1822 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
1814 #undef IPC_MESSAGE_DECL | 1823 #undef IPC_MESSAGE_DECL |
1815 #define IPC_MESSAGE_DECL(name, ...) \ | 1824 #define IPC_MESSAGE_DECL(name, ...) \ |
1816 (*map)[static_cast<uint32_t>(name::ID)] = FuzzerHelper<name>::Fuzz; | 1825 (*map)[static_cast<uint32_t>(name::ID)] = FuzzerHelper<name>::Fuzz; |
1817 | 1826 |
1818 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { | 1827 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { |
1819 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 1828 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
1820 } | 1829 } |
1821 | 1830 |
1822 } // namespace ipc_fuzzer | 1831 } // namespace ipc_fuzzer |
OLD | NEW |