ax_tree_fuzzer.cc 1.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "ui/accessibility/ax_tree.h"
  5. #include "ui/accessibility/ax_tree_observer.h"
  6. class EmptyAXTreeObserver : public ui::AXTreeObserver {
  7. public:
  8. EmptyAXTreeObserver() {}
  9. ~EmptyAXTreeObserver() override {}
  10. };
  11. // Entry point for LibFuzzer.
  12. extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data, size_t size) {
  13. ui::AXTreeUpdate initial_state;
  14. size_t i = 0;
  15. while (i < size) {
  16. ui::AXNodeData node;
  17. node.id = data[i++];
  18. if (i < size) {
  19. size_t child_count = data[i++];
  20. for (size_t j = 0; j < child_count && i < size; j++)
  21. node.child_ids.push_back(data[i++]);
  22. }
  23. initial_state.nodes.push_back(node);
  24. }
  25. // Don't test absurdly large trees, it might time out.
  26. #if defined(NDEBUG)
  27. constexpr size_t kMaxNodes = 500000;
  28. #else
  29. constexpr size_t kMaxNodes = 50000;
  30. #endif
  31. if (initial_state.nodes.size() > kMaxNodes) {
  32. LOG(WARNING) << "Skipping input because it's too large";
  33. return 0;
  34. }
  35. // Run with --v=1 to aid in debugging a specific crash.
  36. VLOG(1) << "Input accessibility tree:\n" << initial_state.ToString();
  37. EmptyAXTreeObserver observer;
  38. ui::AXTree tree;
  39. tree.AddObserver(&observer);
  40. tree.Unserialize(initial_state);
  41. tree.RemoveObserver(&observer);
  42. return 0;
  43. }