Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ | 5 #ifndef TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ |
| 6 #define TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ | 6 #define TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ |
| 7 | 7 |
| 8 #include <stddef.h> | 8 #include <stddef.h> |
| 9 #include <stdint.h> | 9 #include <stdint.h> |
| 10 | 10 |
| 11 #include <memory> | |
| 11 #include <string> | 12 #include <string> |
| 12 #include <vector> | 13 #include <vector> |
| 13 | 14 |
| 14 #include "base/strings/string_util.h" | 15 #include "base/strings/string_util.h" |
| 15 #include "ipc/ipc_message.h" | 16 #include "ipc/ipc_message.h" |
| 16 | 17 |
| 17 namespace ipc_fuzzer { | 18 namespace ipc_fuzzer { |
| 18 | 19 |
| 19 // Interface implemented by those who generate basic types. The types all | 20 // Interface implemented by those who generate basic types. The types all |
| 20 // correspond to the types which a pickle from base/pickle.h can pickle, | 21 // correspond to the types which a pickle from base/pickle.h can pickle, |
| (...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 60 void FuzzInt64(int64_t* value) override {} | 61 void FuzzInt64(int64_t* value) override {} |
| 61 void FuzzUInt64(uint64_t* value) override {} | 62 void FuzzUInt64(uint64_t* value) override {} |
| 62 void FuzzFloat(float* value) override {} | 63 void FuzzFloat(float* value) override {} |
| 63 void FuzzDouble(double* value) override {} | 64 void FuzzDouble(double* value) override {} |
| 64 void FuzzString(std::string* value) override {} | 65 void FuzzString(std::string* value) override {} |
| 65 void FuzzString16(base::string16* value) override {} | 66 void FuzzString16(base::string16* value) override {} |
| 66 void FuzzData(char* data, int length) override {} | 67 void FuzzData(char* data, int length) override {} |
| 67 void FuzzBytes(void* data, int data_len) override {} | 68 void FuzzBytes(void* data, int data_len) override {} |
| 68 }; | 69 }; |
| 69 | 70 |
| 70 typedef IPC::Message* (*FuzzerFunction)(IPC::Message*, Fuzzer*); | 71 typedef std::unique_ptr<IPC::Message> (*FuzzerFunction)(IPC::Message*, Fuzzer*); |
|
Tom Sepez
2017/07/10 17:45:47
nit: might as well move to |using| while were at i
Avi (use Gerrit)
2017/07/10 18:44:00
Done.
| |
| 71 | 72 |
| 72 // Used for mutating messages. Once populated, the map associates a message ID | 73 // Used for mutating messages. Once populated, the map associates a message ID |
| 73 // with a FuzzerFunction used for mutation of that message type. | 74 // with a FuzzerFunction used for mutation of that message type. |
| 74 typedef base::hash_map<uint32_t, FuzzerFunction> FuzzerFunctionMap; | 75 typedef base::hash_map<uint32_t, FuzzerFunction> FuzzerFunctionMap; |
| 75 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map); | 76 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map); |
| 76 | 77 |
| 77 // Used for generating new messages. Once populated, the vector contains | 78 // Used for generating new messages. Once populated, the vector contains |
| 78 // FuzzerFunctions for all message types that we know how to generate. | 79 // FuzzerFunctions for all message types that we know how to generate. |
| 79 typedef std::vector<FuzzerFunction> FuzzerFunctionVector; | 80 typedef std::vector<FuzzerFunction> FuzzerFunctionVector; |
| 80 void PopulateFuzzerFunctionVector(FuzzerFunctionVector* function_vector); | 81 void PopulateFuzzerFunctionVector(FuzzerFunctionVector* function_vector); |
| 81 | 82 |
| 82 // Since IPC::Message can be serialized, we also track a global function vector | 83 // Since IPC::Message can be serialized, we also track a global function vector |
| 83 // to handle generation of new messages while fuzzing. | 84 // to handle generation of new messages while fuzzing. |
| 84 extern FuzzerFunctionVector g_function_vector; | 85 extern FuzzerFunctionVector g_function_vector; |
| 85 | 86 |
| 86 } // namespace ipc_fuzzer | 87 } // namespace ipc_fuzzer |
| 87 | 88 |
| 88 #endif // TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ | 89 #endif // TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ |
| OLD | NEW |