1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
// Copyright 2022 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "remoting/base/protobuf_http_stream_parser.h"
#include <fuzzer/FuzzedDataProvider.h>
#include <stdint.h>
#include <memory>
#include "base/functional/callback_helpers.h"
#include "base/logging.h"
#include "base/test/bind.h"
#include "remoting/base/http_status.h"
// Does initialization and holds state that's shared across all runs.
class Environment {
public:
Environment() {
// Disable noisy logging.
logging::SetMinLogLevel(logging::LOGGING_FATAL);
}
};
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
constexpr size_t kMaxInputSize = 100 * 1000;
static Environment env;
if (size > kMaxInputSize) {
// To avoid spurious timeout and out-of-memory fuzz reports.
return 0;
}
FuzzedDataProvider provider(data, size);
// Create a parser. `stream_closed_callback` destroys it, to satisfy the
// implicit API that nothing should be passed after the stream close message.
std::unique_ptr<remoting::ProtobufHttpStreamParser> parser;
auto on_stream_closed = [&](const remoting::HttpStatus&) { parser.reset(); };
parser = std::make_unique<remoting::ProtobufHttpStreamParser>(
/*message_callback=*/base::DoNothing(),
/*stream_closed_callback=*/base::BindLambdaForTesting(on_stream_closed));
while (parser && provider.remaining_bytes() > 0) {
parser->Append(provider.ConsumeRandomLengthString());
}
return 0;
}
|
