1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
// Copyright 2018 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <stddef.h>
#include <stdint.h>
#include <fuzzer/FuzzedDataProvider.h>
#include "base/check.h"
#include "base/strings/string_number_conversions.h"
#include "base/strings/string_piece.h"
#include "net/base/io_buffer.h"
#include "net/dns/dns_names_util.h"
#include "net/dns/dns_query.h"
#include "net/dns/dns_response.h"
#include "net/dns/dns_util.h"
#include "net/dns/public/dns_protocol.h"
#include "third_party/abseil-cpp/absl/types/optional.h"
namespace {
void ValidateParsedResponse(
net::DnsResponse& response,
const net::IOBufferWithSize& packet,
absl::optional<net::DnsQuery> query = absl::nullopt) {
CHECK_EQ(response.io_buffer(), &packet);
CHECK_EQ(static_cast<int>(response.io_buffer_size()), packet.size());
response.id();
if (response.IsValid()) {
CHECK(response.id().has_value());
response.flags();
response.rcode();
CHECK_EQ(response.dotted_qnames().size(), response.question_count());
CHECK_EQ(response.qtypes().size(), response.question_count());
if (response.question_count() == 1) {
response.GetSingleDottedName();
response.GetSingleQType();
}
response.answer_count();
response.authority_count();
response.additional_answer_count();
bool success = false;
size_t last_offset = 0;
net::DnsRecordParser parser = response.Parser();
do {
net::DnsResourceRecord record;
success = parser.ReadRecord(&record);
CHECK(!success || parser.GetOffset() > last_offset);
last_offset = parser.GetOffset();
} while (success);
// Attempt to parse a couple more.
for (int i = 0; i < 10; ++i) {
net::DnsResourceRecord record;
CHECK(!parser.ReadRecord(&record));
}
if (query) {
CHECK_EQ(response.question_count(), 1u);
CHECK_EQ(response.id().value(), query->id());
absl::optional<std::string> dotted_qname =
net::dns_names_util::NetworkToDottedName(query->qname(),
/*require_complete=*/true);
CHECK(dotted_qname.has_value());
CHECK_EQ(response.GetSingleDottedName(), dotted_qname.value());
CHECK_EQ(response.GetSingleQType(), query->qtype());
}
}
}
} // namespace
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
FuzzedDataProvider data_provider(data, size);
std::string response_string = data_provider.ConsumeRandomLengthString();
auto response_packet =
base::MakeRefCounted<net::IOBufferWithSize>(response_string.size());
memcpy(response_packet->data(), response_string.data(),
response_string.size());
net::DnsResponse received_response(response_packet, response_string.size());
received_response.InitParseWithoutQuery(response_string.size());
ValidateParsedResponse(received_response, *response_packet.get());
size_t query_size = data_provider.remaining_bytes();
auto query_packet = base::MakeRefCounted<net::IOBufferWithSize>(query_size);
data_provider.ConsumeData(query_packet->data(), query_size);
net::DnsQuery query(query_packet);
if (!query.Parse(query_size))
return 0;
net::DnsResponse received_response_with_query(response_packet,
response_string.size());
received_response_with_query.InitParse(response_string.size(), query);
ValidateParsedResponse(received_response_with_query, *response_packet.get(),
query);
net::DnsResponse response(query.id(), true /* is_authoritative */,
{} /* answers */, {} /* authority_records */,
{} /* additional records */, query);
std::string out =
base::HexEncode(response.io_buffer()->data(), response.io_buffer_size());
return 0;
}
|
