1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
// Copyright 2015 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <fuzzer/FuzzedDataProvider.h>
#include <stddef.h>
#include <stdint.h>
#include <memory>
#include <vector>
#include "base/containers/span.h"
#include "base/files/file_path.h"
#include "base/logging.h"
#include "base/time/time.h"
#include "net/dns/dns_response.h"
#include "net/dns/record_parsed.h"
void InitLogging() {
// For debugging, it may be helpful to enable verbose logging by setting the
// minimum log level to (-LOGGING_FATAL).
logging::SetMinLogLevel(logging::LOGGING_FATAL);
logging::LoggingSettings settings;
settings.logging_dest =
logging::LOG_TO_SYSTEM_DEBUG_LOG | logging::LOG_TO_STDERR;
logging::InitLogging(settings);
}
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data_ptr, size_t size) {
// SAFETY: libfuzzer provides a valid pointer and size pair.
auto data = UNSAFE_BUFFERS(base::span(data_ptr, size));
InitLogging();
FuzzedDataProvider data_provider(data.data(), data.size());
size_t num_records = data_provider.ConsumeIntegral<size_t>();
std::vector<uint8_t> packet = data_provider.ConsumeRemainingBytes<uint8_t>();
net::DnsRecordParser parser(packet, /*offset=*/0, num_records);
if (!parser.IsValid()) {
return 0;
}
base::Time time;
std::unique_ptr<const net::RecordParsed> record_parsed;
do {
record_parsed = net::RecordParsed::CreateFrom(&parser, time);
} while (record_parsed);
net::DnsResourceRecord record;
while (parser.ReadRecord(&record)) {
}
return 0;
}
|
