OLD | NEW |
---|---|
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ | 5 #ifndef TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ |
6 #define TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ | 6 #define TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ |
7 | 7 |
8 #include <stddef.h> | 8 #include <stddef.h> |
9 #include <stdint.h> | 9 #include <stdint.h> |
10 | 10 |
11 #include <memory> | |
11 #include <string> | 12 #include <string> |
12 #include <vector> | 13 #include <vector> |
13 | 14 |
14 #include "base/strings/string_util.h" | 15 #include "base/strings/string_util.h" |
15 #include "ipc/ipc_message.h" | 16 #include "ipc/ipc_message.h" |
16 | 17 |
17 namespace ipc_fuzzer { | 18 namespace ipc_fuzzer { |
18 | 19 |
19 // Interface implemented by those who generate basic types. The types all | 20 // Interface implemented by those who generate basic types. The types all |
20 // correspond to the types which a pickle from base/pickle.h can pickle, | 21 // correspond to the types which a pickle from base/pickle.h can pickle, |
(...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
60 void FuzzInt64(int64_t* value) override {} | 61 void FuzzInt64(int64_t* value) override {} |
61 void FuzzUInt64(uint64_t* value) override {} | 62 void FuzzUInt64(uint64_t* value) override {} |
62 void FuzzFloat(float* value) override {} | 63 void FuzzFloat(float* value) override {} |
63 void FuzzDouble(double* value) override {} | 64 void FuzzDouble(double* value) override {} |
64 void FuzzString(std::string* value) override {} | 65 void FuzzString(std::string* value) override {} |
65 void FuzzString16(base::string16* value) override {} | 66 void FuzzString16(base::string16* value) override {} |
66 void FuzzData(char* data, int length) override {} | 67 void FuzzData(char* data, int length) override {} |
67 void FuzzBytes(void* data, int data_len) override {} | 68 void FuzzBytes(void* data, int data_len) override {} |
68 }; | 69 }; |
69 | 70 |
70 typedef IPC::Message* (*FuzzerFunction)(IPC::Message*, Fuzzer*); | 71 typedef std::unique_ptr<IPC::Message> (*FuzzerFunction)(IPC::Message*, Fuzzer*); |
Tom Sepez
2017/07/10 17:45:47
nit: might as well move to |using| while were at i
Avi (use Gerrit)
2017/07/10 18:44:00
Done.
| |
71 | 72 |
72 // Used for mutating messages. Once populated, the map associates a message ID | 73 // Used for mutating messages. Once populated, the map associates a message ID |
73 // with a FuzzerFunction used for mutation of that message type. | 74 // with a FuzzerFunction used for mutation of that message type. |
74 typedef base::hash_map<uint32_t, FuzzerFunction> FuzzerFunctionMap; | 75 typedef base::hash_map<uint32_t, FuzzerFunction> FuzzerFunctionMap; |
75 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map); | 76 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map); |
76 | 77 |
77 // Used for generating new messages. Once populated, the vector contains | 78 // Used for generating new messages. Once populated, the vector contains |
78 // FuzzerFunctions for all message types that we know how to generate. | 79 // FuzzerFunctions for all message types that we know how to generate. |
79 typedef std::vector<FuzzerFunction> FuzzerFunctionVector; | 80 typedef std::vector<FuzzerFunction> FuzzerFunctionVector; |
80 void PopulateFuzzerFunctionVector(FuzzerFunctionVector* function_vector); | 81 void PopulateFuzzerFunctionVector(FuzzerFunctionVector* function_vector); |
81 | 82 |
82 // Since IPC::Message can be serialized, we also track a global function vector | 83 // Since IPC::Message can be serialized, we also track a global function vector |
83 // to handle generation of new messages while fuzzing. | 84 // to handle generation of new messages while fuzzing. |
84 extern FuzzerFunctionVector g_function_vector; | 85 extern FuzzerFunctionVector g_function_vector; |
85 | 86 |
86 } // namespace ipc_fuzzer | 87 } // namespace ipc_fuzzer |
87 | 88 |
88 #endif // TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ | 89 #endif // TOOLS_IPC_FUZZER_MUTATE_FUZZER_H_ |
OLD | NEW |