| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <iostream> | 5 #include <iostream> |
| 6 #include <set> | 6 #include <set> |
| 7 #include <string> | 7 #include <string> |
| 8 #include <tuple> | 8 #include <tuple> |
| 9 #include <utility> | 9 #include <utility> |
| 10 #include <vector> | 10 #include <vector> |
| (...skipping 1118 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1129 template <> | 1129 template <> |
| 1130 struct FuzzTraits<HWND> { | 1130 struct FuzzTraits<HWND> { |
| 1131 static bool Fuzz(HWND* p, Fuzzer* fuzzer) { | 1131 static bool Fuzz(HWND* p, Fuzzer* fuzzer) { |
| 1132 // TODO(aarya): This should actually do something. | 1132 // TODO(aarya): This should actually do something. |
| 1133 return true; | 1133 return true; |
| 1134 } | 1134 } |
| 1135 }; | 1135 }; |
| 1136 #endif | 1136 #endif |
| 1137 | 1137 |
| 1138 template <> | 1138 template <> |
| 1139 struct FuzzTraits<IPC::Message> { | 1139 struct FuzzTraits<std::unique_ptr<IPC::Message>> { |
| 1140 static bool Fuzz(IPC::Message* p, Fuzzer* fuzzer) { | 1140 static bool Fuzz(std::unique_ptr<IPC::Message>* p, Fuzzer* fuzzer) { |
| 1141 // TODO(mbarbella): Support mutation. | 1141 // TODO(mbarbella): Support mutation. |
| 1142 if (!fuzzer->ShouldGenerate()) | 1142 if (!fuzzer->ShouldGenerate()) |
| 1143 return true; | 1143 return true; |
| 1144 | 1144 |
| 1145 if (g_function_vector.empty()) | 1145 if (g_function_vector.empty()) |
| 1146 return false; | 1146 return false; |
| 1147 size_t index = RandInRange(g_function_vector.size()); | 1147 size_t index = RandInRange(g_function_vector.size()); |
| 1148 IPC::Message* ipc_message = (*g_function_vector[index])(NULL, fuzzer); | 1148 std::unique_ptr<IPC::Message> ipc_message = |
| 1149 (*g_function_vector[index])(nullptr, fuzzer); |
| 1149 if (!ipc_message) | 1150 if (!ipc_message) |
| 1150 return false; | 1151 return false; |
| 1151 p = ipc_message; | 1152 *p = std::move(ipc_message); |
| 1152 return true; | 1153 return true; |
| 1153 } | 1154 } |
| 1154 }; | 1155 }; |
| 1155 | 1156 |
| 1156 #if !defined(OS_WIN) | 1157 #if !defined(OS_WIN) |
| 1157 // PlatformfileForTransit is just SharedMemoryHandle on Windows, which already | 1158 // PlatformfileForTransit is just SharedMemoryHandle on Windows, which already |
| 1158 // has a trait, see ipc/ipc_platform_file.h | 1159 // has a trait, see ipc/ipc_platform_file.h |
| 1159 template <> | 1160 template <> |
| 1160 struct FuzzTraits<IPC::PlatformFileForTransit> { | 1161 struct FuzzTraits<IPC::PlatformFileForTransit> { |
| 1161 static bool Fuzz(IPC::PlatformFileForTransit* p, Fuzzer* fuzzer) { | 1162 static bool Fuzz(IPC::PlatformFileForTransit* p, Fuzzer* fuzzer) { |
| (...skipping 565 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1727 | 1728 |
| 1728 // MessageFactory abstracts away constructing control/routed messages by | 1729 // MessageFactory abstracts away constructing control/routed messages by |
| 1729 // providing an additional random routing ID argument when necessary. | 1730 // providing an additional random routing ID argument when necessary. |
| 1730 template <typename Message, IPC::MessageKind> | 1731 template <typename Message, IPC::MessageKind> |
| 1731 class MessageFactory; | 1732 class MessageFactory; |
| 1732 | 1733 |
| 1733 template <typename Message> | 1734 template <typename Message> |
| 1734 class MessageFactory<Message, IPC::MessageKind::CONTROL> { | 1735 class MessageFactory<Message, IPC::MessageKind::CONTROL> { |
| 1735 public: | 1736 public: |
| 1736 template <typename... Args> | 1737 template <typename... Args> |
| 1737 static Message* New(const Args&... args) { | 1738 static std::unique_ptr<Message> New(const Args&... args) { |
| 1738 return new Message(args...); | 1739 return base::MakeUnique<Message>(args...); |
| 1739 } | 1740 } |
| 1740 }; | 1741 }; |
| 1741 | 1742 |
| 1742 template <typename Message> | 1743 template <typename Message> |
| 1743 class MessageFactory<Message, IPC::MessageKind::ROUTED> { | 1744 class MessageFactory<Message, IPC::MessageKind::ROUTED> { |
| 1744 public: | 1745 public: |
| 1745 template <typename... Args> | 1746 template <typename... Args> |
| 1746 static Message* New(const Args&... args) { | 1747 static std::unique_ptr<Message> New(const Args&... args) { |
| 1747 return new Message(RandInRange(MAX_FAKE_ROUTING_ID), args...); | 1748 return base::MakeUnique<Message>(RandInRange(MAX_FAKE_ROUTING_ID), args...); |
| 1748 } | 1749 } |
| 1749 }; | 1750 }; |
| 1750 | 1751 |
| 1751 template <typename Message> | 1752 template <typename Message> |
| 1752 class FuzzerHelper; | 1753 class FuzzerHelper; |
| 1753 | 1754 |
| 1754 template <typename Meta, typename... Ins> | 1755 template <typename Meta, typename... Ins> |
| 1755 class FuzzerHelper<IPC::MessageT<Meta, std::tuple<Ins...>, void>> { | 1756 class FuzzerHelper<IPC::MessageT<Meta, std::tuple<Ins...>, void>> { |
| 1756 public: | 1757 public: |
| 1757 using Message = IPC::MessageT<Meta, std::tuple<Ins...>, void>; | 1758 using Message = IPC::MessageT<Meta, std::tuple<Ins...>, void>; |
| 1758 | 1759 |
| 1759 static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { | 1760 static std::unique_ptr<IPC::Message> Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { |
| 1760 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); | 1761 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); |
| 1761 } | 1762 } |
| 1762 | 1763 |
| 1763 private: | 1764 private: |
| 1764 template <size_t... Ns> | 1765 template <size_t... Ns> |
| 1765 static IPC::Message* FuzzImpl(IPC::Message* msg, | 1766 static std::unique_ptr<IPC::Message> FuzzImpl(IPC::Message* msg, |
| 1766 Fuzzer* fuzzer, | 1767 Fuzzer* fuzzer, |
| 1767 base::IndexSequence<Ns...>) { | 1768 base::IndexSequence<Ns...>) { |
| 1768 typename Message::Param p; | 1769 typename Message::Param p; |
| 1769 if (msg) { | 1770 if (msg) { |
| 1770 Message::Read(static_cast<Message*>(msg), &p); | 1771 Message::Read(static_cast<Message*>(msg), &p); |
| 1771 } | 1772 } |
| 1772 if (FuzzParam(&p, fuzzer)) { | 1773 if (FuzzParam(&p, fuzzer)) { |
| 1773 return MessageFactory<Message, Meta::kKind>::New(std::get<Ns>(p)...); | 1774 return MessageFactory<Message, Meta::kKind>::New(std::get<Ns>(p)...); |
| 1774 } | 1775 } |
| 1775 std::cerr << "Don't know how to handle " << Meta::kName << "\n"; | 1776 std::cerr << "Don't know how to handle " << Meta::kName << "\n"; |
| 1776 return nullptr; | 1777 return nullptr; |
| 1777 } | 1778 } |
| 1778 }; | 1779 }; |
| 1779 | 1780 |
| 1780 template <typename Meta, typename... Ins, typename... Outs> | 1781 template <typename Meta, typename... Ins, typename... Outs> |
| 1781 class FuzzerHelper< | 1782 class FuzzerHelper< |
| 1782 IPC::MessageT<Meta, std::tuple<Ins...>, std::tuple<Outs...>>> { | 1783 IPC::MessageT<Meta, std::tuple<Ins...>, std::tuple<Outs...>>> { |
| 1783 public: | 1784 public: |
| 1784 using Message = IPC::MessageT<Meta, std::tuple<Ins...>, std::tuple<Outs...>>; | 1785 using Message = IPC::MessageT<Meta, std::tuple<Ins...>, std::tuple<Outs...>>; |
| 1785 | 1786 |
| 1786 static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { | 1787 static std::unique_ptr<IPC::Message> Fuzz(IPC::Message* msg, Fuzzer* fuzzer) { |
| 1787 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); | 1788 return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>()); |
| 1788 } | 1789 } |
| 1789 | 1790 |
| 1790 private: | 1791 private: |
| 1791 template <size_t... Ns> | 1792 template <size_t... Ns> |
| 1792 static IPC::Message* FuzzImpl(IPC::Message* msg, | 1793 static std::unique_ptr<IPC::Message> FuzzImpl(IPC::Message* msg, |
| 1793 Fuzzer* fuzzer, | 1794 Fuzzer* fuzzer, |
| 1794 base::IndexSequence<Ns...>) { | 1795 base::IndexSequence<Ns...>) { |
| 1795 typename Message::SendParam p; | 1796 typename Message::SendParam p; |
| 1796 Message* real_msg = static_cast<Message*>(msg); | 1797 Message* real_msg = static_cast<Message*>(msg); |
| 1797 Message* new_msg = nullptr; | 1798 std::unique_ptr<Message> new_msg; |
| 1798 if (real_msg) { | 1799 if (real_msg) { |
| 1799 Message::ReadSendParam(real_msg, &p); | 1800 Message::ReadSendParam(real_msg, &p); |
| 1800 } | 1801 } |
| 1801 if (FuzzParam(&p, fuzzer)) { | 1802 if (FuzzParam(&p, fuzzer)) { |
| 1802 new_msg = MessageFactory<Message, Meta::kKind>::New( | 1803 new_msg = MessageFactory<Message, Meta::kKind>::New( |
| 1803 std::get<Ns>(p)..., static_cast<Outs*>(nullptr)...); | 1804 std::get<Ns>(p)..., static_cast<Outs*>(nullptr)...); |
| 1804 } | 1805 } |
| 1805 if (real_msg && new_msg) { | 1806 if (real_msg && new_msg) { |
| 1806 MessageCracker::CopyMessageID(new_msg, real_msg); | 1807 MessageCracker::CopyMessageID(new_msg.get(), real_msg); |
| 1807 } else if (!new_msg) { | 1808 } else if (!new_msg) { |
| 1808 std::cerr << "Don't know how to handle " << Meta::kName << "\n"; | 1809 std::cerr << "Don't know how to handle " << Meta::kName << "\n"; |
| 1809 } | 1810 } |
| 1810 return new_msg; | 1811 return new_msg; |
| 1811 } | 1812 } |
| 1812 }; | 1813 }; |
| 1813 | 1814 |
| 1814 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 1815 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
| 1815 | 1816 |
| 1816 void PopulateFuzzerFunctionVector( | 1817 void PopulateFuzzerFunctionVector( |
| 1817 FuzzerFunctionVector* function_vector) { | 1818 FuzzerFunctionVector* function_vector) { |
| 1818 #undef IPC_MESSAGE_DECL | 1819 #undef IPC_MESSAGE_DECL |
| 1819 #define IPC_MESSAGE_DECL(name, ...) \ | 1820 #define IPC_MESSAGE_DECL(name, ...) \ |
| 1820 function_vector->push_back(FuzzerHelper<name>::Fuzz); | 1821 function_vector->push_back(FuzzerHelper<name>::Fuzz); |
| 1821 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 1822 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
| 1822 } | 1823 } |
| 1823 | 1824 |
| 1824 // Redefine macros to register fuzzing functions into map. | 1825 // Redefine macros to register fuzzing functions into map. |
| 1825 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" | 1826 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h" |
| 1826 #undef IPC_MESSAGE_DECL | 1827 #undef IPC_MESSAGE_DECL |
| 1827 #define IPC_MESSAGE_DECL(name, ...) \ | 1828 #define IPC_MESSAGE_DECL(name, ...) \ |
| 1828 (*map)[static_cast<uint32_t>(name::ID)] = FuzzerHelper<name>::Fuzz; | 1829 (*map)[static_cast<uint32_t>(name::ID)] = FuzzerHelper<name>::Fuzz; |
| 1829 | 1830 |
| 1830 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { | 1831 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) { |
| 1831 #include "tools/ipc_fuzzer/message_lib/all_messages.h" | 1832 #include "tools/ipc_fuzzer/message_lib/all_messages.h" |
| 1832 } | 1833 } |
| 1833 | 1834 |
| 1834 } // namespace ipc_fuzzer | 1835 } // namespace ipc_fuzzer |
| OLD | NEW |