| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stddef.h> | 5 #include <stddef.h> |
| 6 #include <stdint.h> | 6 #include <stdint.h> |
| 7 | 7 |
| 8 #include <iostream> | 8 #include <iostream> |
| 9 #include <set> | 9 #include <set> |
| 10 #include <utility> |
| 10 #include <vector> | 11 #include <vector> |
| 11 | 12 |
| 12 #include "base/command_line.h" | 13 #include "base/command_line.h" |
| 13 #include "base/strings/string_split.h" | 14 #include "base/strings/string_split.h" |
| 14 #include "ipc/ipc_message_macros.h" | 15 #include "ipc/ipc_message_macros.h" |
| 15 #include "tools/ipc_fuzzer/fuzzer/fuzzer.h" | 16 #include "tools/ipc_fuzzer/fuzzer/fuzzer.h" |
| 16 #include "tools/ipc_fuzzer/fuzzer/generator.h" | 17 #include "tools/ipc_fuzzer/fuzzer/generator.h" |
| 17 #include "tools/ipc_fuzzer/fuzzer/mutator.h" | 18 #include "tools/ipc_fuzzer/fuzzer/mutator.h" |
| 18 #include "tools/ipc_fuzzer/fuzzer/rand_util.h" | 19 #include "tools/ipc_fuzzer/fuzzer/rand_util.h" |
| 19 #include "tools/ipc_fuzzer/message_lib/message_file.h" | 20 #include "tools/ipc_fuzzer/message_lib/message_file.h" |
| (...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 86 return new Mutator(frequency); | 87 return new Mutator(frequency); |
| 87 | 88 |
| 88 if (name == "no-op") | 89 if (name == "no-op") |
| 89 return new NoOpFuzzer(); | 90 return new NoOpFuzzer(); |
| 90 | 91 |
| 91 std::cerr << "No such fuzzer: " << name << "\n"; | 92 std::cerr << "No such fuzzer: " << name << "\n"; |
| 92 return 0; | 93 return 0; |
| 93 } | 94 } |
| 94 }; | 95 }; |
| 95 | 96 |
| 96 static IPC::Message* RewriteMessage( | 97 static std::unique_ptr<IPC::Message> RewriteMessage(IPC::Message* message, |
| 97 IPC::Message* message, | 98 Fuzzer* fuzzer, |
| 98 Fuzzer* fuzzer, | 99 FuzzerFunctionMap* map) { |
| 99 FuzzerFunctionMap* map) { | |
| 100 FuzzerFunctionMap::iterator it = map->find(message->type()); | 100 FuzzerFunctionMap::iterator it = map->find(message->type()); |
| 101 if (it == map->end()) { | 101 if (it == map->end()) { |
| 102 // This usually indicates a missing message file in all_messages.h, or | 102 // This usually indicates a missing message file in all_messages.h, or |
| 103 // that the message dump file is taken from a different revision of | 103 // that the message dump file is taken from a different revision of |
| 104 // chromium from this executable. | 104 // chromium from this executable. |
| 105 std::cerr << "Unknown message type: [" | 105 std::cerr << "Unknown message type: [" |
| 106 << IPC_MESSAGE_ID_CLASS(message->type()) << ", " | 106 << IPC_MESSAGE_ID_CLASS(message->type()) << ", " |
| 107 << IPC_MESSAGE_ID_LINE(message->type()) << "].\n"; | 107 << IPC_MESSAGE_ID_LINE(message->type()) << "].\n"; |
| 108 return 0; | 108 return 0; |
| 109 } | 109 } |
| (...skipping 11 matching lines...) Expand all Loading... |
| 121 | 121 |
| 122 int message_count = 1000; | 122 int message_count = 1000; |
| 123 if (cmd->HasSwitch(kCountSwitch)) | 123 if (cmd->HasSwitch(kCountSwitch)) |
| 124 message_count = atoi(cmd->GetSwitchValueASCII(kCountSwitch).c_str()); | 124 message_count = atoi(cmd->GetSwitchValueASCII(kCountSwitch).c_str()); |
| 125 | 125 |
| 126 MessageVector message_vector; | 126 MessageVector message_vector; |
| 127 int bad_count = 0; | 127 int bad_count = 0; |
| 128 if (message_count < 0) { | 128 if (message_count < 0) { |
| 129 // Enumerate them all. | 129 // Enumerate them all. |
| 130 for (size_t i = 0; i < g_function_vector.size(); ++i) { | 130 for (size_t i = 0; i < g_function_vector.size(); ++i) { |
| 131 if (IPC::Message* new_message = (*g_function_vector[i])(NULL, fuzzer)) | 131 std::unique_ptr<IPC::Message> new_message = |
| 132 message_vector.push_back(new_message); | 132 (*g_function_vector[i])(nullptr, fuzzer); |
| 133 if (new_message) |
| 134 message_vector.push_back(std::move(new_message)); |
| 133 else | 135 else |
| 134 bad_count += 1; | 136 bad_count += 1; |
| 135 } | 137 } |
| 136 } else { | 138 } else { |
| 137 // Fuzz a random batch. | 139 // Fuzz a random batch. |
| 138 for (int i = 0; i < message_count; ++i) { | 140 for (int i = 0; i < message_count; ++i) { |
| 139 size_t index = RandInRange(g_function_vector.size()); | 141 size_t index = RandInRange(g_function_vector.size()); |
| 140 if (IPC::Message* new_message = (*g_function_vector[index])(NULL, fuzzer)) | 142 std::unique_ptr<IPC::Message> new_message = |
| 141 message_vector.push_back(new_message); | 143 (*g_function_vector[index])(nullptr, fuzzer); |
| 144 if (new_message) |
| 145 message_vector.push_back(std::move(new_message)); |
| 142 else | 146 else |
| 143 bad_count += 1; | 147 bad_count += 1; |
| 144 } | 148 } |
| 145 } | 149 } |
| 146 | 150 |
| 147 std::cerr << "Failed to generate " << bad_count << " messages.\n"; | 151 std::cerr << "Failed to generate " << bad_count << " messages.\n"; |
| 148 if (!MessageFile::Write(base::FilePath(output_file_name), message_vector)) | 152 if (!MessageFile::Write(base::FilePath(output_file_name), message_vector)) |
| 149 return EXIT_FAILURE; | 153 return EXIT_FAILURE; |
| 150 return EXIT_SUCCESS; | 154 return EXIT_SUCCESS; |
| 151 } | 155 } |
| (...skipping 18 matching lines...) Expand all Loading... |
| 170 } | 174 } |
| 171 | 175 |
| 172 FuzzerFunctionMap fuzz_function_map; | 176 FuzzerFunctionMap fuzz_function_map; |
| 173 PopulateFuzzerFunctionMap(&fuzz_function_map); | 177 PopulateFuzzerFunctionMap(&fuzz_function_map); |
| 174 | 178 |
| 175 MessageVector message_vector; | 179 MessageVector message_vector; |
| 176 if (!MessageFile::Read(base::FilePath(input_file_name), &message_vector)) | 180 if (!MessageFile::Read(base::FilePath(input_file_name), &message_vector)) |
| 177 return EXIT_FAILURE; | 181 return EXIT_FAILURE; |
| 178 | 182 |
| 179 for (size_t i = 0; i < message_vector.size(); ++i) { | 183 for (size_t i = 0; i < message_vector.size(); ++i) { |
| 180 IPC::Message* msg = message_vector[i]; | 184 IPC::Message* msg = message_vector[i].get(); |
| 181 // If an explicit type set is specified, make sure we should be mutating | 185 // If an explicit type set is specified, make sure we should be mutating |
| 182 // this message type on this run. | 186 // this message type on this run. |
| 183 if (!type_set.empty() && type_set.end() == std::find( | 187 if (!type_set.empty() && type_set.end() == std::find( |
| 184 type_set.begin(), type_set.end(), msg->type())) { | 188 type_set.begin(), type_set.end(), msg->type())) { |
| 185 continue; | 189 continue; |
| 186 } | 190 } |
| 187 IPC::Message* new_message = RewriteMessage(msg, fuzzer, &fuzz_function_map); | 191 std::unique_ptr<IPC::Message> new_message = |
| 188 if (new_message) { | 192 RewriteMessage(msg, fuzzer, &fuzz_function_map); |
| 189 IPC::Message* old_message = message_vector[i]; | 193 if (new_message) |
| 190 delete old_message; | 194 message_vector[i] = std::move(new_message); |
| 191 message_vector[i] = new_message; | |
| 192 } | |
| 193 } | 195 } |
| 194 | 196 |
| 195 if (permute) { | 197 if (permute) { |
| 196 std::random_shuffle(message_vector.begin(), message_vector.end(), | 198 std::random_shuffle(message_vector.begin(), message_vector.end(), |
| 197 RandInRange); | 199 RandInRange); |
| 198 } | 200 } |
| 199 | 201 |
| 200 if (!MessageFile::Write(base::FilePath(output_file_name), message_vector)) | 202 if (!MessageFile::Write(base::FilePath(output_file_name), message_vector)) |
| 201 return EXIT_FAILURE; | 203 return EXIT_FAILURE; |
| 202 return EXIT_SUCCESS; | 204 return EXIT_SUCCESS; |
| (...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 239 } | 241 } |
| 240 | 242 |
| 241 return result; | 243 return result; |
| 242 } | 244 } |
| 243 | 245 |
| 244 } // namespace ipc_fuzzer | 246 } // namespace ipc_fuzzer |
| 245 | 247 |
| 246 int main(int argc, char** argv) { | 248 int main(int argc, char** argv) { |
| 247 return ipc_fuzzer::FuzzerMain(argc, argv); | 249 return ipc_fuzzer::FuzzerMain(argc, argv); |
| 248 } | 250 } |
| OLD | NEW |