File: minidump_fuzzer.cc

package info (click to toggle)
chromium 139.0.7258.127-1
  • links: PTS, VCS
  • area: main
  • in suites:
  • size: 6,122,068 kB
  • sloc: cpp: 35,100,771; ansic: 7,163,530; javascript: 4,103,002; python: 1,436,920; asm: 946,517; xml: 746,709; pascal: 187,653; perl: 88,691; sh: 88,436; objc: 79,953; sql: 51,488; cs: 44,583; fortran: 24,137; makefile: 22,147; tcl: 15,277; php: 13,980; yacc: 8,984; ruby: 7,485; awk: 3,720; lisp: 3,096; lex: 1,327; ada: 727; jsp: 228; sed: 36
file content (96 lines) | stat: -rw-r--r-- 2,936 bytes parent folder | download | duplicates (11)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
// Copyright 2016 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include <stddef.h>
#include <stdint.h>
#include <string.h>

#include <istream>
#include <limits>
#include <memory>
#include <streambuf>

#include "base/memory/free_deleter.h"
#include "google_breakpad/processor/basic_source_line_resolver.h"
#include "google_breakpad/processor/minidump.h"
#include "google_breakpad/processor/minidump_processor.h"
#include "google_breakpad/processor/process_state.h"
#include "processor/logging.h"
#include "processor/simple_symbol_supplier.h"
#include "processor/stackwalk_common.h"

namespace {

using google_breakpad::BasicSourceLineResolver;
using google_breakpad::Minidump;
using google_breakpad::MinidumpProcessor;
using google_breakpad::ProcessState;
using google_breakpad::SimpleSymbolSupplier;

struct membuf : std::streambuf {
  membuf(char* begin, char* end) { setg(begin, begin, end); }

 protected:
  virtual pos_type seekoff(off_type off,
                           std::ios_base::seekdir dir,
                           std::ios_base::openmode which = std::ios_base::in) {
    if (dir == std::ios_base::cur)
      gbump(off);
    return gptr() - eback();
  }
};

bool PrintMinidumpProcess(const uint8_t* data,
                          size_t size,
                          const std::vector<string>& symbol_paths) {
  // Signature and version number.
  static const uint8_t kHeaderPrefix[] = {'P', 'M', 'D', 'M', 0, 0, 0xa7, 0x93};
  if (size > std::numeric_limits<size_t>::max() - sizeof(kHeaderPrefix))
    return false;

  size += sizeof(kHeaderPrefix);
  std::unique_ptr<char, base::FreeDeleter> buffer(
      static_cast<char*>(malloc(size)));
  if (!buffer)
    return false;

  memcpy(buffer.get(), kHeaderPrefix, sizeof(kHeaderPrefix));
  memcpy(buffer.get() + sizeof(kHeaderPrefix), data,
         size - sizeof(kHeaderPrefix));

  membuf sbuf(buffer.get(), buffer.get() + size);
  std::istream input(&sbuf);

  std::unique_ptr<SimpleSymbolSupplier> symbol_supplier;
  if (!symbol_paths.empty())
    symbol_supplier = std::make_unique<SimpleSymbolSupplier>(symbol_paths);

  BasicSourceLineResolver resolver;
  MinidumpProcessor minidump_processor(symbol_supplier.get(), &resolver);

  // Process the minidump.
  Minidump dump(input);
  if (!dump.Read()) {
    BPLOG(ERROR) << "Minidump " << dump.path() << " could not be read";
    return false;
  }
  ProcessState process_state;
  if (minidump_processor.Process(&dump, &process_state) !=
      google_breakpad::PROCESS_OK) {
    BPLOG(ERROR) << "MinidumpProcessor::Process failed";
    return false;
  }

  PrintProcessStateMachineReadable(process_state);

  return true;
}

}  // namespace

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  // TODO(wfh): Somehow pull symbols in.
  PrintMinidumpProcess(data, size, std::vector<string>());
  return 0;
}