Skip to content

Commit 3991186

Browse files
Xiaochu Liuchrome-bot
Xiaochu Liu
authored and
chrome-bot
committed
update_engine: add omaha_request_action_fuzzer target
It fuzzes the XML response sent from Omaha. It also refactored .gyp file to separate fake*/mock* libraries from unittest* themselves. BUG=chromium:906815 TEST=cros_fuzz Change-Id: Ic7d0e7d18784e48f4e43b538f9797e5d2d452d08 Reviewed-on: https://chromium-review.googlesource.com/1344914 Commit-Ready: Xiaochu Liu <[email protected]> Tested-by: Xiaochu Liu <[email protected]> Reviewed-by: Amin Hassani <[email protected]>
1 parent e318392 commit 3991186

File tree

3 files changed

+230
-10
lines changed

3 files changed

+230
-10
lines changed

‎fuzz/xml.dict

+125
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
#
2+
# AFL dictionary for XML
3+
# ----------------------
4+
#
5+
# Several basic syntax elements and attributes, modeled on libxml2.
6+
#
7+
# Created by Michal Zalewski <[email protected]>
8+
#
9+
10+
attr_encoding=" encoding=\"1\""
11+
attr_generic=" a=\"1\""
12+
attr_href=" href=\"1\""
13+
attr_standalone=" standalone=\"no\""
14+
attr_version=" version=\"1\""
15+
attr_xml_base=" xml:base=\"1\""
16+
attr_xml_id=" xml:id=\"1\""
17+
attr_xml_lang=" xml:lang=\"1\""
18+
attr_xml_space=" xml:space=\"1\""
19+
attr_xmlns=" xmlns=\"1\""
20+
21+
entity_builtin="&lt;"
22+
entity_decimal="&#1;"
23+
entity_external="&a;"
24+
entity_hex="&#x1;"
25+
26+
# keywords
27+
"ANY"
28+
"ATTLIST"
29+
"CDATA"
30+
"DOCTYPE"
31+
"ELEMENT"
32+
"EMPTY"
33+
"ENTITIES"
34+
"ENTITY"
35+
"FIXED"
36+
"ID"
37+
"IDREF"
38+
"IDREFS"
39+
"IGNORE"
40+
"IMPLIED"
41+
"INCLUDE"
42+
"NDATA"
43+
"NMTOKEN"
44+
"NMTOKENS"
45+
"NOTATION"
46+
"PCDATA"
47+
"PUBLIC"
48+
"REQUIRED"
49+
"SYSTEM"
50+
51+
# Various tag parts
52+
"<"
53+
">"
54+
"/>"
55+
"</"
56+
"<?"
57+
"?>"
58+
"<!"
59+
"!>"
60+
"[]"
61+
"]]"
62+
"<![CDATA["
63+
"<![CDATA[]]>"
64+
"\"\""
65+
"''"
66+
"=\"\""
67+
"=''"
68+
69+
# DTD
70+
"<!ATTLIST"
71+
"<!DOCTYPE"
72+
"<!ELEMENT"
73+
"<!ENTITY"
74+
"<![IGNORE["
75+
"<![INCLUDE["
76+
"<!NOTATION"
77+
"#CDATA"
78+
"#FIXED"
79+
"#IMPLIED"
80+
"#PCDATA"
81+
"#REQUIRED"
82+
83+
# Encodings
84+
"ISO-8859-1"
85+
"US-ASCII"
86+
"UTF-8"
87+
"UTF-16"
88+
"UTF-16BE"
89+
"UTF-16LE"
90+
91+
# Namespaces and schemas
92+
"xmlns"
93+
"xmlns:"
94+
"xmlns:xhtml=\"http://www.w3.org/1999/xhtml\""
95+
"xmlns:xml=\"http://www.w3.org/XML/1998/namespace\""
96+
"xmlns:xmlns=\"http://www.w3.org/2000/xmlns\""
97+
98+
string_col_fallback=":fallback"
99+
string_col_generic=":a"
100+
string_col_include=":include"
101+
string_dashes="--"
102+
string_parentheses="()"
103+
string_percent="%a"
104+
string_schema=":schema"
105+
string_ucs4="UCS-4"
106+
tag_close="</a>"
107+
tag_open="<a>"
108+
tag_open_close="<a />"
109+
110+
111+
"<?xml?>"
112+
"http://docboo"
113+
"http://www.w"
114+
"he30"
115+
"he2"
116+
"IET"
117+
"FDF-10"
118+
"aDUCS-4OPveb:"
119+
"a>"
120+
"UT"
121+
"xMl"
122+
"/usr/share/sg"
123+
"ha07"
124+
"http://www.oa"
125+
"cle"

‎omaha_request_action_fuzzer.cc

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
//
2+
// Copyright (C) 2018 The Android Open Source Project
3+
//
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
//
8+
// http://www.apache.org/licenses/LICENSE-2.0
9+
//
10+
// Unless required by applicable law or agreed to in writing, software
11+
// distributed under the License is distributed on an "AS IS" BASIS,
12+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
// See the License for the specific language governing permissions and
14+
// limitations under the License.
15+
//
16+
17+
#include <brillo/message_loops/fake_message_loop.h>
18+
19+
#include "update_engine/common/mock_http_fetcher.h"
20+
#include "update_engine/common/test_utils.h"
21+
#include "update_engine/fake_system_state.h"
22+
#include "update_engine/omaha_request_action.h"
23+
24+
class Environment {
25+
public:
26+
Environment() { logging::SetMinLogLevel(logging::LOG_FATAL); }
27+
};
28+
29+
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
30+
static Environment env;
31+
brillo::FakeMessageLoop loop(nullptr);
32+
loop.SetAsCurrent();
33+
34+
chromeos_update_engine::FakeSystemState fake_system_state;
35+
auto omaha_request_action =
36+
std::make_unique<chromeos_update_engine::OmahaRequestAction>(
37+
&fake_system_state,
38+
nullptr,
39+
std::make_unique<chromeos_update_engine::MockHttpFetcher>(
40+
data, size, nullptr),
41+
false);
42+
auto collector_action =
43+
std::make_unique<chromeos_update_engine::ObjectCollectorAction<
44+
chromeos_update_engine::OmahaResponse>>();
45+
BondActions(omaha_request_action.get(), collector_action.get());
46+
chromeos_update_engine::ActionProcessor action_processor;
47+
action_processor.EnqueueAction(std::move(omaha_request_action));
48+
action_processor.EnqueueAction(std::move(collector_action));
49+
action_processor.StartProcessing();
50+
51+
loop.Run();
52+
return 0;
53+
}

‎update_engine.gyp

+52-10
Original file line numberDiff line numberDiff line change
@@ -447,6 +447,32 @@
447447
'payload_generator/generate_delta_main.cc',
448448
],
449449
},
450+
{
451+
'target_name': 'update_engine_test_libs',
452+
'type': 'static_library',
453+
'variables': {
454+
'deps': [
455+
'libshill-client-test',
456+
],
457+
},
458+
'dependencies': [
459+
'libupdate_engine',
460+
],
461+
'includes': [
462+
'../../../platform2/common-mk/common_test.gypi',
463+
],
464+
'sources': [
465+
'common/fake_prefs.cc',
466+
'common/file_fetcher.cc', # Only required for tests.
467+
'common/mock_http_fetcher.cc',
468+
'common/test_utils.cc',
469+
'fake_shill_proxy.cc',
470+
'fake_system_state.cc',
471+
'payload_consumer/fake_file_descriptor.cc',
472+
'payload_generator/fake_filesystem.cc',
473+
'update_manager/umtest_utils.cc',
474+
],
475+
},
450476
],
451477
'conditions': [
452478
['USE_test == 1', {
@@ -511,30 +537,24 @@
511537
'dependencies': [
512538
'libupdate_engine',
513539
'libpayload_generator',
540+
'update_engine_test_libs',
514541
],
515-
'includes': ['../../../platform2/common-mk/common_test.gypi'],
516542
'sources': [
517543
'boot_control_chromeos_unittest.cc',
518544
'certificate_checker_unittest.cc',
519545
'common/action_pipe_unittest.cc',
520546
'common/action_processor_unittest.cc',
521547
'common/action_unittest.cc',
522548
'common/cpu_limiter_unittest.cc',
523-
'common/fake_prefs.cc',
524-
'common/file_fetcher.cc', # Only required for tests.
525549
'common/hash_calculator_unittest.cc',
526550
'common/http_fetcher_unittest.cc',
527551
'common/hwid_override_unittest.cc',
528-
'common/mock_http_fetcher.cc',
529552
'common/prefs_unittest.cc',
530553
'common/subprocess_unittest.cc',
531554
'common/terminator_unittest.cc',
532-
'common/test_utils.cc',
533555
'common/utils_unittest.cc',
534556
'common_service_unittest.cc',
535557
'connection_manager_unittest.cc',
536-
'fake_shill_proxy.cc',
537-
'fake_system_state.cc',
538558
'hardware_chromeos_unittest.cc',
539559
'image_properties_chromeos_unittest.cc',
540560
'metrics_reporter_omaha_unittest.cc',
@@ -551,7 +571,6 @@
551571
'payload_consumer/download_action_unittest.cc',
552572
'payload_consumer/extent_reader_unittest.cc',
553573
'payload_consumer/extent_writer_unittest.cc',
554-
'payload_consumer/fake_file_descriptor.cc',
555574
'payload_consumer/file_descriptor_utils_unittest.cc',
556575
'payload_consumer/file_writer_unittest.cc',
557576
'payload_consumer/filesystem_verifier_action_unittest.cc',
@@ -566,7 +585,6 @@
566585
'payload_generator/ext2_filesystem_unittest.cc',
567586
'payload_generator/extent_ranges_unittest.cc',
568587
'payload_generator/extent_utils_unittest.cc',
569-
'payload_generator/fake_filesystem.cc',
570588
'payload_generator/full_update_generator_unittest.cc',
571589
'payload_generator/graph_utils_unittest.cc',
572590
'payload_generator/inplace_generator_unittest.cc',
@@ -595,7 +613,6 @@
595613
'update_manager/real_time_provider_unittest.cc',
596614
'update_manager/real_updater_provider_unittest.cc',
597615
'update_manager/staging_utils_unittest.cc',
598-
'update_manager/umtest_utils.cc',
599616
'update_manager/update_manager_unittest.cc',
600617
'update_manager/update_time_restrictions_policy_impl_unittest.cc',
601618
'update_manager/variable_unittest.cc',
@@ -604,5 +621,30 @@
604621
},
605622
],
606623
}],
624+
# Fuzzer target.
625+
['USE_fuzzer == 1', {
626+
'targets': [
627+
{
628+
'target_name': 'update_engine_omaha_request_action_fuzzer',
629+
'type': 'executable',
630+
'variables': {
631+
'deps': [
632+
'libbrillo-test-<(libbase_ver)',
633+
'libchrome-test-<(libbase_ver)',
634+
],
635+
},
636+
'includes': [
637+
'../../../platform2/common-mk/common_fuzzer.gypi',
638+
],
639+
'dependencies': [
640+
'libupdate_engine',
641+
'update_engine_test_libs',
642+
],
643+
'sources': [
644+
'omaha_request_action_fuzzer.cc',
645+
],
646+
},
647+
],
648+
}],
607649
],
608650
}

0 commit comments

Comments
 (0)