| OLD | NEW |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <memory> | 5 #include <memory> |
| 6 #include <string> | 6 #include <string> |
| 7 | 7 |
| 8 #include "base/memory/ptr_util.h" | 8 #include "base/memory/ptr_util.h" |
| 9 #include "base/memory/singleton.h" | 9 #include "base/memory/singleton.h" |
| 10 #include "base/message_loop/message_loop.h" | |
| 11 #include "base/run_loop.h" | 10 #include "base/run_loop.h" |
| 12 #include "base/test/fuzzed_data_provider.h" | 11 #include "base/test/fuzzed_data_provider.h" |
| 13 #include "base/test/scoped_task_scheduler.h" | 12 #include "base/test/scoped_task_scheduler.h" |
| 14 #include "base/threading/thread_task_runner_handle.h" | 13 #include "base/threading/thread_task_runner_handle.h" |
| 15 #include "net/http/http_request_headers.h" | 14 #include "net/http/http_request_headers.h" |
| 16 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h" | 15 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h" |
| 17 #include "net/url_request/data_protocol_handler.h" | 16 #include "net/url_request/data_protocol_handler.h" |
| 18 #include "net/url_request/url_request.h" | 17 #include "net/url_request/url_request.h" |
| 19 #include "net/url_request/url_request_job_factory_impl.h" | 18 #include "net/url_request/url_request_job_factory_impl.h" |
| 20 #include "net/url_request/url_request_test_util.h" | 19 #include "net/url_request/url_request_test_util.h" |
| 21 | 20 |
| 22 namespace { | 21 namespace { |
| 23 | 22 |
| 24 const size_t kMaxLengthForFuzzedRange = 32; | 23 const size_t kMaxLengthForFuzzedRange = 32; |
| 25 | 24 |
| 26 } // namespace | 25 } // namespace |
| 27 | 26 |
| 28 // This class tests creating and reading to completion a URLRequest with fuzzed | 27 // This class tests creating and reading to completion a URLRequest with fuzzed |
| 29 // input. The fuzzer provides a data: URL and optionally generates custom Range | 28 // input. The fuzzer provides a data: URL and optionally generates custom Range |
| 30 // headers. The amount of data read in each Read call is also fuzzed, as is | 29 // headers. The amount of data read in each Read call is also fuzzed, as is |
| 31 // the size of the IOBuffer to read data into. | 30 // the size of the IOBuffer to read data into. |
| 32 class URLRequestDataJobFuzzerHarness : public net::URLRequest::Delegate { | 31 class URLRequestDataJobFuzzerHarness : public net::URLRequest::Delegate { |
| 33 public: | 32 public: |
| 34 URLRequestDataJobFuzzerHarness() | 33 URLRequestDataJobFuzzerHarness() |
| 35 : scoped_task_scheduler_(base::MessageLoop::current()), | 34 : task_runner_(base::ThreadTaskRunnerHandle::Get()), context_(true) { |
| 36 task_runner_(base::ThreadTaskRunnerHandle::Get()), | |
| 37 context_(true) { | |
| 38 job_factory_.SetProtocolHandler( | 35 job_factory_.SetProtocolHandler( |
| 39 "data", base::MakeUnique<net::DataProtocolHandler>()); | 36 "data", base::MakeUnique<net::DataProtocolHandler>()); |
| 40 context_.set_job_factory(&job_factory_); | 37 context_.set_job_factory(&job_factory_); |
| 41 context_.Init(); | 38 context_.Init(); |
| 42 } | 39 } |
| 43 | 40 |
| 44 static URLRequestDataJobFuzzerHarness* GetInstance() { | 41 static URLRequestDataJobFuzzerHarness* GetInstance() { |
| 45 return base::Singleton<URLRequestDataJobFuzzerHarness>::get(); | 42 return base::Singleton<URLRequestDataJobFuzzerHarness>::get(); |
| 46 } | 43 } |
| 47 | 44 |
| (...skipping 105 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 153 if (bytes_read > 0) { | 150 if (bytes_read > 0) { |
| 154 ReadFromRequest(request); | 151 ReadFromRequest(request); |
| 155 } else { | 152 } else { |
| 156 QuitLoop(); | 153 QuitLoop(); |
| 157 } | 154 } |
| 158 } | 155 } |
| 159 | 156 |
| 160 private: | 157 private: |
| 161 friend struct base::DefaultSingletonTraits<URLRequestDataJobFuzzerHarness>; | 158 friend struct base::DefaultSingletonTraits<URLRequestDataJobFuzzerHarness>; |
| 162 | 159 |
| 163 base::test::ScopedTaskScheduler scoped_task_scheduler_; | |
| 164 scoped_refptr<base::SingleThreadTaskRunner> task_runner_; | 160 scoped_refptr<base::SingleThreadTaskRunner> task_runner_; |
| 165 | 161 |
| 166 net::TestURLRequestContext context_; | 162 net::TestURLRequestContext context_; |
| 167 net::URLRequestJobFactoryImpl job_factory_; | 163 net::URLRequestJobFactoryImpl job_factory_; |
| 168 std::vector<size_t> read_lengths_; | 164 std::vector<size_t> read_lengths_; |
| 169 scoped_refptr<net::IOBuffer> buf_; | 165 scoped_refptr<net::IOBuffer> buf_; |
| 170 base::RunLoop* read_loop_; | 166 base::RunLoop* read_loop_; |
| 171 | 167 |
| 172 DISALLOW_COPY_AND_ASSIGN(URLRequestDataJobFuzzerHarness); | 168 DISALLOW_COPY_AND_ASSIGN(URLRequestDataJobFuzzerHarness); |
| 173 }; | 169 }; |
| 174 | 170 |
| 175 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | 171 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
| 176 // Using a static singleton test harness lets the test run ~3-4x faster. | 172 // Using a static singleton test harness lets the test run ~3-4x faster. |
| 177 return URLRequestDataJobFuzzerHarness::GetInstance() | 173 return URLRequestDataJobFuzzerHarness::GetInstance() |
| 178 ->CreateAndReadFromDataURLRequest(data, size); | 174 ->CreateAndReadFromDataURLRequest(data, size); |
| 179 } | 175 } |
| OLD | NEW |