1 // Copyright 2016 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <stddef.h>
6 #include <stdint.h>
7
8 #include <random>
9 #include <string>
10
11 #include "libxml/parser.h"
12
13 #include "base/at_exit.h"
14 #include "base/command_line.h"
15 #include "base/functional/bind.h"
16 #include "base/i18n/icu_util.h"
17 #include "base/run_loop.h"
18 #include "base/task/single_thread_task_executor.h"
19 #include "components/search_engines/search_terms_data.h"
20 #include "components/search_engines/template_url.h"
21 #include "components/search_engines/template_url_parser.h"
22 #include "mojo/core/embedder/embedder.h"
23 #include "services/data_decoder/public/cpp/test_support/in_process_data_decoder.h"
24 #include "testing/libfuzzer/libfuzzer_exports.h"
25
PseudoRandomFilter(std::mt19937 * generator,std::uniform_int_distribution<uint16_t> * pool,const std::string &,const std::string &)26 bool PseudoRandomFilter(std::mt19937* generator,
27 std::uniform_int_distribution<uint16_t>* pool,
28 const std::string&,
29 const std::string&) {
30 // Return true 254/255 times, ie: as if pool only returned uint8_t.
31 return (*pool)(*generator) % (UINT8_MAX + 1);
32 }
33
34 struct FuzzerFixedParams {
35 uint32_t seed_;
36 };
37
38 base::AtExitManager at_exit_manager; // used by ICU integration
39
LLVMFuzzerInitialize(int * argc,char *** argv)40 extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
41 CHECK(base::i18n::InitializeICU());
42 CHECK(base::CommandLine::Init(*argc, *argv));
43 return 0;
44 }
45
ignore(void * ctx,const char * msg,...)46 void ignore(void* ctx, const char* msg, ...) {
47 // Error handler to avoid error message spam from libxml parser.
48 }
49
50 class Env {
51 public:
Env()52 Env() : executor_(base::MessagePumpType::IO) {
53 mojo::core::Init();
54 xmlSetGenericErrorFunc(nullptr, &ignore);
55 }
56
57 private:
58 base::SingleThreadTaskExecutor executor_;
59 data_decoder::test::InProcessDataDecoder data_decoder_;
60 };
61
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)62 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
63 static Env env;
64 if (size < sizeof(FuzzerFixedParams)) {
65 return 0;
66 }
67
68 const FuzzerFixedParams* params =
69 reinterpret_cast<const FuzzerFixedParams*>(data);
70 size -= sizeof(FuzzerFixedParams);
71
72 std::mt19937 generator(params->seed_);
73 // Use a uint16_t here instead of uint8_t because uniform_int_distribution
74 // does not support 8 bit types on Windows.
75 std::uniform_int_distribution<uint16_t> pool(0, 1);
76
77 base::RunLoop run_loop;
78
79 SearchTermsData search_terms_data;
80 std::string string_data(reinterpret_cast<const char*>(params + 1), size);
81 TemplateURLParser::ParameterFilter filter =
82 base::BindRepeating(&PseudoRandomFilter, base::Unretained(&generator),
83 base::Unretained(&pool));
84 TemplateURLParser::Parse(&search_terms_data, string_data, filter,
85 base::BindOnce(
86 [](base::OnceClosure quit_closure,
87 std::unique_ptr<TemplateURL> ignored) {
88 std::move(quit_closure).Run();
89 },
90 run_loop.QuitClosure()));
91
92 run_loop.Run();
93
94 return 0;
95 }
96