1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
// Copyright 2021 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "extensions/common/manifest.h"
#include <fuzzer/FuzzedDataProvider.h>
#include <stddef.h>
#include <stdint.h>
#include <memory>
#include <optional>
#include <string>
#include <utility>
#include <vector>
#include "base/at_exit.h"
#include "base/check.h"
#include "base/command_line.h"
#include "base/json/json_reader.h"
#include "base/values.h"
#include "content/public/common/content_client.h"
#include "content/public/test/content_test_suite_base.h"
#include "extensions/common/extensions_client.h"
#include "extensions/common/install_warning.h"
#include "extensions/common/mojom/manifest.mojom-shared.h"
#include "extensions/test/test_extensions_client.h"
namespace extensions {
namespace {
// Bail out on larger inputs to prevent out-of-memory failures.
constexpr int kMaxInputSizeBytes = 200 * 1024;
const mojom::ManifestLocation kLocations[] = {
mojom::ManifestLocation::kInternal,
mojom::ManifestLocation::kExternalPref,
mojom::ManifestLocation::kExternalRegistry,
mojom::ManifestLocation::kUnpacked,
mojom::ManifestLocation::kComponent,
mojom::ManifestLocation::kExternalPrefDownload,
mojom::ManifestLocation::kExternalPolicyDownload,
mojom::ManifestLocation::kCommandLine,
mojom::ManifestLocation::kExternalPolicy,
mojom::ManifestLocation::kExternalComponent,
};
class FakeContentClient : public content::ContentClient {
public:
FakeContentClient() = default;
FakeContentClient(const FakeContentClient&) = delete;
FakeContentClient& operator=(const FakeContentClient&) = delete;
~FakeContentClient() override = default;
};
// Holds state shared across all fuzzer calls. The base class supports
// registering URL schemes required to load manifest features.
struct Environment : public content::ContentTestSuiteBase {
Environment() : ContentTestSuiteBase(0, nullptr) {
RegisterContentSchemes(&content_client);
extensions_client = std::make_unique<TestExtensionsClient>();
ExtensionsClient::Set(extensions_client.get());
}
// Singleton objects needed for the tested code.
base::AtExitManager at_exit;
FakeContentClient content_client;
// This must be created after content schemes are registered.
std::unique_ptr<TestExtensionsClient> extensions_client;
};
} // namespace
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
static Environment env;
if (size > kMaxInputSizeBytes) {
return 0;
}
FuzzedDataProvider fuzzed_data_provider(data, size);
std::string extension_id = fuzzed_data_provider.ConsumeRandomLengthString();
if (extension_id.empty())
extension_id.resize(1);
std::optional<base::Value> parsed_json = base::JSONReader::Read(
fuzzed_data_provider.ConsumeRemainingBytesAsString());
if (!parsed_json || !parsed_json->is_dict())
return 0;
for (auto location : kLocations) {
Manifest manifest(location, parsed_json->GetDict().Clone(), extension_id);
std::vector<InstallWarning> install_warning;
manifest.ValidateManifest(&install_warning);
}
return 0;
}
} // namespace extensions
|
