url_request_fuzzer.cc 2.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/url_request/url_request.h"
  5. #include <stddef.h>
  6. #include <stdint.h>
  7. #include <fuzzer/FuzzedDataProvider.h>
  8. #include <memory>
  9. #include "base/run_loop.h"
  10. #include "net/base/request_priority.h"
  11. #include "net/socket/fuzzed_socket_factory.h"
  12. #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
  13. #include "net/url_request/url_request.h"
  14. #include "net/url_request/url_request_context.h"
  15. #include "net/url_request/url_request_context_builder.h"
  16. #include "net/url_request/url_request_test_util.h"
  17. #include "url/gurl.h"
  18. // Restrict max input length to reject too long inputs that can be too slow to
  19. // process and may lead to an unbounded corpus growth.
  20. const size_t kMaxInputSize = 65536 + 257;
  21. // Integration fuzzer for URLRequest's handling of HTTP requests. Can follow
  22. // redirects, both on the same server (using a new socket or the old one) and
  23. // across servers.
  24. // TODO(mmenke): Add support for testing HTTPS, auth, proxies, uploading,
  25. // cancelation, deferring reads / redirects, using preconnected sockets, SPDY,
  26. // QUIC, DNS failures (they all currently resolve to localhost), IPv6 DNS
  27. // results, URLs with IPs instead of hostnames (v4 and v6), etc.
  28. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  29. if (size > kMaxInputSize)
  30. return 0;
  31. FuzzedDataProvider data_provider(data, size);
  32. auto context_builder = net::CreateTestURLRequestContextBuilder();
  33. net::FuzzedSocketFactory fuzzed_socket_factory(&data_provider);
  34. context_builder->set_client_socket_factory_for_testing(
  35. &fuzzed_socket_factory);
  36. auto url_request_context = context_builder->Build();
  37. net::TestDelegate delegate;
  38. std::unique_ptr<net::URLRequest> url_request(
  39. url_request_context->CreateRequest(GURL("http://foo/"),
  40. net::DEFAULT_PRIORITY, &delegate,
  41. TRAFFIC_ANNOTATION_FOR_TESTS));
  42. url_request->Start();
  43. // TestDelegate quits the message loop on completion.
  44. base::RunLoop().Run();
  45. return 0;
  46. }