Hpack fuzzing tweaks to address CHECK failures on ClusterFuzz

net/spdy/fuzzing/hpack_fuzz_util.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/fuzzing/hpack_fuzz_util.h"
 
 #include <algorithm>
 #include <cmath>
 
 #include "base/rand_util.h"
@@ skipping 95 matching lines @@
 }
 
 // static
 size_t HpackFuzzUtil::SampleExponential(size_t mean, size_t sanity_bound) {
   return std::min<size_t>(-std::log(base::RandDouble()) * mean, sanity_bound);
 }
 
 // static
 bool HpackFuzzUtil::NextHeaderBlock(Input* input,
                                     StringPiece* out) {
+  // ClusterFuzz may truncate input files if the fuzzer ran out of allocated
+  // disk space. Be tolerant of these.
   CHECK_LE(input->offset, input->input.size());
-  if (input->remaining() == 0) {
+  if (input->remaining() < sizeof(uint32)) {
     return false;
   }
-  CHECK_LE(sizeof(uint32), input->remaining());
 
   size_t length = ntohl(*reinterpret_cast<const uint32*>(input->ptr()));
   input->offset += sizeof(uint32);
 
-  CHECK_LE(length, input->remaining());
+  if (input->remaining() < length) {
+    return false;
+  }
   *out = StringPiece(input->ptr(), length);
   input->offset += length;
   return true;
 }
 
 // static
 string HpackFuzzUtil::HeaderBlockPrefix(size_t block_size) {
   uint32 length = htonl(block_size);
   return string(reinterpret_cast<char*>(&length), sizeof(uint32));
 }
@@ skipping 14 matching lines @@
     return false;
   }
   if (!context->first_stage->HandleControlFrameHeadersComplete(1)) {
     return false;
   }
   // Second stage: Re-encode the decoded header block. This must succeed.
   string second_stage_out;
   CHECK(context->second_stage->EncodeHeaderSet(
       context->first_stage->decoded_block(), &second_stage_out));
 
-  // Third stage: Expect a decoding of the re-encoded block to succeed.
-  CHECK(context->third_stage->HandleControlFrameHeadersData(
-      1, second_stage_out.data(), second_stage_out.length()));
-  CHECK(context->third_stage->HandleControlFrameHeadersComplete(1));
+  // Third stage: Expect a decoding of the re-encoded block to succeed, but
+  // don't require it. It's possible for the stage-two encoder to produce an
+  // output which violates decoder size tolerances.
+  if (!context->third_stage->HandleControlFrameHeadersData(
+          1, second_stage_out.data(), second_stage_out.length())) {
+    return false;
+  }
+  if (!context->third_stage->HandleControlFrameHeadersComplete(1)) {

[Ryan Hamilton, 2014/05/12 21:05:49]

Up to you, but you could write this as:

return context->third_stage->HandleControlFrameHeadersData(
          1, second_stage_out.data(), second_stage_out.length()) &&
       context->third_stage->HandleControlFrameHeadersComplete(1);

Perhaps this is not actually any better :>

+    return false;
+  }
   return true;
 }
 
 // static
 void HpackFuzzUtil::FlipBits(uint8* buffer, size_t buffer_length,
                              size_t flip_per_thousand) {
   uint64 buffer_bit_length = buffer_length * 8u;
   uint64 bits_to_flip = flip_per_thousand * (1 + buffer_bit_length / 1024);
 
   // Iteratively identify & flip offsets in the buffer bit-sequence.
   for (uint64 i = 0; i != bits_to_flip; ++i) {
     uint64 bit_offset = base::RandUint64() % buffer_bit_length;
     buffer[bit_offset / 8u] ^= (1 << (bit_offset % 8u));
   }
 }
 
 }  // namespace net