host_cache_fuzzer.cc 3.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192
  1. // Copyright 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <stddef.h>
  5. #include <stdint.h>
  6. #include <stdlib.h>
  7. #include "base/json/json_reader.h"
  8. #include "base/logging.h"
  9. #include "base/numerics/clamped_math.h"
  10. #include "base/numerics/ostream_operators.h"
  11. #include "base/strings/string_piece_forward.h"
  12. #include "net/dns/host_cache.h"
  13. #include "net/dns/host_cache_fuzzer.pb.h"
  14. #include "testing/libfuzzer/proto/json.pb.h"
  15. #include "testing/libfuzzer/proto/json_proto_converter.h"
  16. #include "testing/libfuzzer/proto/lpm_interface.h"
  17. #include "third_party/abseil-cpp/absl/types/optional.h"
  18. namespace net {
  19. struct Environment {
  20. Environment() { logging::SetMinLogLevel(logging::LOG_INFO); }
  21. const bool kDumpStats = getenv("DUMP_FUZZER_STATS");
  22. const bool kDumpNativeInput = getenv("LPM_DUMP_NATIVE_INPUT");
  23. };
  24. // This fuzzer checks that parsing a JSON list to a HostCache and then
  25. // re-serializing it recreates the original JSON list.
  26. //
  27. // A side effect of this technique is that our distribution of HostCaches only
  28. // contains HostCaches that can be generated by RestoreFromListValue. It's
  29. // conceivable that this doesn't capture all possible HostCaches.
  30. //
  31. // TODO(dmcardle): Check the other direction of this property. Starting from an
  32. // arbitrary HostCache, serialize it and then parse a different HostCache.
  33. // Verify that the two HostCaches are equal.
  34. DEFINE_PROTO_FUZZER(const host_cache_fuzzer_proto::JsonOrBytes& input) {
  35. static Environment env;
  36. // Clamp these counters to avoid incorrect statistics in case of overflow. On
  37. // platforms with 8-byte size_t, it would take roughly 58,000 centuries to
  38. // overflow, assuming a very fast fuzzer running at 100,000 exec/s. However, a
  39. // 4-byte size_t could overflow in roughly 12 hours.
  40. static base::ClampedNumeric<size_t> valid_json_count = 0;
  41. static base::ClampedNumeric<size_t> iteration_count = 0;
  42. constexpr size_t kIterationsPerStatsDump = 1024;
  43. static_assert(SIZE_MAX % kIterationsPerStatsDump != 0,
  44. "After saturation, stats would print on every iteration.");
  45. ++iteration_count;
  46. if (env.kDumpStats && iteration_count % kIterationsPerStatsDump == 0) {
  47. LOG(INFO) << "Valid JSON hit rate:" << valid_json_count << "/"
  48. << iteration_count;
  49. }
  50. std::string native_input;
  51. if (input.has_json()) {
  52. json_proto::JsonProtoConverter converter;
  53. native_input = converter.Convert(input.json());
  54. } else if (input.has_bytes()) {
  55. native_input = input.bytes();
  56. } else {
  57. return;
  58. }
  59. if (env.kDumpNativeInput)
  60. LOG(INFO) << "native_input: " << native_input;
  61. absl::optional<base::Value> value = base::JSONReader::Read(native_input);
  62. if (!value || !value->is_list())
  63. return;
  64. ++valid_json_count;
  65. // Parse the HostCache.
  66. constexpr size_t kMaxEntries = 1000;
  67. HostCache host_cache(kMaxEntries);
  68. if (!host_cache.RestoreFromListValue(value->GetList()))
  69. return;
  70. // Serialize the HostCache.
  71. base::Value::List serialized;
  72. host_cache.GetList(
  73. serialized /* entry_list */, true /* include_staleness */,
  74. HostCache::SerializationType::kRestorable /* serialization_type */);
  75. CHECK_EQ(*value, serialized);
  76. return;
  77. }
  78. } // namespace net