| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/spdy/core/fuzzing/hpack_fuzz_util.h" | 5 #include "net/spdy/core/fuzzing/hpack_fuzz_util.h" |
| 6 | 6 |
| 7 #include <algorithm> | 7 #include <algorithm> |
| 8 #include <cmath> | 8 #include <cmath> |
| 9 | 9 |
| 10 #include "base/rand_util.h" | 10 #include "base/rand_util.h" |
| 11 #include "base/sys_byteorder.h" | 11 #include "base/sys_byteorder.h" |
| 12 #include "net/spdy/core/hpack/hpack_constants.h" | 12 #include "net/spdy/core/hpack/hpack_constants.h" |
| 13 #include "net/spdy/platform/api/spdy_ptr_util.h" |
| 13 | 14 |
| 14 namespace net { | 15 namespace net { |
| 15 | 16 |
| 16 namespace { | 17 namespace { |
| 17 | 18 |
| 18 // Sampled exponential distribution parameters: | 19 // Sampled exponential distribution parameters: |
| 19 // Number of headers in each header set. | 20 // Number of headers in each header set. |
| 20 const size_t kHeaderCountMean = 7; | 21 const size_t kHeaderCountMean = 7; |
| 21 const size_t kHeaderCountMax = 50; | 22 const size_t kHeaderCountMax = 50; |
| 22 // Selected index within list of headers. | 23 // Selected index within list of headers. |
| (...skipping 108 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 131 } | 132 } |
| 132 | 133 |
| 133 // static | 134 // static |
| 134 SpdyString HpackFuzzUtil::HeaderBlockPrefix(size_t block_size) { | 135 SpdyString HpackFuzzUtil::HeaderBlockPrefix(size_t block_size) { |
| 135 uint32_t length = base::HostToNet32(static_cast<uint32_t>(block_size)); | 136 uint32_t length = base::HostToNet32(static_cast<uint32_t>(block_size)); |
| 136 return SpdyString(reinterpret_cast<char*>(&length), sizeof(uint32_t)); | 137 return SpdyString(reinterpret_cast<char*>(&length), sizeof(uint32_t)); |
| 137 } | 138 } |
| 138 | 139 |
| 139 // static | 140 // static |
| 140 void HpackFuzzUtil::InitializeFuzzerContext(FuzzerContext* context) { | 141 void HpackFuzzUtil::InitializeFuzzerContext(FuzzerContext* context) { |
| 141 context->first_stage.reset(new HpackDecoder()); | 142 context->first_stage = SpdyMakeUnique<HpackDecoder>(); |
| 142 context->second_stage.reset(new HpackEncoder(ObtainHpackHuffmanTable())); | 143 context->second_stage = |
| 143 context->third_stage.reset(new HpackDecoder()); | 144 SpdyMakeUnique<HpackEncoder>(ObtainHpackHuffmanTable()); |
| 145 context->third_stage = SpdyMakeUnique<HpackDecoder>(); |
| 144 } | 146 } |
| 145 | 147 |
| 146 // static | 148 // static |
| 147 bool HpackFuzzUtil::RunHeaderBlockThroughFuzzerStages( | 149 bool HpackFuzzUtil::RunHeaderBlockThroughFuzzerStages( |
| 148 FuzzerContext* context, | 150 FuzzerContext* context, |
| 149 SpdyStringPiece input_block) { | 151 SpdyStringPiece input_block) { |
| 150 // First stage: Decode the input header block. This may fail on invalid input. | 152 // First stage: Decode the input header block. This may fail on invalid input. |
| 151 if (!context->first_stage->HandleControlFrameHeadersData( | 153 if (!context->first_stage->HandleControlFrameHeadersData( |
| 152 input_block.data(), input_block.size())) { | 154 input_block.data(), input_block.size())) { |
| 153 return false; | 155 return false; |
| (...skipping 27 matching lines...) Expand all Loading... |
| 181 uint64_t bits_to_flip = flip_per_thousand * (1 + buffer_bit_length / 1024); | 183 uint64_t bits_to_flip = flip_per_thousand * (1 + buffer_bit_length / 1024); |
| 182 | 184 |
| 183 // Iteratively identify & flip offsets in the buffer bit-sequence. | 185 // Iteratively identify & flip offsets in the buffer bit-sequence. |
| 184 for (uint64_t i = 0; i != bits_to_flip; ++i) { | 186 for (uint64_t i = 0; i != bits_to_flip; ++i) { |
| 185 uint64_t bit_offset = base::RandUint64() % buffer_bit_length; | 187 uint64_t bit_offset = base::RandUint64() % buffer_bit_length; |
| 186 buffer[bit_offset / 8u] ^= (1 << (bit_offset % 8u)); | 188 buffer[bit_offset / 8u] ^= (1 << (bit_offset % 8u)); |
| 187 } | 189 } |
| 188 } | 190 } |
| 189 | 191 |
| 190 } // namespace net | 192 } // namespace net |
| OLD | NEW |