Revert https://src.chromium.org/viewvc/chrome?view=rev&revision=231330

ipc/ipc_fuzzing_tests.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdio.h>
 #include <string>
 #include <sstream>
 
 #include "base/message_loop/message_loop.h"
 #include "base/threading/platform_thread.h"
@@ skipping 20 matching lines @@
 IPC_MESSAGE_CONTROL0(MsgUnhandled)
 
 // -----------------------------------------------------------------------------
 
 namespace {
 
 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) {
   //This was BUG 984408.
   uint32 v1 = kuint32max - 1;
   int v2 = 666;
-  IPC::Message m(0, 1);
+  IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
   EXPECT_TRUE(m.WriteInt(v1));
   EXPECT_TRUE(m.WriteInt(v2));
 
   PickleIterator iter(m);
   std::string vs;
   EXPECT_FALSE(m.ReadString(&iter, &vs));
 }
 
 TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) {
   //This was BUG 984408.
   uint32 v1 = kuint32max - 1;
   int v2 = 777;
-  IPC::Message m(0, 1);
+  IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
   EXPECT_TRUE(m.WriteInt(v1));
   EXPECT_TRUE(m.WriteInt(v2));
 
   PickleIterator iter(m);
   std::wstring vs;
   EXPECT_FALSE(m.ReadWString(&iter, &vs));
 }
 
 TEST(IPCMessageIntegrity, ReadBytesBadIterator) {
   // This was BUG 1035467.
-  IPC::Message m(0, 1);
+  IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
   EXPECT_TRUE(m.WriteInt(1));
   EXPECT_TRUE(m.WriteInt(2));
 
   PickleIterator iter(m);
   const char* data = NULL;
   EXPECT_TRUE(m.ReadBytes(&iter, &data, sizeof(int)));
 }
 
 TEST(IPCMessageIntegrity, ReadVectorNegativeSize) {
   // A slight variation of BUG 984408. Note that the pickling of vector<char>
   // has a specialized template which is not vulnerable to this bug. So here
   // try to hit the non-specialized case vector<P>.
-  IPC::Message m(0, 1);
+  IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
   EXPECT_TRUE(m.WriteInt(-1));   // This is the count of elements.
   EXPECT_TRUE(m.WriteInt(1));
   EXPECT_TRUE(m.WriteInt(2));
   EXPECT_TRUE(m.WriteInt(3));
 
   std::vector<double> vec;
   PickleIterator iter(m);
   EXPECT_FALSE(ReadParam(&m, &iter, &vec));
 }
 
 TEST(IPCMessageIntegrity, ReadVectorTooLarge1) {
   // This was BUG 1006367. This is the large but positive length case. Again
   // we try to hit the non-specialized case vector<P>.
-  IPC::Message m(0, 1);
+  IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
   EXPECT_TRUE(m.WriteInt(0x21000003));   // This is the count of elements.
   EXPECT_TRUE(m.WriteInt64(1));
   EXPECT_TRUE(m.WriteInt64(2));
 
   std::vector<int64> vec;
   PickleIterator iter(m);
   EXPECT_FALSE(ReadParam(&m, &iter, &vec));
 }
 
 TEST(IPCMessageIntegrity, ReadVectorTooLarge2) {
   // This was BUG 1006367. This is the large but positive with an additional
   // integer overflow when computing the actual byte size. Again we try to hit
   // the non-specialized case vector<P>.
-  IPC::Message m(0, 1);
+  IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
   EXPECT_TRUE(m.WriteInt(0x71000000));   // This is the count of elements.
   EXPECT_TRUE(m.WriteInt64(1));
   EXPECT_TRUE(m.WriteInt64(2));
 
   std::vector<int64> vec;
   PickleIterator iter(m);
   EXPECT_FALSE(ReadParam(&m, &iter, &vec));
 }
 
 class SimpleListener : public IPC::Listener {
@@ skipping 40 matching lines @@
     Cleanup();
   }
 
   void OnMsgClassSIMessage(const std::wstring& text, int value) {
     UseData(MsgClassSI::ID, value, text);
     RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value);
     Cleanup();
   }
 
   bool RoundtripAckReply(int routing, uint32 type_id, int reply) {
-    IPC::Message* message = new IPC::Message(routing, type_id);
+    IPC::Message* message = new IPC::Message(routing, type_id,
+                                             IPC::Message::PRIORITY_NORMAL);
     message->WriteInt(reply + 1);
     message->WriteInt(reply);
     return other_->Send(message);
   }
 
   void Cleanup() {
     --message_count_;
     --pending_messages_;
     if (0 == message_count_)
       base::MessageLoop::current()->Quit();
@@ skipping 112 matching lines @@
 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON)
 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) {
   Init("FuzzServerClient");
 
   FuzzerClientListener listener;
   CreateChannel(&listener);
   listener.Init(channel());
   ASSERT_TRUE(ConnectChannel());
   ASSERT_TRUE(StartClient());
 
-  IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID);
+  IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID,
+                                       IPC::Message::PRIORITY_NORMAL);
   msg->WriteInt(666);
   sender()->Send(msg);
   EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID));
 
   msg = new MsgClassSI(L"expect one", 1);
   sender()->Send(msg);
   EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID));
 
   EXPECT_TRUE(WaitForClientShutdown());
   DestroyChannel();
 }
 #endif
 
 // This test uses a payload that has too many arguments, but so the payload size
 // is big enough so the unpacking routine does not generate an error as in the
 // case of MsgBadPayloadShort test. This test does not pinpoint a flaw (per se)
 // as by design we don't carry type information on the IPC message.
 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) {
   Init("FuzzServerClient");
 
   FuzzerClientListener listener;
   CreateChannel(&listener);
   listener.Init(channel());
   ASSERT_TRUE(ConnectChannel());
   ASSERT_TRUE(StartClient());
 
-  IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID);
+  IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID,
+                                       IPC::Message::PRIORITY_NORMAL);
   msg->WriteWString(L"d");
   msg->WriteInt(0);
   msg->WriteInt(0x65);  // Extra argument.
 
   sender()->Send(msg);
   EXPECT_TRUE(listener.ExpectMessage(0, MsgClassSI::ID));
 
   // Now send a well formed message to make sure the receiver wasn't
   // thrown out of sync by the extra argument.
   msg = new MsgClassIS(3, L"expect three");
@@ skipping 45 matching lines @@
   // Test the regular messages.
   msg = new MsgClassIS(3, L"text3");
   EXPECT_TRUE(server.OnMessageReceived(*msg));
   delete msg;
   msg = new MsgClassSI(L"text2", 2);
   EXPECT_TRUE(server.OnMessageReceived(*msg));
   delete msg;
 
 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON)
   // Test a bad message.
-  msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID);
+  msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID,
+                         IPC::Message::PRIORITY_NORMAL);
   msg->WriteInt(2);
   EXPECT_FALSE(server.OnMessageReceived(*msg));
   delete msg;
 
-  msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID);
+  msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID,
+                         IPC::Message::PRIORITY_NORMAL);
   msg->WriteInt(0x64);
   msg->WriteInt(0x32);
   EXPECT_FALSE(server.OnMessageReceived(*msg));
   delete msg;
 
   EXPECT_EQ(0, server.unhandled_msgs());
 #endif
 }
 
 }  // namespace