| OLD | NEW |
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include <algorithm> | |
| 6 #include <sstream> | |
| 7 #include <string> | |
| 8 #include <vector> | |
| 9 | |
| 10 #include "base/basictypes.h" | |
| 11 #include "base/files/file_path.h" | |
| 12 #include "base/files/file_util.h" | |
| 13 #include "base/json/json_reader.h" | |
| 14 #include "base/memory/scoped_ptr.h" | |
| 15 #include "base/time/time.h" | |
| 16 #include "base/values.h" | |
| 17 #include "net/base/address_list.h" | |
| 18 #include "net/base/dns_util.h" | |
| 19 #include "net/base/io_buffer.h" | |
| 20 #include "net/base/ip_endpoint.h" | |
| 21 #include "net/dns/dns_protocol.h" | |
| 22 #include "net/dns/dns_query.h" | |
| 23 #include "net/dns/dns_response.h" | |
| 24 | |
| 25 namespace { | |
| 26 | |
| 27 void CrashDoubleFree(void) { | |
| 28 // Cause ASAN to detect a double-free | |
| 29 void *p = malloc(1); | |
| 30 LOG(INFO) << "Allocated p=" << p << ". Double-freeing..."; | |
| 31 free(p); | |
| 32 free(p); | |
| 33 } | |
| 34 | |
| 35 void CrashNullPointerDereference(void) { | |
| 36 // Cause the program to segfault with a NULL pointer dereference | |
| 37 int *p = NULL; | |
| 38 *p = 0; | |
| 39 } | |
| 40 | |
| 41 bool FitsUint8(int num) { | |
| 42 return (num >= 0) && (num <= kuint8max); | |
| 43 } | |
| 44 | |
| 45 bool FitsUint16(int num) { | |
| 46 return (num >= 0) && (num <= kuint16max); | |
| 47 } | |
| 48 | |
| 49 bool ReadTestCase(const char* filename, | |
| 50 uint16* id, std::string* qname, uint16* qtype, | |
| 51 std::vector<char>* resp_buf, | |
| 52 bool* crash_test) { | |
| 53 base::FilePath filepath = base::FilePath::FromUTF8Unsafe(filename); | |
| 54 | |
| 55 std::string json; | |
| 56 if (!base::ReadFileToString(filepath, &json)) { | |
| 57 LOG(ERROR) << filename << ": couldn't read file."; | |
| 58 return false; | |
| 59 } | |
| 60 | |
| 61 scoped_ptr<base::Value> value(base::JSONReader::Read(json)); | |
| 62 if (!value.get()) { | |
| 63 LOG(ERROR) << filename << ": couldn't parse JSON."; | |
| 64 return false; | |
| 65 } | |
| 66 | |
| 67 base::DictionaryValue* dict; | |
| 68 if (!value->GetAsDictionary(&dict)) { | |
| 69 LOG(ERROR) << filename << ": test case is not a dictionary."; | |
| 70 return false; | |
| 71 } | |
| 72 | |
| 73 *crash_test = dict->HasKey("crash_test"); | |
| 74 if (*crash_test) { | |
| 75 LOG(INFO) << filename << ": crash_test is set!"; | |
| 76 return true; | |
| 77 } | |
| 78 | |
| 79 int id_int; | |
| 80 if (!dict->GetInteger("id", &id_int)) { | |
| 81 LOG(ERROR) << filename << ": id is missing or not an integer."; | |
| 82 return false; | |
| 83 } | |
| 84 if (!FitsUint16(id_int)) { | |
| 85 LOG(ERROR) << filename << ": id is out of range."; | |
| 86 return false; | |
| 87 } | |
| 88 *id = static_cast<uint16>(id_int); | |
| 89 | |
| 90 if (!dict->GetStringASCII("qname", qname)) { | |
| 91 LOG(ERROR) << filename << ": qname is missing or not a string."; | |
| 92 return false; | |
| 93 } | |
| 94 | |
| 95 int qtype_int; | |
| 96 if (!dict->GetInteger("qtype", &qtype_int)) { | |
| 97 LOG(ERROR) << filename << ": qtype is missing or not an integer."; | |
| 98 return false; | |
| 99 } | |
| 100 if (!FitsUint16(qtype_int)) { | |
| 101 LOG(ERROR) << filename << ": qtype is out of range."; | |
| 102 return false; | |
| 103 } | |
| 104 *qtype = static_cast<uint16>(qtype_int); | |
| 105 | |
| 106 base::ListValue* resp_list; | |
| 107 if (!dict->GetList("response", &resp_list)) { | |
| 108 LOG(ERROR) << filename << ": response is missing or not a list."; | |
| 109 return false; | |
| 110 } | |
| 111 | |
| 112 size_t resp_size = resp_list->GetSize(); | |
| 113 resp_buf->clear(); | |
| 114 resp_buf->reserve(resp_size); | |
| 115 for (size_t i = 0; i < resp_size; i++) { | |
| 116 int resp_byte_int; | |
| 117 if ((!resp_list->GetInteger(i, &resp_byte_int))) { | |
| 118 LOG(ERROR) << filename << ": response[" << i << "] is not an integer."; | |
| 119 return false; | |
| 120 } | |
| 121 if (!FitsUint8(resp_byte_int)) { | |
| 122 LOG(ERROR) << filename << ": response[" << i << "] is out of range."; | |
| 123 return false; | |
| 124 } | |
| 125 resp_buf->push_back(static_cast<char>(resp_byte_int)); | |
| 126 } | |
| 127 DCHECK(resp_buf->size() == resp_size); | |
| 128 | |
| 129 LOG(INFO) << "Query: id=" << id_int << ", " | |
| 130 << "qname=" << *qname << ", " | |
| 131 << "qtype=" << qtype_int << ", " | |
| 132 << "resp_size=" << resp_size; | |
| 133 | |
| 134 return true; | |
| 135 } | |
| 136 | |
| 137 void RunTestCase(uint16 id, std::string& qname, uint16 qtype, | |
| 138 std::vector<char>& resp_buf) { | |
| 139 net::DnsQuery query(id, qname, qtype); | |
| 140 net::DnsResponse response; | |
| 141 std::copy(resp_buf.begin(), resp_buf.end(), response.io_buffer()->data()); | |
| 142 | |
| 143 if (!response.InitParse(resp_buf.size(), query)) { | |
| 144 LOG(INFO) << "InitParse failed."; | |
| 145 return; | |
| 146 } | |
| 147 | |
| 148 net::AddressList address_list; | |
| 149 base::TimeDelta ttl; | |
| 150 net::DnsResponse::Result result = response.ParseToAddressList( | |
| 151 &address_list, &ttl); | |
| 152 if (result != net::DnsResponse::DNS_PARSE_OK) { | |
| 153 LOG(INFO) << "ParseToAddressList failed: " << result; | |
| 154 return; | |
| 155 } | |
| 156 | |
| 157 // Print the response in one compact line. | |
| 158 std::stringstream result_line; | |
| 159 result_line << "Response: address_list={ "; | |
| 160 for (unsigned int i = 0; i < address_list.size(); i++) | |
| 161 result_line << address_list[i].ToString() << " "; | |
| 162 result_line << "}, ttl=" << ttl.InSeconds() << "s"; | |
| 163 | |
| 164 LOG(INFO) << result_line.str(); | |
| 165 } | |
| 166 | |
| 167 bool ReadAndRunTestCase(const char* filename) { | |
| 168 uint16 id = 0; | |
| 169 std::string qname; | |
| 170 uint16 qtype = 0; | |
| 171 std::vector<char> resp_buf; | |
| 172 bool crash_test = false; | |
| 173 | |
| 174 LOG(INFO) << "Test case: " << filename; | |
| 175 | |
| 176 // ReadTestCase will print a useful error message if it fails. | |
| 177 if (!ReadTestCase(filename, &id, &qname, &qtype, &resp_buf, &crash_test)) | |
| 178 return false; | |
| 179 | |
| 180 if (crash_test) { | |
| 181 LOG(INFO) << "Crashing."; | |
| 182 CrashDoubleFree(); | |
| 183 // if we're not running under ASAN, that might not have worked | |
| 184 CrashNullPointerDereference(); | |
| 185 NOTREACHED(); | |
| 186 return true; | |
| 187 } | |
| 188 | |
| 189 std::string qname_dns; | |
| 190 if (!net::DNSDomainFromDot(qname, &qname_dns)) { | |
| 191 LOG(ERROR) << filename << ": DNSDomainFromDot(" << qname << ") failed."; | |
| 192 return false; | |
| 193 } | |
| 194 | |
| 195 RunTestCase(id, qname_dns, qtype, resp_buf); | |
| 196 | |
| 197 return true; | |
| 198 } | |
| 199 | |
| 200 } | |
| 201 | |
| 202 int main(int argc, char** argv) { | |
| 203 int ret = 0; | |
| 204 | |
| 205 for (int i = 1; i < argc; i++) | |
| 206 if (!ReadAndRunTestCase(argv[i])) | |
| 207 ret = 2; | |
| 208 | |
| 209 // Cluster-Fuzz likes "#EOF" as the last line of output to help distinguish | |
| 210 // successful runs from crashes. | |
| 211 printf("#EOF\n"); | |
| 212 | |
| 213 return ret; | |
| 214 } | |
| 215 | |
| OLD | NEW |