1 // Copyright 2015 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include <stddef.h> 6 #include <stdint.h> 7 8 #include <algorithm> 9 #include <vector> 10 11 #include "net/http/http_chunked_decoder.h" 12 13 // Entry point for LibFuzzer. LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)14extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 15 const char* data_ptr = reinterpret_cast<const char*>(data); 16 net::HttpChunkedDecoder decoder; 17 18 // Feed data to decoder.FilterBuf() by blocks of "random" size. 19 size_t block_size = 0; 20 for (size_t offset = 0; offset < size; offset += block_size) { 21 // Since there is no input for block_size values, but it should be strictly 22 // determined, let's calculate these values using a couple of data bytes. 23 uint8_t temp_block_size = data[offset] ^ data[size - offset - 1]; 24 25 // Let temp_block_size be in range from 0 to 0x3F (0b00111111). 26 temp_block_size &= 0x3F; 27 28 // XOR with previous block size to get different values for different data. 29 block_size ^= temp_block_size; 30 31 // Prevent infinite loop if block_size == 0. 32 block_size = std::max(block_size, static_cast<size_t>(1)); 33 34 // Prevent out-of-bounds access. 35 block_size = std::min(block_size, size - offset); 36 37 // Create new buffer with current block of data and feed it to the decoder. 38 std::vector<char> buffer(data_ptr + offset, data_ptr + offset + block_size); 39 int result = decoder.FilterBuf(buffer.data(), buffer.size()); 40 if (result < 0) 41 return 0; 42 } 43 44 return 0; 45 } 46