http_chunked_decoder_fuzzer.cc 1.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445
  1. // Copyright 2015 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <stddef.h>
  5. #include <stdint.h>
  6. #include <algorithm>
  7. #include <vector>
  8. #include "net/http/http_chunked_decoder.h"
  9. // Entry point for LibFuzzer.
  10. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  11. const char* data_ptr = reinterpret_cast<const char*>(data);
  12. net::HttpChunkedDecoder decoder;
  13. // Feed data to decoder.FilterBuf() by blocks of "random" size.
  14. size_t block_size = 0;
  15. for (size_t offset = 0; offset < size; offset += block_size) {
  16. // Since there is no input for block_size values, but it should be strictly
  17. // determined, let's calculate these values using a couple of data bytes.
  18. uint8_t temp_block_size = data[offset] ^ data[size - offset - 1];
  19. // Let temp_block_size be in range from 0 to 0x3F (0b00111111).
  20. temp_block_size &= 0x3F;
  21. // XOR with previous block size to get different values for different data.
  22. block_size ^= temp_block_size;
  23. // Prevent infinite loop if block_size == 0.
  24. block_size = std::max(block_size, static_cast<size_t>(1));
  25. // Prevent out-of-bounds access.
  26. block_size = std::min(block_size, size - offset);
  27. // Create new buffer with current block of data and feed it to the decoder.
  28. std::vector<char> buffer(data_ptr + offset, data_ptr + offset + block_size);
  29. int result = decoder.FilterBuf(buffer.data(), buffer.size());
  30. if (result < 0)
  31. return 0;
  32. }
  33. return 0;
  34. }