| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdio.h> | 5 #include <stdio.h> |
| 6 #include <string> | 6 #include <string> |
| 7 #include <sstream> | 7 #include <sstream> |
| 8 | 8 |
| 9 #include "base/message_loop/message_loop.h" | 9 #include "base/message_loop/message_loop.h" |
| 10 #include "base/threading/platform_thread.h" | 10 #include "base/threading/platform_thread.h" |
| (...skipping 26 matching lines...) Expand all Loading... |
| 37 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { | 37 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { |
| 38 //This was BUG 984408. | 38 //This was BUG 984408. |
| 39 uint32 v1 = kuint32max - 1; | 39 uint32 v1 = kuint32max - 1; |
| 40 int v2 = 666; | 40 int v2 = 666; |
| 41 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 41 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
| 42 EXPECT_TRUE(m.WriteInt(v1)); | 42 EXPECT_TRUE(m.WriteInt(v1)); |
| 43 EXPECT_TRUE(m.WriteInt(v2)); | 43 EXPECT_TRUE(m.WriteInt(v2)); |
| 44 | 44 |
| 45 PickleIterator iter(m); | 45 PickleIterator iter(m); |
| 46 std::string vs; | 46 std::string vs; |
| 47 EXPECT_FALSE(iter.ReadString(&vs)); | 47 EXPECT_FALSE(m.ReadString(&iter, &vs)); |
| 48 } | 48 } |
| 49 | 49 |
| 50 TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) { | 50 TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) { |
| 51 //This was BUG 984408. | 51 //This was BUG 984408. |
| 52 uint32 v1 = kuint32max - 1; | 52 uint32 v1 = kuint32max - 1; |
| 53 int v2 = 777; | 53 int v2 = 777; |
| 54 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 54 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
| 55 EXPECT_TRUE(m.WriteInt(v1)); | 55 EXPECT_TRUE(m.WriteInt(v1)); |
| 56 EXPECT_TRUE(m.WriteInt(v2)); | 56 EXPECT_TRUE(m.WriteInt(v2)); |
| 57 | 57 |
| 58 PickleIterator iter(m); | 58 PickleIterator iter(m); |
| 59 std::wstring vs; | 59 std::wstring vs; |
| 60 EXPECT_FALSE(iter.ReadWString(&vs)); | 60 EXPECT_FALSE(m.ReadWString(&iter, &vs)); |
| 61 } | 61 } |
| 62 | 62 |
| 63 TEST(IPCMessageIntegrity, ReadBytesBadIterator) { | 63 TEST(IPCMessageIntegrity, ReadBytesBadIterator) { |
| 64 // This was BUG 1035467. | 64 // This was BUG 1035467. |
| 65 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 65 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
| 66 EXPECT_TRUE(m.WriteInt(1)); | 66 EXPECT_TRUE(m.WriteInt(1)); |
| 67 EXPECT_TRUE(m.WriteInt(2)); | 67 EXPECT_TRUE(m.WriteInt(2)); |
| 68 | 68 |
| 69 PickleIterator iter(m); | 69 PickleIterator iter(m); |
| 70 const char* data = NULL; | 70 const char* data = NULL; |
| 71 EXPECT_TRUE(iter.ReadBytes(&data, sizeof(int))); | 71 EXPECT_TRUE(m.ReadBytes(&iter, &data, sizeof(int))); |
| 72 } | 72 } |
| 73 | 73 |
| 74 TEST(IPCMessageIntegrity, ReadVectorNegativeSize) { | 74 TEST(IPCMessageIntegrity, ReadVectorNegativeSize) { |
| 75 // A slight variation of BUG 984408. Note that the pickling of vector<char> | 75 // A slight variation of BUG 984408. Note that the pickling of vector<char> |
| 76 // has a specialized template which is not vulnerable to this bug. So here | 76 // has a specialized template which is not vulnerable to this bug. So here |
| 77 // try to hit the non-specialized case vector<P>. | 77 // try to hit the non-specialized case vector<P>. |
| 78 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); | 78 IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); |
| 79 EXPECT_TRUE(m.WriteInt(-1)); // This is the count of elements. | 79 EXPECT_TRUE(m.WriteInt(-1)); // This is the count of elements. |
| 80 EXPECT_TRUE(m.WriteInt(1)); | 80 EXPECT_TRUE(m.WriteInt(1)); |
| 81 EXPECT_TRUE(m.WriteInt(2)); | 81 EXPECT_TRUE(m.WriteInt(2)); |
| (...skipping 122 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 204 base::MessageLoop::current()->Quit(); | 204 base::MessageLoop::current()->Quit(); |
| 205 return true; | 205 return true; |
| 206 } | 206 } |
| 207 | 207 |
| 208 bool ExpectMessage(int value, uint32 type_id) { | 208 bool ExpectMessage(int value, uint32 type_id) { |
| 209 if (!MsgHandlerInternal(type_id)) | 209 if (!MsgHandlerInternal(type_id)) |
| 210 return false; | 210 return false; |
| 211 int msg_value1 = 0; | 211 int msg_value1 = 0; |
| 212 int msg_value2 = 0; | 212 int msg_value2 = 0; |
| 213 PickleIterator iter(*last_msg_); | 213 PickleIterator iter(*last_msg_); |
| 214 if (!iter.ReadInt(&msg_value1)) | 214 if (!last_msg_->ReadInt(&iter, &msg_value1)) |
| 215 return false; | 215 return false; |
| 216 if (!iter.ReadInt(&msg_value2)) | 216 if (!last_msg_->ReadInt(&iter, &msg_value2)) |
| 217 return false; | 217 return false; |
| 218 if ((msg_value2 + 1) != msg_value1) | 218 if ((msg_value2 + 1) != msg_value1) |
| 219 return false; | 219 return false; |
| 220 if (msg_value2 != value) | 220 if (msg_value2 != value) |
| 221 return false; | 221 return false; |
| 222 | 222 |
| 223 delete last_msg_; | 223 delete last_msg_; |
| 224 last_msg_ = NULL; | 224 last_msg_ = NULL; |
| 225 return true; | 225 return true; |
| 226 } | 226 } |
| (...skipping 112 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 339 // thrown out of sync by the extra argument. | 339 // thrown out of sync by the extra argument. |
| 340 msg = new MsgClassIS(3, L"expect three"); | 340 msg = new MsgClassIS(3, L"expect three"); |
| 341 sender()->Send(msg); | 341 sender()->Send(msg); |
| 342 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); | 342 EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); |
| 343 | 343 |
| 344 EXPECT_TRUE(WaitForClientShutdown()); | 344 EXPECT_TRUE(WaitForClientShutdown()); |
| 345 DestroyChannel(); | 345 DestroyChannel(); |
| 346 } | 346 } |
| 347 | 347 |
| 348 } // namespace | 348 } // namespace |
| OLD | NEW |