Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(82)

Side by Side Diff: ipc/ipc_fuzzing_tests.cc

Issue 35643005: Remove unused IPC::Message priority. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Rebase Created 7 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « ipc/ipc_channel_win.cc ('k') | ipc/ipc_logging.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <stdio.h> 5 #include <stdio.h>
6 #include <string> 6 #include <string>
7 #include <sstream> 7 #include <sstream>
8 8
9 #include "base/message_loop/message_loop.h" 9 #include "base/message_loop/message_loop.h"
10 #include "base/threading/platform_thread.h" 10 #include "base/threading/platform_thread.h"
(...skipping 20 matching lines...) Expand all
31 IPC_MESSAGE_CONTROL0(MsgUnhandled) 31 IPC_MESSAGE_CONTROL0(MsgUnhandled)
32 32
33 // ----------------------------------------------------------------------------- 33 // -----------------------------------------------------------------------------
34 34
35 namespace { 35 namespace {
36 36
37 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { 37 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) {
38 //This was BUG 984408. 38 //This was BUG 984408.
39 uint32 v1 = kuint32max - 1; 39 uint32 v1 = kuint32max - 1;
40 int v2 = 666; 40 int v2 = 666;
41 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); 41 IPC::Message m(0, 1);
42 EXPECT_TRUE(m.WriteInt(v1)); 42 EXPECT_TRUE(m.WriteInt(v1));
43 EXPECT_TRUE(m.WriteInt(v2)); 43 EXPECT_TRUE(m.WriteInt(v2));
44 44
45 PickleIterator iter(m); 45 PickleIterator iter(m);
46 std::string vs; 46 std::string vs;
47 EXPECT_FALSE(m.ReadString(&iter, &vs)); 47 EXPECT_FALSE(m.ReadString(&iter, &vs));
48 } 48 }
49 49
50 TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) { 50 TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) {
51 //This was BUG 984408. 51 //This was BUG 984408.
52 uint32 v1 = kuint32max - 1; 52 uint32 v1 = kuint32max - 1;
53 int v2 = 777; 53 int v2 = 777;
54 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); 54 IPC::Message m(0, 1);
55 EXPECT_TRUE(m.WriteInt(v1)); 55 EXPECT_TRUE(m.WriteInt(v1));
56 EXPECT_TRUE(m.WriteInt(v2)); 56 EXPECT_TRUE(m.WriteInt(v2));
57 57
58 PickleIterator iter(m); 58 PickleIterator iter(m);
59 std::wstring vs; 59 std::wstring vs;
60 EXPECT_FALSE(m.ReadWString(&iter, &vs)); 60 EXPECT_FALSE(m.ReadWString(&iter, &vs));
61 } 61 }
62 62
63 TEST(IPCMessageIntegrity, ReadBytesBadIterator) { 63 TEST(IPCMessageIntegrity, ReadBytesBadIterator) {
64 // This was BUG 1035467. 64 // This was BUG 1035467.
65 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); 65 IPC::Message m(0, 1);
66 EXPECT_TRUE(m.WriteInt(1)); 66 EXPECT_TRUE(m.WriteInt(1));
67 EXPECT_TRUE(m.WriteInt(2)); 67 EXPECT_TRUE(m.WriteInt(2));
68 68
69 PickleIterator iter(m); 69 PickleIterator iter(m);
70 const char* data = NULL; 70 const char* data = NULL;
71 EXPECT_TRUE(m.ReadBytes(&iter, &data, sizeof(int))); 71 EXPECT_TRUE(m.ReadBytes(&iter, &data, sizeof(int)));
72 } 72 }
73 73
74 TEST(IPCMessageIntegrity, ReadVectorNegativeSize) { 74 TEST(IPCMessageIntegrity, ReadVectorNegativeSize) {
75 // A slight variation of BUG 984408. Note that the pickling of vector<char> 75 // A slight variation of BUG 984408. Note that the pickling of vector<char>
76 // has a specialized template which is not vulnerable to this bug. So here 76 // has a specialized template which is not vulnerable to this bug. So here
77 // try to hit the non-specialized case vector<P>. 77 // try to hit the non-specialized case vector<P>.
78 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); 78 IPC::Message m(0, 1);
79 EXPECT_TRUE(m.WriteInt(-1)); // This is the count of elements. 79 EXPECT_TRUE(m.WriteInt(-1)); // This is the count of elements.
80 EXPECT_TRUE(m.WriteInt(1)); 80 EXPECT_TRUE(m.WriteInt(1));
81 EXPECT_TRUE(m.WriteInt(2)); 81 EXPECT_TRUE(m.WriteInt(2));
82 EXPECT_TRUE(m.WriteInt(3)); 82 EXPECT_TRUE(m.WriteInt(3));
83 83
84 std::vector<double> vec; 84 std::vector<double> vec;
85 PickleIterator iter(m); 85 PickleIterator iter(m);
86 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); 86 EXPECT_FALSE(ReadParam(&m, &iter, &vec));
87 } 87 }
88 88
89 TEST(IPCMessageIntegrity, ReadVectorTooLarge1) { 89 TEST(IPCMessageIntegrity, ReadVectorTooLarge1) {
90 // This was BUG 1006367. This is the large but positive length case. Again 90 // This was BUG 1006367. This is the large but positive length case. Again
91 // we try to hit the non-specialized case vector<P>. 91 // we try to hit the non-specialized case vector<P>.
92 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); 92 IPC::Message m(0, 1);
93 EXPECT_TRUE(m.WriteInt(0x21000003)); // This is the count of elements. 93 EXPECT_TRUE(m.WriteInt(0x21000003)); // This is the count of elements.
94 EXPECT_TRUE(m.WriteInt64(1)); 94 EXPECT_TRUE(m.WriteInt64(1));
95 EXPECT_TRUE(m.WriteInt64(2)); 95 EXPECT_TRUE(m.WriteInt64(2));
96 96
97 std::vector<int64> vec; 97 std::vector<int64> vec;
98 PickleIterator iter(m); 98 PickleIterator iter(m);
99 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); 99 EXPECT_FALSE(ReadParam(&m, &iter, &vec));
100 } 100 }
101 101
102 TEST(IPCMessageIntegrity, ReadVectorTooLarge2) { 102 TEST(IPCMessageIntegrity, ReadVectorTooLarge2) {
103 // This was BUG 1006367. This is the large but positive with an additional 103 // This was BUG 1006367. This is the large but positive with an additional
104 // integer overflow when computing the actual byte size. Again we try to hit 104 // integer overflow when computing the actual byte size. Again we try to hit
105 // the non-specialized case vector<P>. 105 // the non-specialized case vector<P>.
106 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); 106 IPC::Message m(0, 1);
107 EXPECT_TRUE(m.WriteInt(0x71000000)); // This is the count of elements. 107 EXPECT_TRUE(m.WriteInt(0x71000000)); // This is the count of elements.
108 EXPECT_TRUE(m.WriteInt64(1)); 108 EXPECT_TRUE(m.WriteInt64(1));
109 EXPECT_TRUE(m.WriteInt64(2)); 109 EXPECT_TRUE(m.WriteInt64(2));
110 110
111 std::vector<int64> vec; 111 std::vector<int64> vec;
112 PickleIterator iter(m); 112 PickleIterator iter(m);
113 EXPECT_FALSE(ReadParam(&m, &iter, &vec)); 113 EXPECT_FALSE(ReadParam(&m, &iter, &vec));
114 } 114 }
115 115
116 class SimpleListener : public IPC::Listener { 116 class SimpleListener : public IPC::Listener {
(...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after
157 Cleanup(); 157 Cleanup();
158 } 158 }
159 159
160 void OnMsgClassSIMessage(const std::wstring& text, int value) { 160 void OnMsgClassSIMessage(const std::wstring& text, int value) {
161 UseData(MsgClassSI::ID, value, text); 161 UseData(MsgClassSI::ID, value, text);
162 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value); 162 RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value);
163 Cleanup(); 163 Cleanup();
164 } 164 }
165 165
166 bool RoundtripAckReply(int routing, uint32 type_id, int reply) { 166 bool RoundtripAckReply(int routing, uint32 type_id, int reply) {
167 IPC::Message* message = new IPC::Message(routing, type_id, 167 IPC::Message* message = new IPC::Message(routing, type_id);
168 IPC::Message::PRIORITY_NORMAL);
169 message->WriteInt(reply + 1); 168 message->WriteInt(reply + 1);
170 message->WriteInt(reply); 169 message->WriteInt(reply);
171 return other_->Send(message); 170 return other_->Send(message);
172 } 171 }
173 172
174 void Cleanup() { 173 void Cleanup() {
175 --message_count_; 174 --message_count_;
176 --pending_messages_; 175 --pending_messages_;
177 if (0 == message_count_) 176 if (0 == message_count_)
178 base::MessageLoop::current()->Quit(); 177 base::MessageLoop::current()->Quit();
(...skipping 112 matching lines...) Expand 10 before | Expand all | Expand 10 after
291 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) 290 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON)
292 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { 291 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) {
293 Init("FuzzServerClient"); 292 Init("FuzzServerClient");
294 293
295 FuzzerClientListener listener; 294 FuzzerClientListener listener;
296 CreateChannel(&listener); 295 CreateChannel(&listener);
297 listener.Init(channel()); 296 listener.Init(channel());
298 ASSERT_TRUE(ConnectChannel()); 297 ASSERT_TRUE(ConnectChannel());
299 ASSERT_TRUE(StartClient()); 298 ASSERT_TRUE(StartClient());
300 299
301 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, 300 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID);
302 IPC::Message::PRIORITY_NORMAL);
303 msg->WriteInt(666); 301 msg->WriteInt(666);
304 sender()->Send(msg); 302 sender()->Send(msg);
305 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); 303 EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID));
306 304
307 msg = new MsgClassSI(L"expect one", 1); 305 msg = new MsgClassSI(L"expect one", 1);
308 sender()->Send(msg); 306 sender()->Send(msg);
309 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); 307 EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID));
310 308
311 EXPECT_TRUE(WaitForClientShutdown()); 309 EXPECT_TRUE(WaitForClientShutdown());
312 DestroyChannel(); 310 DestroyChannel();
313 } 311 }
314 #endif 312 #endif
315 313
316 // This test uses a payload that has too many arguments, but so the payload size 314 // This test uses a payload that has too many arguments, but so the payload size
317 // is big enough so the unpacking routine does not generate an error as in the 315 // is big enough so the unpacking routine does not generate an error as in the
318 // case of MsgBadPayloadShort test. This test does not pinpoint a flaw (per se) 316 // case of MsgBadPayloadShort test. This test does not pinpoint a flaw (per se)
319 // as by design we don't carry type information on the IPC message. 317 // as by design we don't carry type information on the IPC message.
320 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { 318 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) {
321 Init("FuzzServerClient"); 319 Init("FuzzServerClient");
322 320
323 FuzzerClientListener listener; 321 FuzzerClientListener listener;
324 CreateChannel(&listener); 322 CreateChannel(&listener);
325 listener.Init(channel()); 323 listener.Init(channel());
326 ASSERT_TRUE(ConnectChannel()); 324 ASSERT_TRUE(ConnectChannel());
327 ASSERT_TRUE(StartClient()); 325 ASSERT_TRUE(StartClient());
328 326
329 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, 327 IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID);
330 IPC::Message::PRIORITY_NORMAL);
331 msg->WriteWString(L"d"); 328 msg->WriteWString(L"d");
332 msg->WriteInt(0); 329 msg->WriteInt(0);
333 msg->WriteInt(0x65); // Extra argument. 330 msg->WriteInt(0x65); // Extra argument.
334 331
335 sender()->Send(msg); 332 sender()->Send(msg);
336 EXPECT_TRUE(listener.ExpectMessage(0, MsgClassSI::ID)); 333 EXPECT_TRUE(listener.ExpectMessage(0, MsgClassSI::ID));
337 334
338 // Now send a well formed message to make sure the receiver wasn't 335 // Now send a well formed message to make sure the receiver wasn't
339 // thrown out of sync by the extra argument. 336 // thrown out of sync by the extra argument.
340 msg = new MsgClassIS(3, L"expect three"); 337 msg = new MsgClassIS(3, L"expect three");
(...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after
386 // Test the regular messages. 383 // Test the regular messages.
387 msg = new MsgClassIS(3, L"text3"); 384 msg = new MsgClassIS(3, L"text3");
388 EXPECT_TRUE(server.OnMessageReceived(*msg)); 385 EXPECT_TRUE(server.OnMessageReceived(*msg));
389 delete msg; 386 delete msg;
390 msg = new MsgClassSI(L"text2", 2); 387 msg = new MsgClassSI(L"text2", 2);
391 EXPECT_TRUE(server.OnMessageReceived(*msg)); 388 EXPECT_TRUE(server.OnMessageReceived(*msg));
392 delete msg; 389 delete msg;
393 390
394 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) 391 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON)
395 // Test a bad message. 392 // Test a bad message.
396 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, 393 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID);
397 IPC::Message::PRIORITY_NORMAL);
398 msg->WriteInt(2); 394 msg->WriteInt(2);
399 EXPECT_FALSE(server.OnMessageReceived(*msg)); 395 EXPECT_FALSE(server.OnMessageReceived(*msg));
400 delete msg; 396 delete msg;
401 397
402 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, 398 msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID);
403 IPC::Message::PRIORITY_NORMAL);
404 msg->WriteInt(0x64); 399 msg->WriteInt(0x64);
405 msg->WriteInt(0x32); 400 msg->WriteInt(0x32);
406 EXPECT_FALSE(server.OnMessageReceived(*msg)); 401 EXPECT_FALSE(server.OnMessageReceived(*msg));
407 delete msg; 402 delete msg;
408 403
409 EXPECT_EQ(0, server.unhandled_msgs()); 404 EXPECT_EQ(0, server.unhandled_msgs());
410 #endif 405 #endif
411 } 406 }
412 407
413 } // namespace 408 } // namespace
OLDNEW
« no previous file with comments | « ipc/ipc_channel_win.cc ('k') | ipc/ipc_logging.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698