Support split chunk input for WebSocketFrameParser fuzzer
net::WebSocketFrameParser keeps state between calls as a WebSocket frame header
can span multiple reads from the underlying socket. Up until now, the fuzzer
only simulated one read. By passing the input in multiple chunks, the coverage
of the fuzzer is increased.
Also increase max_len to 256. As the per-iteration setup cost is quite high for
this fuzzer, a larger input length makes the coverage from each iteration higher
without significantly harming speed.
R=yhirano
BUG=
Review-Url: https://codereview.chromium.org/2309723002
Cr-Commit-Position: refs/heads/master@{#417224}
diff --git a/net/websockets/websocket_frame_parser_fuzzer.cc b/net/websockets/websocket_frame_parser_fuzzer.cc
index 6e4b1f3..562941d 100644
--- a/net/websockets/websocket_frame_parser_fuzzer.cc
+++ b/net/websockets/websocket_frame_parser_fuzzer.cc
@@ -7,13 +7,18 @@
#include <vector>
+#include "base/test/fuzzed_data_provider.h"
#include "net/websockets/websocket_frame_parser.h"
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ base::FuzzedDataProvider fuzzed_data_provider(data, size);
net::WebSocketFrameParser parser;
std::vector<std::unique_ptr<net::WebSocketFrameChunk>> frame_chunks;
- parser.Decode(reinterpret_cast<const char*>(data), size, &frame_chunks);
-
+ while (fuzzed_data_provider.remaining_bytes() > 0) {
+ size_t chunk_size = fuzzed_data_provider.ConsumeUint32InRange(1, 32);
+ base::StringPiece chunk = fuzzed_data_provider.ConsumeBytes(chunk_size);
+ parser.Decode(chunk.data(), chunk.size(), &frame_chunks);
+ }
return 0;
}
