1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
// Copyright 2023 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <stddef.h>
#include <stdint.h>
#include <fuzzer/FuzzedDataProvider.h>
#include "base/check_op.h"
#include "base/json/json_reader.h"
#include "base/values.h"
#include "net/dns/host_resolver_cache.h"
#include "testing/libfuzzer/proto/json.pb.h"
#include "testing/libfuzzer/proto/json_proto_converter.h"
#include "testing/libfuzzer/proto/lpm_interface.h"
#include "third_party/abseil-cpp/absl/types/optional.h"
namespace net {
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
FuzzedDataProvider data_provider(data, size);
size_t cache_size = data_provider.ConsumeIntegral<size_t>();
if (cache_size == 0) {
return 0;
}
// Either consume a JSON proto string to maximize base::Value compatibility or
// a bare string to maximize fuzzing.
std::string json_string;
if (data_provider.ConsumeBool()) {
std::vector<uint8_t> bytes = data_provider.ConsumeRemainingBytes<uint8_t>();
json_proto::JsonValue proto;
if (!protobuf_mutator::libfuzzer::LoadProtoInput(
/*binary=*/false, bytes.data(), bytes.size(), &proto)) {
return 0;
}
json_string = json_proto::JsonProtoConverter().Convert(proto);
} else {
json_string = data_provider.ConsumeRemainingBytesAsString();
}
absl::optional<base::Value> value = base::JSONReader::Read(json_string);
if (!value.has_value()) {
return 0;
}
HostResolverCache cache(cache_size);
if (!cache.RestoreFromValue(value.value())) {
return 0;
}
base::Value reserialized = cache.Serialize();
// If at max size, may not have deserialized all data out of the fuzzed input.
if (cache.AtMaxSizeForTesting()) {
return 0;
}
CHECK_EQ(reserialized, value.value());
return 0;
}
} // namespace net
|
