// Copyright 2019 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <fuzzer/FuzzedDataProvider.h>
#include <cstddef>
#include <cstdint>
#include <map>
#include <string>
#include <vector>
#include "base/functional/bind.h"
#include "base/memory/raw_ptr.h"
#include "base/task/sequenced_task_runner.h"
#include "base/test/task_environment.h"
#include "chrome/browser/ash/printing/zeroconf_printer_detector.h"
#include "chrome/browser/local_discovery/service_discovery_device_lister.h"
namespace {
// Describes a single call to ZeroconfDetector.
struct CallToDelegate {
// method to call
enum CallType {
kOnDeviceChanged = 0,
kOnDeviceRemoved = 1,
kOnDeviceCacheFlushed = 2,
kMaxValue = 2
} call_type;
// parameters (depends on |call_type|)
bool added;
local_discovery::ServiceDescription description;
};
// Shortcut for a map of unique_ptr<ServiceDiscoveryDeviceLister>.
// The key is a name of a service type.
using MapOfListers =
std::map<std::string,
std::unique_ptr<local_discovery::ServiceDiscoveryDeviceLister>>;
// Objects of this class fuzzes ZeroconfDetector by calling methods from
// local_discovery::ServiceDiscoveryDeviceLister::Delegate interface.
class FuzzDeviceLister : public local_discovery::ServiceDiscoveryDeviceLister {
public:
// |calls| contains definition of calls to made in reverse order.
FuzzDeviceLister(const std::string& service_type,
const std::vector<CallToDelegate>& calls)
: service_type_(service_type), calls_(calls) {}
~FuzzDeviceLister() override = default;
// Sets a pointer to ZeroconfDetector object and starts fuzzing it.
void SetDelegate(
local_discovery::ServiceDiscoveryDeviceLister::Delegate* delegate) {
delegate_ = delegate;
base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
FROM_HERE, base::BindOnce(&FuzzDeviceLister::CallDelegate,
base::Unretained(this)));
}
void Start() override {}
void DiscoverNewDevices() override {}
const std::string& service_type() const override { return service_type_; }
private:
// Executes single call to
// local_discovery::ServiceDiscoveryDeviceLister::Delegate interface.
// This method schedules for execution last call from calls_, removes it from
// calls_ and at the end schedules itself for execution. It does nothing
// when calls_ is empty.
void CallDelegate() {
if (calls_.empty())
return;
const CallToDelegate call = calls_.back();
calls_.pop_back();
switch (call.call_type) {
case CallToDelegate::kOnDeviceChanged:
base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
FROM_HERE,
base::BindOnce(&local_discovery::ServiceDiscoveryDeviceLister::
Delegate::OnDeviceChanged,
base::Unretained(delegate_), service_type_,
call.added, call.description));
break;
case CallToDelegate::kOnDeviceRemoved:
base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
FROM_HERE,
base::BindOnce(&local_discovery::ServiceDiscoveryDeviceLister::
Delegate::OnDeviceRemoved,
base::Unretained(delegate_), service_type_,
call.description.service_name));
break;
case CallToDelegate::kOnDeviceCacheFlushed:
base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
FROM_HERE,
base::BindOnce(&local_discovery::ServiceDiscoveryDeviceLister::
Delegate::OnDeviceCacheFlushed,
base::Unretained(delegate_), service_type_));
break;
}
base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
FROM_HERE, base::BindOnce(&FuzzDeviceLister::CallDelegate,
base::Unretained(this)));
}
raw_ptr<local_discovery::ServiceDiscoveryDeviceLister::Delegate> delegate_ =
nullptr;
std::string service_type_;
std::vector<CallToDelegate> calls_;
};
// Helper for creating a lister.
void CreateLister(const std::string& service_type,
const std::vector<CallToDelegate>& calls,
MapOfListers* listers) {
std::unique_ptr<FuzzDeviceLister> fuzz_lister =
std::make_unique<FuzzDeviceLister>(service_type, std::move(calls));
listers->emplace(service_type, std::move(fuzz_lister));
}
// Helper for creating a vector of (fuzzing) calls to make.
std::vector<CallToDelegate> CreateFuzzCalls(FuzzedDataProvider* fuzz_data) {
// local function to generate random int
auto RandInt = [fuzz_data](int min, int max) -> int {
return fuzz_data->ConsumeIntegralInRange(min, max);
};
// local function to generate random string with random length
auto RandStr = [fuzz_data](size_t max_length) -> std::string {
return fuzz_data->ConsumeRandomLengthString(max_length);
};
// fuzzing parameters
constexpr size_t kMaxNumberOfCalls = 100;
constexpr size_t kMaxNameLength = 1000;
constexpr size_t kMaxMetadataEntriesCount = 1000;
constexpr size_t kMaxMetadataEntryLength = 1000;
// an array of fuzzing calls
std::vector<CallToDelegate> calls(RandInt(0, kMaxNumberOfCalls));
// in this array we store names of created services
std::vector<std::string> names_history;
names_history.reserve(calls.size() / 2);
// generates random fuzzing calls
for (auto& call : calls) {
call.call_type = static_cast<CallToDelegate::CallType>(
RandInt(0, CallToDelegate::CallType::kMaxValue));
switch (call.call_type) {
case CallToDelegate::kOnDeviceChanged:
call.description.service_name = RandStr(kMaxNameLength);
call.description.metadata.resize(RandInt(0, kMaxMetadataEntriesCount));
for (auto& text : call.description.metadata)
text = RandStr(kMaxMetadataEntryLength);
names_history.push_back(call.description.service_name);
break;
case CallToDelegate::kOnDeviceRemoved:
// in 10% of cases random string is used as service name, in the rest
// 90% one of the name is picked from names_history
if (names_history.empty() || RandInt(0, 9) == 0) {
call.description.service_name = RandStr(kMaxNameLength);
} else {
const int n = names_history.size();
call.description.service_name = names_history[RandInt(0, n - 1)];
}
break;
case CallToDelegate::kOnDeviceCacheFlushed:
break;
}
}
return calls;
}
} // namespace
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
base::test::TaskEnvironment task_environment;
FuzzedDataProvider fuzz_data(data, size);
// Creating listers in similar way as in "standard" constructor of
// ZeroconfPrinterDetector.
MapOfListers listers;
std::vector<CallToDelegate> calls = CreateFuzzCalls(&fuzz_data);
CreateLister(ash::ZeroconfPrinterDetector::kIppServiceName, calls, &listers);
CreateLister(ash::ZeroconfPrinterDetector::kIppsServiceName, calls, &listers);
CreateLister(ash::ZeroconfPrinterDetector::kIppEverywhereServiceName, calls,
&listers);
CreateLister(ash::ZeroconfPrinterDetector::kIppsEverywhereServiceName, calls,
&listers);
// Creating an object of ZeroconfPrinterDetector to fuzz.
auto detector = ash::ZeroconfPrinterDetector::CreateForTesting(
&listers, /*ipp_reject_list=*/{});
for (auto& lf : listers) {
static_cast<FuzzDeviceLister*>(lf.second.get())
->SetDelegate(detector.get());
}
// Fuzzing.
task_environment.RunUntilIdle();
return 0;
}
Codebase Browser
chromium