OLD | NEW |
1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <memory> | 5 #include <memory> |
6 #include <string> | 6 #include <string> |
7 | 7 |
8 #include "base/memory/ptr_util.h" | 8 #include "base/memory/ptr_util.h" |
9 #include "base/memory/singleton.h" | 9 #include "base/memory/singleton.h" |
10 #include "base/message_loop/message_loop.h" | |
11 #include "base/run_loop.h" | 10 #include "base/run_loop.h" |
12 #include "base/test/fuzzed_data_provider.h" | 11 #include "base/test/fuzzed_data_provider.h" |
13 #include "base/test/scoped_task_scheduler.h" | 12 #include "base/test/scoped_task_scheduler.h" |
14 #include "base/threading/thread_task_runner_handle.h" | 13 #include "base/threading/thread_task_runner_handle.h" |
15 #include "net/http/http_request_headers.h" | 14 #include "net/http/http_request_headers.h" |
16 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h" | 15 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h" |
17 #include "net/url_request/data_protocol_handler.h" | 16 #include "net/url_request/data_protocol_handler.h" |
18 #include "net/url_request/url_request.h" | 17 #include "net/url_request/url_request.h" |
19 #include "net/url_request/url_request_job_factory_impl.h" | 18 #include "net/url_request/url_request_job_factory_impl.h" |
20 #include "net/url_request/url_request_test_util.h" | 19 #include "net/url_request/url_request_test_util.h" |
21 | 20 |
22 namespace { | 21 namespace { |
23 | 22 |
24 const size_t kMaxLengthForFuzzedRange = 32; | 23 const size_t kMaxLengthForFuzzedRange = 32; |
25 | 24 |
26 } // namespace | 25 } // namespace |
27 | 26 |
28 // This class tests creating and reading to completion a URLRequest with fuzzed | 27 // This class tests creating and reading to completion a URLRequest with fuzzed |
29 // input. The fuzzer provides a data: URL and optionally generates custom Range | 28 // input. The fuzzer provides a data: URL and optionally generates custom Range |
30 // headers. The amount of data read in each Read call is also fuzzed, as is | 29 // headers. The amount of data read in each Read call is also fuzzed, as is |
31 // the size of the IOBuffer to read data into. | 30 // the size of the IOBuffer to read data into. |
32 class URLRequestDataJobFuzzerHarness : public net::URLRequest::Delegate { | 31 class URLRequestDataJobFuzzerHarness : public net::URLRequest::Delegate { |
33 public: | 32 public: |
34 URLRequestDataJobFuzzerHarness() | 33 URLRequestDataJobFuzzerHarness() |
35 : scoped_task_scheduler_(base::MessageLoop::current()), | 34 : task_runner_(base::ThreadTaskRunnerHandle::Get()), context_(true) { |
36 task_runner_(base::ThreadTaskRunnerHandle::Get()), | |
37 context_(true) { | |
38 job_factory_.SetProtocolHandler( | 35 job_factory_.SetProtocolHandler( |
39 "data", base::MakeUnique<net::DataProtocolHandler>()); | 36 "data", base::MakeUnique<net::DataProtocolHandler>()); |
40 context_.set_job_factory(&job_factory_); | 37 context_.set_job_factory(&job_factory_); |
41 context_.Init(); | 38 context_.Init(); |
42 } | 39 } |
43 | 40 |
44 static URLRequestDataJobFuzzerHarness* GetInstance() { | 41 static URLRequestDataJobFuzzerHarness* GetInstance() { |
45 return base::Singleton<URLRequestDataJobFuzzerHarness>::get(); | 42 return base::Singleton<URLRequestDataJobFuzzerHarness>::get(); |
46 } | 43 } |
47 | 44 |
(...skipping 105 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
153 if (bytes_read > 0) { | 150 if (bytes_read > 0) { |
154 ReadFromRequest(request); | 151 ReadFromRequest(request); |
155 } else { | 152 } else { |
156 QuitLoop(); | 153 QuitLoop(); |
157 } | 154 } |
158 } | 155 } |
159 | 156 |
160 private: | 157 private: |
161 friend struct base::DefaultSingletonTraits<URLRequestDataJobFuzzerHarness>; | 158 friend struct base::DefaultSingletonTraits<URLRequestDataJobFuzzerHarness>; |
162 | 159 |
163 base::test::ScopedTaskScheduler scoped_task_scheduler_; | |
164 scoped_refptr<base::SingleThreadTaskRunner> task_runner_; | 160 scoped_refptr<base::SingleThreadTaskRunner> task_runner_; |
165 | 161 |
166 net::TestURLRequestContext context_; | 162 net::TestURLRequestContext context_; |
167 net::URLRequestJobFactoryImpl job_factory_; | 163 net::URLRequestJobFactoryImpl job_factory_; |
168 std::vector<size_t> read_lengths_; | 164 std::vector<size_t> read_lengths_; |
169 scoped_refptr<net::IOBuffer> buf_; | 165 scoped_refptr<net::IOBuffer> buf_; |
170 base::RunLoop* read_loop_; | 166 base::RunLoop* read_loop_; |
171 | 167 |
172 DISALLOW_COPY_AND_ASSIGN(URLRequestDataJobFuzzerHarness); | 168 DISALLOW_COPY_AND_ASSIGN(URLRequestDataJobFuzzerHarness); |
173 }; | 169 }; |
174 | 170 |
175 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | 171 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
176 // Using a static singleton test harness lets the test run ~3-4x faster. | 172 // Using a static singleton test harness lets the test run ~3-4x faster. |
177 return URLRequestDataJobFuzzerHarness::GetInstance() | 173 return URLRequestDataJobFuzzerHarness::GetInstance() |
178 ->CreateAndReadFromDataURLRequest(data, size); | 174 ->CreateAndReadFromDataURLRequest(data, size); |
179 } | 175 } |
OLD | NEW |