OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <stdio.h> | 5 #include <stdio.h> |
6 #include <string> | 6 #include <string> |
7 #include <sstream> | 7 #include <sstream> |
8 | 8 |
9 #include "base/message_loop/message_loop.h" | 9 #include "base/message_loop/message_loop.h" |
10 #include "base/threading/platform_thread.h" | 10 #include "base/threading/platform_thread.h" |
(...skipping 26 matching lines...) Expand all Loading... |
37 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { | 37 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { |
38 //This was BUG 984408. | 38 //This was BUG 984408. |
39 uint32 v1 = kuint32max - 1; | 39 uint32 v1 = kuint32max - 1; |
40 int v2 = 666; | 40 int v2 = 666; |
41 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 41 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
42 EXPECT_TRUE(m.WriteInt(v1)); | 42 EXPECT_TRUE(m.WriteInt(v1)); |
43 EXPECT_TRUE(m.WriteInt(v2)); | 43 EXPECT_TRUE(m.WriteInt(v2)); |
44 | 44 |
45 PickleIterator iter(m); | 45 PickleIterator iter(m); |
46 std::string vs; | 46 std::string vs; |
47 EXPECT_FALSE(iter.ReadString(&vs)); | 47 EXPECT_FALSE(m.ReadString(&iter, &vs)); |
48 } | 48 } |
49 | 49 |
50 TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) { | 50 TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) { |
51 //This was BUG 984408. | 51 //This was BUG 984408. |
52 uint32 v1 = kuint32max - 1; | 52 uint32 v1 = kuint32max - 1; |
53 int v2 = 777; | 53 int v2 = 777; |
54 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 54 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
55 EXPECT_TRUE(m.WriteInt(v1)); | 55 EXPECT_TRUE(m.WriteInt(v1)); |
56 EXPECT_TRUE(m.WriteInt(v2)); | 56 EXPECT_TRUE(m.WriteInt(v2)); |
57 | 57 |
58 PickleIterator iter(m); | 58 PickleIterator iter(m); |
59 std::wstring vs; | 59 std::wstring vs; |
60 EXPECT_FALSE(iter.ReadWString(&vs)); | 60 EXPECT_FALSE(m.ReadWString(&iter, &vs)); |
61 } | 61 } |
62 | 62 |
63 TEST(IPCMessageIntegrity, ReadBytesBadIterator) { | 63 TEST(IPCMessageIntegrity, ReadBytesBadIterator) { |
64 // This was BUG 1035467. | 64 // This was BUG 1035467. |
65 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 65 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
66 EXPECT_TRUE(m.WriteInt(1)); | 66 EXPECT_TRUE(m.WriteInt(1)); |
67 EXPECT_TRUE(m.WriteInt(2)); | 67 EXPECT_TRUE(m.WriteInt(2)); |
68 | 68 |
69 PickleIterator iter(m); | 69 PickleIterator iter(m); |
70 const char* data = NULL; | 70 const char* data = NULL; |
71 EXPECT_TRUE(iter.ReadBytes(&data, sizeof(int))); | 71 EXPECT_TRUE(m.ReadBytes(&iter, &data, sizeof(int))); |
72 } | 72 } |
73 | 73 |
74 TEST(IPCMessageIntegrity, ReadVectorNegativeSize) { | 74 TEST(IPCMessageIntegrity, ReadVectorNegativeSize) { |
75 // A slight variation of BUG 984408. Note that the pickling of vector<char> | 75 // A slight variation of BUG 984408. Note that the pickling of vector<char> |
76 // has a specialized template which is not vulnerable to this bug. So here | 76 // has a specialized template which is not vulnerable to this bug. So here |
77 // try to hit the non-specialized case vector<P>. | 77 // try to hit the non-specialized case vector<P>. |
78 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 78 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
79 EXPECT_TRUE(m.WriteInt(-1)); // This is the count of elements. | 79 EXPECT_TRUE(m.WriteInt(-1)); // This is the count of elements. |
80 EXPECT_TRUE(m.WriteInt(1)); | 80 EXPECT_TRUE(m.WriteInt(1)); |
81 EXPECT_TRUE(m.WriteInt(2)); | 81 EXPECT_TRUE(m.WriteInt(2)); |
(...skipping 122 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
204 base::MessageLoop::current()->Quit(); | 204 base::MessageLoop::current()->Quit(); |
205 return true; | 205 return true; |
206 } | 206 } |
207 | 207 |
208 bool ExpectMessage(int value, uint32 type_id) { | 208 bool ExpectMessage(int value, uint32 type_id) { |
209 if (!MsgHandlerInternal(type_id)) | 209 if (!MsgHandlerInternal(type_id)) |
210 return false; | 210 return false; |
211 int msg_value1 = 0; | 211 int msg_value1 = 0; |
212 int msg_value2 = 0; | 212 int msg_value2 = 0; |
213 PickleIterator iter(*last_msg_); | 213 PickleIterator iter(*last_msg_); |
214 if (!iter.ReadInt(&msg_value1)) | 214 if (!last_msg_->ReadInt(&iter, &msg_value1)) |
215 return false; | 215 return false; |
216 if (!iter.ReadInt(&msg_value2)) | 216 if (!last_msg_->ReadInt(&iter, &msg_value2)) |
217 return false; | 217 return false; |
218 if ((msg_value2 + 1) != msg_value1) | 218 if ((msg_value2 + 1) != msg_value1) |
219 return false; | 219 return false; |
220 if (msg_value2 != value) | 220 if (msg_value2 != value) |
221 return false; | 221 return false; |
222 | 222 |
223 delete last_msg_; | 223 delete last_msg_; |
224 last_msg_ = NULL; | 224 last_msg_ = NULL; |
225 return true; | 225 return true; |
226 } | 226 } |
(...skipping 112 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
339 // thrown out of sync by the extra argument. | 339 // thrown out of sync by the extra argument. |
340 msg = new MsgClassIS(3, L"expect three"); | 340 msg = new MsgClassIS(3, L"expect three"); |
341 sender()->Send(msg); | 341 sender()->Send(msg); |
342 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); | 342 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); |
343 | 343 |
344 EXPECT_TRUE(WaitForClientShutdown()); | 344 EXPECT_TRUE(WaitForClientShutdown()); |
345 DestroyChannel(); | 345 DestroyChannel(); |
346 } | 346 } |
347 | 347 |
348 } // namespace | 348 } // namespace |
OLD | NEW |