| // WARNING: This file is machine generated by fidlgen. |
| |
| #include <fidl/test/protocols/cpp/libfuzzer.h> |
| #include <lib/async-loop/cpp/loop.h> |
| #include <lib/async-loop/default.h> |
| #include <lib/fidl/cpp/fuzzing/fuzzer.h> |
| #include <lib/fidl/cpp/interface_ptr.h> |
| #include <lib/zx/channel.h> |
| #include <zircon/errors.h> |
| #include <zircon/syscalls.h> |
| #include <zircon/types.h> |
| |
| using namespace ::fuzzing; |
| using namespace ::fidl::test::protocols; |
| |
| // Add //build/fuzzing:fuzzing_verbose_logging to a GN target's configs to |
| // enable. |
| #if FUZZING_VERBOSE_LOGGING |
| #include <stdio.h> |
| #define xprintf(fmt...) printf(fmt) |
| #else |
| #define xprintf(fmt...) \ |
| do { \ |
| } while (0) |
| #endif |
| |
| extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data_, size_t size_) { |
| static ::async::Loop* loop_ = nullptr; |
| |
| if (loop_ == nullptr) { |
| xprintf("Starting client async loop\n"); |
| loop_ = new ::async::Loop(&kAsyncLoopConfigAttachToCurrentThread); |
| } |
| |
| // Must fuzz some protocol; first two bytes used to select protocol and |
| // method. |
| if (size_ < 2) { |
| xprintf("Early exit: Input too small: %zu\n", size_); |
| return 0; |
| } |
| size_ -= 2; |
| |
| uint8_t protocol_selector_ = data_[0]; |
| uint8_t protocol_selection_ = protocol_selector_ % 4; |
| |
| xprintf("Starting fuzzer with %zu bytes of data\n", size_); |
| |
| // Hardcode mutually-exclusive if blocks that selects exactly one protocol. |
| zx_status_t status_; |
| if (protocol_selection_ == 0) { |
| #if !defined(PROTOCOL_fidl_test_protocols_Transitional) |
| // Selected protocol from FIDL file that is not part of this fuzzer. |
| xprintf( |
| "Early exit: Chose disabled protocol: " |
| "fidl_test_protocols_Transitional\n"); |
| return 0; |
| #else |
| |
| ::fidl::InterfacePtr< ::fidl::test::protocols::Transitional> protocol_; |
| |
| xprintf("Starting fidl_test_protocols_Transitional service\n"); |
| ::fidl::fuzzing::Fuzzer< ::fidl::test::protocols::Transitional> fuzzer_( |
| loop_->dispatcher()); |
| if ((status_ = fuzzer_.Init()) != ZX_OK) { |
| xprintf("Early exit: fuzzer.Init returned bad status: %d\n", status_); |
| return 0; |
| } |
| |
| if ((status_ = fuzzer_.BindService()) != ZX_OK) { |
| xprintf("Early exit: fuzzer.BindService returned bad status: %d\n", |
| status_); |
| return 0; |
| } |
| |
| if ((status_ = fuzzer_.BindClient(&protocol_, loop_->dispatcher())) != |
| ZX_OK) { |
| xprintf("Early exit: fuzzer.BindClient returned bad status: %d\n", |
| status_); |
| return 0; |
| } |
| |
| FuzzInput src_(data_, size_); |
| |
| uint8_t method_selector_ = data_[1]; |
| uint8_t method_selection_ = method_selector_ % 3; |
| if (method_selection_ == 0) { |
| #if !(ALL_METHODS || defined(METHOD_Request)) |
| // Selected method from protocol that is not part of this fuzzer. |
| xprintf("Early exit: Chose disabled method: Request\n"); |
| return 0; |
| #else |
| const size_t min_size_ = MinSize<int64_t>(); |
| |
| // Must have enough bytes for input. |
| if (size_ < min_size_) { |
| xprintf("Early exit: Input size too small: %zu < %zu\n", size_, |
| min_size_); |
| return 0; |
| } |
| |
| const size_t slack_size_ = size_ - min_size_; |
| const size_t slack_size_per_param = slack_size_ / 1; |
| |
| xprintf("Allocating parameters with %zu bytes (%zu bytes each)\n", |
| slack_size_, slack_size_per_param); |
| |
| size_t param_size_; |
| param_size_ = MinSize<int64_t>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for int64_t x\n", param_size_); |
| int64_t x = Allocate<int64_t>{}(&src_, ¶m_size_); |
| |
| xprintf("Invoking method fidl_test_protocols_Transitional.Request\n"); |
| protocol_->Request( |
| std::move(x), |
| [signaller = fuzzer_.NewCallbackSignaller()](int64_t y) { |
| xprintf("Invoked fidl_test_protocols_Transitional.Request\n"); |
| zx_status_t status_ = signaller.SignalCallback(); |
| if (status_ != ZX_OK) { |
| xprintf("signaller.SignalCallback returned bad status: %d\n", |
| status_); |
| } |
| }); |
| #endif |
| } |
| if (method_selection_ == 1) { |
| #if !(ALL_METHODS || defined(METHOD_OneWay)) |
| // Selected method from protocol that is not part of this fuzzer. |
| xprintf("Early exit: Chose disabled method: OneWay\n"); |
| return 0; |
| #else |
| const size_t min_size_ = MinSize<int64_t>(); |
| |
| // Must have enough bytes for input. |
| if (size_ < min_size_) { |
| xprintf("Early exit: Input size too small: %zu < %zu\n", size_, |
| min_size_); |
| return 0; |
| } |
| |
| const size_t slack_size_ = size_ - min_size_; |
| const size_t slack_size_per_param = slack_size_ / 1; |
| |
| xprintf("Allocating parameters with %zu bytes (%zu bytes each)\n", |
| slack_size_, slack_size_per_param); |
| |
| size_t param_size_; |
| param_size_ = MinSize<int64_t>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for int64_t x\n", param_size_); |
| int64_t x = Allocate<int64_t>{}(&src_, ¶m_size_); |
| |
| xprintf("Invoking method fidl_test_protocols_Transitional.OneWay\n"); |
| protocol_->OneWay(std::move(x)); |
| #endif |
| } |
| |
| loop_->RunUntilIdle(); |
| |
| if ((status_ = fuzzer_.WaitForCallback()) != ZX_OK) { |
| xprintf("fuzzer.WaitForCallback returned bad status: %d\n", status_); |
| } |
| |
| protocol_.Unbind(); |
| #endif |
| } |
| if (protocol_selection_ == 1) { |
| #if !defined(PROTOCOL_fidl_test_protocols_ChannelProtocol) |
| // Selected protocol from FIDL file that is not part of this fuzzer. |
| xprintf( |
| "Early exit: Chose disabled protocol: " |
| "fidl_test_protocols_ChannelProtocol\n"); |
| return 0; |
| #else |
| |
| ::fidl::InterfacePtr< ::fidl::test::protocols::ChannelProtocol> protocol_; |
| |
| xprintf("Starting fidl_test_protocols_ChannelProtocol service\n"); |
| ::fidl::fuzzing::Fuzzer< ::fidl::test::protocols::ChannelProtocol> fuzzer_( |
| loop_->dispatcher()); |
| if ((status_ = fuzzer_.Init()) != ZX_OK) { |
| xprintf("Early exit: fuzzer.Init returned bad status: %d\n", status_); |
| return 0; |
| } |
| |
| if ((status_ = fuzzer_.BindService()) != ZX_OK) { |
| xprintf("Early exit: fuzzer.BindService returned bad status: %d\n", |
| status_); |
| return 0; |
| } |
| |
| if ((status_ = fuzzer_.BindClient(&protocol_, loop_->dispatcher())) != |
| ZX_OK) { |
| xprintf("Early exit: fuzzer.BindClient returned bad status: %d\n", |
| status_); |
| return 0; |
| } |
| |
| FuzzInput src_(data_, size_); |
| |
| uint8_t method_selector_ = data_[1]; |
| uint8_t method_selection_ = method_selector_ % 5; |
| if (method_selection_ == 0) { |
| #if !(ALL_METHODS || defined(METHOD_MethodA)) |
| // Selected method from protocol that is not part of this fuzzer. |
| xprintf("Early exit: Chose disabled method: MethodA\n"); |
| return 0; |
| #else |
| const size_t min_size_ = MinSize<int64_t>() + MinSize<int64_t>(); |
| |
| // Must have enough bytes for input. |
| if (size_ < min_size_) { |
| xprintf("Early exit: Input size too small: %zu < %zu\n", size_, |
| min_size_); |
| return 0; |
| } |
| |
| const size_t slack_size_ = size_ - min_size_; |
| const size_t slack_size_per_param = slack_size_ / 2; |
| |
| xprintf("Allocating parameters with %zu bytes (%zu bytes each)\n", |
| slack_size_, slack_size_per_param); |
| |
| size_t param_size_; |
| param_size_ = MinSize<int64_t>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for int64_t a\n", param_size_); |
| int64_t a = Allocate<int64_t>{}(&src_, ¶m_size_); |
| param_size_ = MinSize<int64_t>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for int64_t b\n", param_size_); |
| int64_t b = Allocate<int64_t>{}(&src_, ¶m_size_); |
| |
| xprintf("Invoking method fidl_test_protocols_ChannelProtocol.MethodA\n"); |
| protocol_->MethodA(std::move(a), std::move(b)); |
| #endif |
| } |
| if (method_selection_ == 2) { |
| #if !(ALL_METHODS || defined(METHOD_MethodB)) |
| // Selected method from protocol that is not part of this fuzzer. |
| xprintf("Early exit: Chose disabled method: MethodB\n"); |
| return 0; |
| #else |
| const size_t min_size_ = MinSize<int64_t>() + MinSize<int64_t>(); |
| |
| // Must have enough bytes for input. |
| if (size_ < min_size_) { |
| xprintf("Early exit: Input size too small: %zu < %zu\n", size_, |
| min_size_); |
| return 0; |
| } |
| |
| const size_t slack_size_ = size_ - min_size_; |
| const size_t slack_size_per_param = slack_size_ / 2; |
| |
| xprintf("Allocating parameters with %zu bytes (%zu bytes each)\n", |
| slack_size_, slack_size_per_param); |
| |
| size_t param_size_; |
| param_size_ = MinSize<int64_t>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for int64_t a\n", param_size_); |
| int64_t a = Allocate<int64_t>{}(&src_, ¶m_size_); |
| param_size_ = MinSize<int64_t>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for int64_t b\n", param_size_); |
| int64_t b = Allocate<int64_t>{}(&src_, ¶m_size_); |
| |
| xprintf("Invoking method fidl_test_protocols_ChannelProtocol.MethodB\n"); |
| protocol_->MethodB( |
| std::move(a), std::move(b), |
| [signaller = fuzzer_.NewCallbackSignaller()](int64_t result) { |
| xprintf("Invoked fidl_test_protocols_ChannelProtocol.MethodB\n"); |
| zx_status_t status_ = signaller.SignalCallback(); |
| if (status_ != ZX_OK) { |
| xprintf("signaller.SignalCallback returned bad status: %d\n", |
| status_); |
| } |
| }); |
| #endif |
| } |
| if (method_selection_ == 3) { |
| #if !(ALL_METHODS || defined(METHOD_TakeHandle)) |
| // Selected method from protocol that is not part of this fuzzer. |
| xprintf("Early exit: Chose disabled method: TakeHandle\n"); |
| return 0; |
| #else |
| const size_t min_size_ = MinSize< ::zx::handle>(); |
| |
| // Must have enough bytes for input. |
| if (size_ < min_size_) { |
| xprintf("Early exit: Input size too small: %zu < %zu\n", size_, |
| min_size_); |
| return 0; |
| } |
| |
| const size_t slack_size_ = size_ - min_size_; |
| const size_t slack_size_per_param = slack_size_ / 1; |
| |
| xprintf("Allocating parameters with %zu bytes (%zu bytes each)\n", |
| slack_size_, slack_size_per_param); |
| |
| size_t param_size_; |
| param_size_ = MinSize< ::zx::handle>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for ::zx::handle h\n", param_size_); |
| ::zx::handle h = Allocate< ::zx::handle>{}(&src_, ¶m_size_); |
| |
| xprintf( |
| "Invoking method fidl_test_protocols_ChannelProtocol.TakeHandle\n"); |
| protocol_->TakeHandle(std::move(h)); |
| #endif |
| } |
| if (method_selection_ == 4) { |
| #if !(ALL_METHODS || defined(METHOD_MutateSocket)) |
| // Selected method from protocol that is not part of this fuzzer. |
| xprintf("Early exit: Chose disabled method: MutateSocket\n"); |
| return 0; |
| #else |
| const size_t min_size_ = MinSize< ::zx::socket>(); |
| |
| // Must have enough bytes for input. |
| if (size_ < min_size_) { |
| xprintf("Early exit: Input size too small: %zu < %zu\n", size_, |
| min_size_); |
| return 0; |
| } |
| |
| const size_t slack_size_ = size_ - min_size_; |
| const size_t slack_size_per_param = slack_size_ / 1; |
| |
| xprintf("Allocating parameters with %zu bytes (%zu bytes each)\n", |
| slack_size_, slack_size_per_param); |
| |
| size_t param_size_; |
| param_size_ = MinSize< ::zx::socket>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for ::zx::socket a\n", param_size_); |
| ::zx::socket a = Allocate< ::zx::socket>{}(&src_, ¶m_size_); |
| |
| xprintf( |
| "Invoking method fidl_test_protocols_ChannelProtocol.MutateSocket\n"); |
| protocol_->MutateSocket( |
| std::move(a), |
| [signaller = fuzzer_.NewCallbackSignaller()](::zx::socket b) { |
| xprintf( |
| "Invoked fidl_test_protocols_ChannelProtocol.MutateSocket\n"); |
| zx_status_t status_ = signaller.SignalCallback(); |
| if (status_ != ZX_OK) { |
| xprintf("signaller.SignalCallback returned bad status: %d\n", |
| status_); |
| } |
| }); |
| #endif |
| } |
| |
| loop_->RunUntilIdle(); |
| |
| if ((status_ = fuzzer_.WaitForCallback()) != ZX_OK) { |
| xprintf("fuzzer.WaitForCallback returned bad status: %d\n", status_); |
| } |
| |
| protocol_.Unbind(); |
| #endif |
| } |
| if (protocol_selection_ == 2) { |
| #if !defined(PROTOCOL_fidl_test_protocols_WithAndWithoutRequestResponse) |
| // Selected protocol from FIDL file that is not part of this fuzzer. |
| xprintf( |
| "Early exit: Chose disabled protocol: " |
| "fidl_test_protocols_WithAndWithoutRequestResponse\n"); |
| return 0; |
| #else |
| |
| ::fidl::InterfacePtr< |
| ::fidl::test::protocols::WithAndWithoutRequestResponse> |
| protocol_; |
| |
| xprintf( |
| "Starting fidl_test_protocols_WithAndWithoutRequestResponse service\n"); |
| ::fidl::fuzzing::Fuzzer< |
| ::fidl::test::protocols::WithAndWithoutRequestResponse> |
| fuzzer_(loop_->dispatcher()); |
| if ((status_ = fuzzer_.Init()) != ZX_OK) { |
| xprintf("Early exit: fuzzer.Init returned bad status: %d\n", status_); |
| return 0; |
| } |
| |
| if ((status_ = fuzzer_.BindService()) != ZX_OK) { |
| xprintf("Early exit: fuzzer.BindService returned bad status: %d\n", |
| status_); |
| return 0; |
| } |
| |
| if ((status_ = fuzzer_.BindClient(&protocol_, loop_->dispatcher())) != |
| ZX_OK) { |
| xprintf("Early exit: fuzzer.BindClient returned bad status: %d\n", |
| status_); |
| return 0; |
| } |
| |
| FuzzInput src_(data_, size_); |
| |
| uint8_t method_selector_ = data_[1]; |
| uint8_t method_selection_ = method_selector_ % 8; |
| if (method_selection_ == 3) { |
| #if !(ALL_METHODS || defined(METHOD_WithRequestNoResponse)) |
| // Selected method from protocol that is not part of this fuzzer. |
| xprintf("Early exit: Chose disabled method: WithRequestNoResponse\n"); |
| return 0; |
| #else |
| const size_t min_size_ = MinSize< ::std::string>(); |
| |
| // Must have enough bytes for input. |
| if (size_ < min_size_) { |
| xprintf("Early exit: Input size too small: %zu < %zu\n", size_, |
| min_size_); |
| return 0; |
| } |
| |
| const size_t slack_size_ = size_ - min_size_; |
| const size_t slack_size_per_param = slack_size_ / 1; |
| |
| xprintf("Allocating parameters with %zu bytes (%zu bytes each)\n", |
| slack_size_, slack_size_per_param); |
| |
| size_t param_size_; |
| param_size_ = MinSize< ::std::string>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for ::std::string arg\n", param_size_); |
| ::std::string arg = Allocate< ::std::string>{}(&src_, ¶m_size_); |
| |
| xprintf( |
| "Invoking method " |
| "fidl_test_protocols_WithAndWithoutRequestResponse." |
| "WithRequestNoResponse\n"); |
| protocol_->WithRequestNoResponse(std::move(arg)); |
| #endif |
| } |
| if (method_selection_ == 4) { |
| #if !(ALL_METHODS || defined(METHOD_WithRequestEmptyResponse)) |
| // Selected method from protocol that is not part of this fuzzer. |
| xprintf("Early exit: Chose disabled method: WithRequestEmptyResponse\n"); |
| return 0; |
| #else |
| const size_t min_size_ = MinSize< ::std::string>(); |
| |
| // Must have enough bytes for input. |
| if (size_ < min_size_) { |
| xprintf("Early exit: Input size too small: %zu < %zu\n", size_, |
| min_size_); |
| return 0; |
| } |
| |
| const size_t slack_size_ = size_ - min_size_; |
| const size_t slack_size_per_param = slack_size_ / 1; |
| |
| xprintf("Allocating parameters with %zu bytes (%zu bytes each)\n", |
| slack_size_, slack_size_per_param); |
| |
| size_t param_size_; |
| param_size_ = MinSize< ::std::string>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for ::std::string arg\n", param_size_); |
| ::std::string arg = Allocate< ::std::string>{}(&src_, ¶m_size_); |
| |
| xprintf( |
| "Invoking method " |
| "fidl_test_protocols_WithAndWithoutRequestResponse." |
| "WithRequestEmptyResponse\n"); |
| protocol_->WithRequestEmptyResponse(std::move(arg)); |
| #endif |
| } |
| if (method_selection_ == 5) { |
| #if !(ALL_METHODS || defined(METHOD_WithRequestWithResponse)) |
| // Selected method from protocol that is not part of this fuzzer. |
| xprintf("Early exit: Chose disabled method: WithRequestWithResponse\n"); |
| return 0; |
| #else |
| const size_t min_size_ = MinSize< ::std::string>(); |
| |
| // Must have enough bytes for input. |
| if (size_ < min_size_) { |
| xprintf("Early exit: Input size too small: %zu < %zu\n", size_, |
| min_size_); |
| return 0; |
| } |
| |
| const size_t slack_size_ = size_ - min_size_; |
| const size_t slack_size_per_param = slack_size_ / 1; |
| |
| xprintf("Allocating parameters with %zu bytes (%zu bytes each)\n", |
| slack_size_, slack_size_per_param); |
| |
| size_t param_size_; |
| param_size_ = MinSize< ::std::string>() + slack_size_per_param; |
| xprintf("Allocating %zu bytes for ::std::string arg\n", param_size_); |
| ::std::string arg = Allocate< ::std::string>{}(&src_, ¶m_size_); |
| |
| xprintf( |
| "Invoking method " |
| "fidl_test_protocols_WithAndWithoutRequestResponse." |
| "WithRequestWithResponse\n"); |
| protocol_->WithRequestWithResponse( |
| std::move(arg), |
| [signaller = fuzzer_.NewCallbackSignaller()](::std::string ret) { |
| xprintf( |
| "Invoked " |
| "fidl_test_protocols_WithAndWithoutRequestResponse." |
| "WithRequestWithResponse\n"); |
| zx_status_t status_ = signaller.SignalCallback(); |
| if (status_ != ZX_OK) { |
| xprintf("signaller.SignalCallback returned bad status: %d\n", |
| status_); |
| } |
| }); |
| #endif |
| } |
| |
| loop_->RunUntilIdle(); |
| |
| if ((status_ = fuzzer_.WaitForCallback()) != ZX_OK) { |
| xprintf("fuzzer.WaitForCallback returned bad status: %d\n", status_); |
| } |
| |
| protocol_.Unbind(); |
| #endif |
| } |
| if (protocol_selection_ == 3) { |
| #if !defined(PROTOCOL_fidl_test_protocols_WithErrorSyntax) |
| // Selected protocol from FIDL file that is not part of this fuzzer. |
| xprintf( |
| "Early exit: Chose disabled protocol: " |
| "fidl_test_protocols_WithErrorSyntax\n"); |
| return 0; |
| #else |
| |
| ::fidl::InterfacePtr< ::fidl::test::protocols::WithErrorSyntax> protocol_; |
| |
| xprintf("Starting fidl_test_protocols_WithErrorSyntax service\n"); |
| ::fidl::fuzzing::Fuzzer< ::fidl::test::protocols::WithErrorSyntax> fuzzer_( |
| loop_->dispatcher()); |
| if ((status_ = fuzzer_.Init()) != ZX_OK) { |
| xprintf("Early exit: fuzzer.Init returned bad status: %d\n", status_); |
| return 0; |
| } |
| |
| if ((status_ = fuzzer_.BindService()) != ZX_OK) { |
| xprintf("Early exit: fuzzer.BindService returned bad status: %d\n", |
| status_); |
| return 0; |
| } |
| |
| if ((status_ = fuzzer_.BindClient(&protocol_, loop_->dispatcher())) != |
| ZX_OK) { |
| xprintf("Early exit: fuzzer.BindClient returned bad status: %d\n", |
| status_); |
| return 0; |
| } |
| |
| FuzzInput src_(data_, size_); |
| |
| uint8_t method_selector_ = data_[1]; |
| uint8_t method_selection_ = method_selector_ % 3; |
| |
| loop_->RunUntilIdle(); |
| |
| if ((status_ = fuzzer_.WaitForCallback()) != ZX_OK) { |
| xprintf("fuzzer.WaitForCallback returned bad status: %d\n", status_); |
| } |
| |
| protocol_.Unbind(); |
| #endif |
| } |
| |
| xprintf("Fuzzer stopped!\n"); |
| |
| return 0; |
| } |