// Copyright 2016 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include "net/url_request/url_request.h" #include #include #include #include #include "base/run_loop.h" #include "net/base/request_priority.h" #include "net/socket/fuzzed_socket_factory.h" #include "net/traffic_annotation/network_traffic_annotation_test_helper.h" #include "net/url_request/url_request.h" #include "net/url_request/url_request_context.h" #include "net/url_request/url_request_context_builder.h" #include "net/url_request/url_request_test_util.h" #include "url/gurl.h" // Restrict max input length to reject too long inputs that can be too slow to // process and may lead to an unbounded corpus growth. const size_t kMaxInputSize = 65536 + 257; // Integration fuzzer for URLRequest's handling of HTTP requests. Can follow // redirects, both on the same server (using a new socket or the old one) and // across servers. // TODO(mmenke): Add support for testing HTTPS, auth, proxies, uploading, // cancelation, deferring reads / redirects, using preconnected sockets, SPDY, // QUIC, DNS failures (they all currently resolve to localhost), IPv6 DNS // results, URLs with IPs instead of hostnames (v4 and v6), etc. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { if (size > kMaxInputSize) return 0; FuzzedDataProvider data_provider(data, size); auto context_builder = net::CreateTestURLRequestContextBuilder(); net::FuzzedSocketFactory fuzzed_socket_factory(&data_provider); context_builder->set_client_socket_factory_for_testing( &fuzzed_socket_factory); auto url_request_context = context_builder->Build(); net::TestDelegate delegate; std::unique_ptr url_request( url_request_context->CreateRequest(GURL("http://foo/"), net::DEFAULT_PRIORITY, &delegate, TRAFFIC_ANNOTATION_FOR_TESTS)); url_request->Start(); // TestDelegate quits the message loop on completion. base::RunLoop().Run(); return 0; }