Migrate //net and //content fuzz targets to use the new FuzzedDataProvider.
The end goal is to delete `base::FuzzedDataProvider` and always use the
version from libFuzzer upstream, which in fact has evolved from the
initial `FuzzedDataProvider` version that was created in Chromium --
kudos to Chrome networking team who, I believe, have implemented that
class originally.
Since this is the first migration CL, I've also slightly updated libFuzzer
docs to make sure new fuzzer authors won't depend on the class living in
//base.
Bug: 907103
Change-Id: I7042664142efce97835e09fc6f1d7c9eff3c5a7d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1671287
Reviewed-by: Avi Drissman <[email protected]>
Reviewed-by: Matt Mueller <[email protected]>
Commit-Queue: Max Moroz <[email protected]>
Cr-Commit-Position: refs/heads/master@{#671709}
diff --git a/content/DEPS b/content/DEPS
index 087194fd..6b12bcdf 100644
--- a/content/DEPS
+++ b/content/DEPS
@@ -135,4 +135,9 @@
# (it is part of //components/variations:test_support target).
"+components/variations/variations_params_manager.h",
],
+
+ # Dependencies specific for fuzz targets and other fuzzing-related code.
+ ".*fuzz.*": [
+ "+third_party/libFuzzer/src/utils", # This contains FuzzedDataProvider.
+ ]
}
diff --git a/content/browser/speech/audio_encoder_fuzzer.cc b/content/browser/speech/audio_encoder_fuzzer.cc
index bd05b40..f8cf9d8 100644
--- a/content/browser/speech/audio_encoder_fuzzer.cc
+++ b/content/browser/speech/audio_encoder_fuzzer.cc
@@ -5,8 +5,8 @@
#include <stddef.h>
#include <stdint.h>
-#include "base/test/fuzzed_data_provider.h"
#include "content/browser/speech/audio_encoder.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
using content::AudioChunk;
@@ -17,7 +17,7 @@
const int kAudioPacketIntervalMs = 100;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider provider(data, size);
+ FuzzedDataProvider provider(data, size);
content::AudioEncoder encoder(kDefaultConfigSampleRate,
kDefaultConfigBitsPerSample);
diff --git a/content/test/data/fuzzer_dictionaries/merkle_integrity_source_stream_fuzzer.dict b/content/test/data/fuzzer_dictionaries/merkle_integrity_source_stream_fuzzer.dict
index 87687fc..3e60047a 100644
--- a/content/test/data/fuzzer_dictionaries/merkle_integrity_source_stream_fuzzer.dict
+++ b/content/test/data/fuzzer_dictionaries/merkle_integrity_source_stream_fuzzer.dict
@@ -8,7 +8,7 @@
# The header version of the hash.
"mi-sha256=QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI\\ "
-# base::FuzzedDataProvider separator.
+# FuzzedDataProvider separator.
"\\ "
# Use a 16-byte record size if you don't have better ideas.
diff --git a/content/test/fuzzer/merkle_integrity_source_stream_fuzzer.cc b/content/test/fuzzer/merkle_integrity_source_stream_fuzzer.cc
index 5b63bfd..544b63c6 100644
--- a/content/test/fuzzer/merkle_integrity_source_stream_fuzzer.cc
+++ b/content/test/fuzzer/merkle_integrity_source_stream_fuzzer.cc
@@ -8,17 +8,17 @@
#include "base/logging.h"
#include "base/memory/scoped_refptr.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/io_buffer.h"
#include "net/base/test_completion_callback.h"
#include "net/filter/fuzzed_source_stream.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Fuzzer for MerkleIntegritySourceStream
//
// |data| contains a header prefix, and then is used to build a
// FuzzedSourceStream.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
std::string header = data_provider.ConsumeRandomLengthString(256);
net::TestCompletionCallback callback;
diff --git a/net/DEPS b/net/DEPS
index 291fa1a..5b608efb 100644
--- a/net/DEPS
+++ b/net/DEPS
@@ -69,9 +69,10 @@
"+base/i18n",
],
- # Needed for fuzz targets written using libprotobuf-mutator library.
+ # Dependencies specific for fuzz targets and other fuzzing-related code.
".*fuzz.*": [
- "+third_party/libprotobuf-mutator",
+ "+third_party/libFuzzer/src/utils", # This contains FuzzedDataProvider.
+ "+third_party/libprotobuf-mutator", # This is needed for LPM-based fuzzers.
]
}
diff --git a/net/cert/crl_set_fuzzer.cc b/net/cert/crl_set_fuzzer.cc
index ef186183..3b83709 100644
--- a/net/cert/crl_set_fuzzer.cc
+++ b/net/cert/crl_set_fuzzer.cc
@@ -5,14 +5,14 @@
#include <stddef.h>
#include <stdint.h>
-#include "base/test/fuzzed_data_provider.h"
#include "net/cert/crl_set.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
if (size < 32 + 32 + 20)
return 0;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
std::string spki_hash = data_provider.ConsumeBytesAsString(32);
std::string issuer_hash = data_provider.ConsumeBytesAsString(32);
size_t serial_length = data_provider.ConsumeIntegralInRange(4, 19);
diff --git a/net/cert/internal/verify_name_match_fuzzer.cc b/net/cert/internal/verify_name_match_fuzzer.cc
index 03c7e9c..a22d3f9 100644
--- a/net/cert/internal/verify_name_match_fuzzer.cc
+++ b/net/cert/internal/verify_name_match_fuzzer.cc
@@ -9,17 +9,19 @@
#include <vector>
-#include "base/test/fuzzed_data_provider.h"
#include "net/der/input.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider fuzzed_data(data, size);
+ FuzzedDataProvider fuzzed_data(data, size);
// Intentionally using uint16_t here to avoid empty |second_part|.
size_t first_part_size = fuzzed_data.ConsumeIntegral<uint16_t>();
- std::vector<uint8_t> first_part = fuzzed_data.ConsumeBytes(first_part_size);
- std::vector<uint8_t> second_part = fuzzed_data.ConsumeRemainingBytes();
+ std::vector<uint8_t> first_part =
+ fuzzed_data.ConsumeBytes<uint8_t>(first_part_size);
+ std::vector<uint8_t> second_part =
+ fuzzed_data.ConsumeRemainingBytes<uint8_t>();
net::der::Input in1(first_part.data(), first_part.size());
net::der::Input in2(second_part.data(), second_part.size());
diff --git a/net/cert/internal/verify_name_match_verifynameinsubtree_fuzzer.cc b/net/cert/internal/verify_name_match_verifynameinsubtree_fuzzer.cc
index d948e59f..a289c7f1 100644
--- a/net/cert/internal/verify_name_match_verifynameinsubtree_fuzzer.cc
+++ b/net/cert/internal/verify_name_match_verifynameinsubtree_fuzzer.cc
@@ -9,17 +9,19 @@
#include <vector>
-#include "base/test/fuzzed_data_provider.h"
#include "net/der/input.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider fuzzed_data(data, size);
+ FuzzedDataProvider fuzzed_data(data, size);
// Intentionally using uint16_t here to avoid empty |second_part|.
size_t first_part_size = fuzzed_data.ConsumeIntegral<uint16_t>();
- std::vector<uint8_t> first_part = fuzzed_data.ConsumeBytes(first_part_size);
- std::vector<uint8_t> second_part = fuzzed_data.ConsumeRemainingBytes();
+ std::vector<uint8_t> first_part =
+ fuzzed_data.ConsumeBytes<uint8_t>(first_part_size);
+ std::vector<uint8_t> second_part =
+ fuzzed_data.ConsumeRemainingBytes<uint8_t>();
net::der::Input in1(first_part.data(), first_part.size());
net::der::Input in2(second_part.data(), second_part.size());
diff --git a/net/cookies/parse_cookie_line_fuzzer.cc b/net/cookies/parse_cookie_line_fuzzer.cc
index beb8401..a8aaf00 100644
--- a/net/cookies/parse_cookie_line_fuzzer.cc
+++ b/net/cookies/parse_cookie_line_fuzzer.cc
@@ -6,10 +6,10 @@
#include <stdint.h>
#include "base/logging.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/cookies/parsed_cookie.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
-const std::string GetArbitraryString(base::FuzzedDataProvider* data_provider) {
+const std::string GetArbitraryString(FuzzedDataProvider* data_provider) {
// Adding a fudge factor to kMaxCookieSize so that both branches of the bounds
// detection code will be tested.
return data_provider->ConsumeRandomLengthString(
@@ -18,7 +18,7 @@
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
const std::string cookie_line = GetArbitraryString(&data_provider);
net::ParsedCookie parsed_cookie(cookie_line);
diff --git a/net/dns/fuzzed_host_resolver_util.cc b/net/dns/fuzzed_host_resolver_util.cc
index ab59eef4..b547c5a 100644
--- a/net/dns/fuzzed_host_resolver_util.cc
+++ b/net/dns/fuzzed_host_resolver_util.cc
@@ -18,7 +18,6 @@
#include "base/memory/ref_counted.h"
#include "base/memory/weak_ptr.h"
#include "base/single_thread_task_runner.h"
-#include "base/test/fuzzed_data_provider.h"
#include "base/threading/thread_task_runner_handle.h"
#include "net/base/address_list.h"
#include "net/base/completion_once_callback.h"
@@ -39,18 +38,19 @@
#include "net/log/net_log_with_source.h"
#include "net/socket/datagram_server_socket.h"
#include "net/socket/fuzzed_socket_factory.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace net {
namespace {
// Returns a fuzzed non-zero port number.
-uint16_t FuzzPort(base::FuzzedDataProvider* data_provider) {
+uint16_t FuzzPort(FuzzedDataProvider* data_provider) {
return data_provider->ConsumeIntegral<uint16_t>();
}
// Returns a fuzzed IPv4 address. Can return invalid / reserved addresses.
-IPAddress FuzzIPv4Address(base::FuzzedDataProvider* data_provider) {
+IPAddress FuzzIPv4Address(FuzzedDataProvider* data_provider) {
return IPAddress(data_provider->ConsumeIntegral<uint8_t>(),
data_provider->ConsumeIntegral<uint8_t>(),
data_provider->ConsumeIntegral<uint8_t>(),
@@ -58,7 +58,7 @@
}
// Returns a fuzzed IPv6 address. Can return invalid / reserved addresses.
-IPAddress FuzzIPv6Address(base::FuzzedDataProvider* data_provider) {
+IPAddress FuzzIPv6Address(FuzzedDataProvider* data_provider) {
return IPAddress(data_provider->ConsumeIntegral<uint8_t>(),
data_provider->ConsumeIntegral<uint8_t>(),
data_provider->ConsumeIntegral<uint8_t>(),
@@ -79,7 +79,7 @@
// Returns a fuzzed address, which can be either IPv4 or IPv6. Can return
// invalid / reserved addresses.
-IPAddress FuzzIPAddress(base::FuzzedDataProvider* data_provider) {
+IPAddress FuzzIPAddress(FuzzedDataProvider* data_provider) {
if (data_provider->ConsumeBool())
return FuzzIPv4Address(data_provider);
return FuzzIPv6Address(data_provider);
@@ -93,7 +93,7 @@
// happen if a request is issued but the code never waits for the result
// before the test ends.
explicit FuzzedHostResolverProc(
- base::WeakPtr<base::FuzzedDataProvider> data_provider)
+ base::WeakPtr<FuzzedDataProvider> data_provider)
: HostResolverProc(nullptr),
data_provider_(data_provider),
network_task_runner_(base::ThreadTaskRunnerHandle::Get()) {}
@@ -151,7 +151,7 @@
private:
~FuzzedHostResolverProc() override = default;
- base::WeakPtr<base::FuzzedDataProvider> data_provider_;
+ base::WeakPtr<FuzzedDataProvider> data_provider_;
// Just used for thread-safety checks.
scoped_refptr<base::SingleThreadTaskRunner> network_task_runner_;
@@ -172,7 +172,7 @@
// RecvFrom calls.
class FuzzedMdnsSocket : public DatagramServerSocket {
public:
- explicit FuzzedMdnsSocket(base::FuzzedDataProvider* data_provider)
+ explicit FuzzedMdnsSocket(FuzzedDataProvider* data_provider)
: data_provider_(data_provider),
local_address_(FuzzIPAddress(data_provider_), 5353),
weak_factory_(this) {}
@@ -277,7 +277,7 @@
std::move(callback).Run(data_provider_->PickValueInArray(kMdnsErrors));
}
- base::FuzzedDataProvider* const data_provider_;
+ FuzzedDataProvider* const data_provider_;
const IPEndPoint local_address_;
const NetLogWithSource net_log_;
@@ -286,7 +286,7 @@
class FuzzedMdnsSocketFactory : public MDnsSocketFactory {
public:
- explicit FuzzedMdnsSocketFactory(base::FuzzedDataProvider* data_provider)
+ explicit FuzzedMdnsSocketFactory(FuzzedDataProvider* data_provider)
: data_provider_(data_provider) {}
void CreateSockets(
@@ -297,7 +297,7 @@
}
private:
- base::FuzzedDataProvider* const data_provider_;
+ FuzzedDataProvider* const data_provider_;
};
class FuzzedHostResolverManager : public HostResolverManager {
@@ -305,7 +305,7 @@
// |data_provider| and |net_log| must outlive the FuzzedHostResolver.
FuzzedHostResolverManager(const HostResolver::ManagerOptions& options,
NetLog* net_log,
- base::FuzzedDataProvider* data_provider)
+ FuzzedDataProvider* data_provider)
: HostResolverManager(options, net_log),
data_provider_(data_provider),
is_ipv6_reachable_(data_provider->ConsumeBool()),
@@ -348,7 +348,7 @@
SetHaveOnlyLoopbackAddresses(data_provider_->ConsumeBool());
}
- base::FuzzedDataProvider* const data_provider_;
+ FuzzedDataProvider* const data_provider_;
// Fixed value to be returned by IsIPv6Reachable.
const bool is_ipv6_reachable_;
@@ -358,7 +358,7 @@
NetLog* const net_log_;
- base::WeakPtrFactory<base::FuzzedDataProvider> data_provider_weak_factory_;
+ base::WeakPtrFactory<FuzzedDataProvider> data_provider_weak_factory_;
DISALLOW_COPY_AND_ASSIGN(FuzzedHostResolverManager);
};
@@ -424,7 +424,7 @@
std::unique_ptr<DnsClient> dns_client = DnsClient::CreateClientForTesting(
net_log_, &socket_factory_,
- base::Bind(&base::FuzzedDataProvider::ConsumeIntegralInRange<int32_t>,
+ base::Bind(&FuzzedDataProvider::ConsumeIntegralInRange<int32_t>,
base::Unretained(data_provider_)));
dns_client->SetConfig(config);
HostResolverManager::SetDnsClientForTesting(std::move(dns_client));
@@ -435,7 +435,7 @@
std::unique_ptr<ContextHostResolver> CreateFuzzedContextHostResolver(
const HostResolver::ManagerOptions& options,
NetLog* net_log,
- base::FuzzedDataProvider* data_provider,
+ FuzzedDataProvider* data_provider,
bool enable_caching) {
// FuzzedHostResolverManager only handles fuzzing DnsClient when enabled
// through SetDnsClientEnabled().
diff --git a/net/dns/fuzzed_host_resolver_util.h b/net/dns/fuzzed_host_resolver_util.h
index 5f6fbb1..11ac006 100644
--- a/net/dns/fuzzed_host_resolver_util.h
+++ b/net/dns/fuzzed_host_resolver_util.h
@@ -9,9 +9,7 @@
#include "net/dns/host_resolver.h"
-namespace base {
class FuzzedDataProvider;
-}
namespace net {
@@ -38,7 +36,7 @@
std::unique_ptr<ContextHostResolver> CreateFuzzedContextHostResolver(
const HostResolver::ManagerOptions& options,
NetLog* net_log,
- base::FuzzedDataProvider* data_provider,
+ FuzzedDataProvider* data_provider,
bool enable_caching);
} // namespace net
diff --git a/net/dns/host_resolver_manager_fuzzer.cc b/net/dns/host_resolver_manager_fuzzer.cc
index ca19d4f..0606e0a 100644
--- a/net/dns/host_resolver_manager_fuzzer.cc
+++ b/net/dns/host_resolver_manager_fuzzer.cc
@@ -11,7 +11,6 @@
#include "base/bind.h"
#include "base/logging.h"
#include "base/run_loop.h"
-#include "base/test/fuzzed_data_provider.h"
#include "base/test/scoped_task_environment.h"
#include "net/base/address_family.h"
#include "net/base/address_list.h"
@@ -23,6 +22,7 @@
#include "net/log/net_log_with_source.h"
#include "net/log/test_net_log.h"
#include "net/net_buildflags.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace {
@@ -32,7 +32,7 @@
class DnsRequest {
public:
DnsRequest(net::HostResolver* host_resolver,
- base::FuzzedDataProvider* data_provider,
+ FuzzedDataProvider* data_provider,
std::vector<std::unique_ptr<DnsRequest>>* dns_requests)
: host_resolver_(host_resolver),
data_provider_(data_provider),
@@ -44,7 +44,7 @@
// doesn't complete synchronously, adds it to |dns_requests|.
static void CreateRequest(
net::HostResolver* host_resolver,
- base::FuzzedDataProvider* data_provider,
+ FuzzedDataProvider* data_provider,
std::vector<std::unique_ptr<DnsRequest>>* dns_requests) {
std::unique_ptr<DnsRequest> dns_request(
new DnsRequest(host_resolver, data_provider, dns_requests));
@@ -56,7 +56,7 @@
// If |dns_requests| is non-empty, waits for a randomly chosen one of the
// requests to complete and removes it from |dns_requests|.
static void WaitForRequestComplete(
- base::FuzzedDataProvider* data_provider,
+ FuzzedDataProvider* data_provider,
std::vector<std::unique_ptr<DnsRequest>>* dns_requests) {
if (dns_requests->empty())
return;
@@ -75,7 +75,7 @@
// complete, just removes it from the list.
static void CancelRequest(
net::HostResolver* host_resolver,
- base::FuzzedDataProvider* data_provider,
+ FuzzedDataProvider* data_provider,
std::vector<std::unique_ptr<DnsRequest>>* dns_requests) {
if (dns_requests->empty())
return;
@@ -176,7 +176,7 @@
void Cancel() { request_.reset(); }
net::HostResolver* host_resolver_;
- base::FuzzedDataProvider* data_provider_;
+ FuzzedDataProvider* data_provider_;
std::vector<std::unique_ptr<DnsRequest>>* dns_requests_;
// Non-null only while running.
@@ -199,7 +199,7 @@
// async resolver while lookups are active as a result of the change.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
{
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
net::TestNetLog net_log;
net::HostResolver::ManagerOptions options;
diff --git a/net/filter/brotli_source_stream_fuzzer.cc b/net/filter/brotli_source_stream_fuzzer.cc
index ef3f4a0..7305a18 100644
--- a/net/filter/brotli_source_stream_fuzzer.cc
+++ b/net/filter/brotli_source_stream_fuzzer.cc
@@ -6,18 +6,18 @@
#include "base/logging.h"
#include "base/memory/ref_counted.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/io_buffer.h"
#include "net/base/test_completion_callback.h"
#include "net/filter/fuzzed_source_stream.h"
#include "net/filter/source_stream.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Fuzzer for BrotliSourceStream.
//
// |data| is used to create a FuzzedSourceStream.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
net::TestCompletionCallback callback;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
std::unique_ptr<net::FuzzedSourceStream> fuzzed_source_stream(
new net::FuzzedSourceStream(&data_provider));
std::unique_ptr<net::SourceStream> brotli_stream =
diff --git a/net/filter/fuzzed_source_stream.cc b/net/filter/fuzzed_source_stream.cc
index 6a711d0e..bfe9c98 100644
--- a/net/filter/fuzzed_source_stream.cc
+++ b/net/filter/fuzzed_source_stream.cc
@@ -9,10 +9,10 @@
#include <utility>
#include "base/bind.h"
-#include "base/test/fuzzed_data_provider.h"
#include "base/threading/thread_task_runner_handle.h"
#include "net/base/io_buffer.h"
#include "net/base/net_errors.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace net {
@@ -23,7 +23,7 @@
} // namespace
-FuzzedSourceStream::FuzzedSourceStream(base::FuzzedDataProvider* data_provider)
+FuzzedSourceStream::FuzzedSourceStream(FuzzedDataProvider* data_provider)
: SourceStream(SourceStream::TYPE_NONE),
data_provider_(data_provider),
read_pending_(false),
diff --git a/net/filter/fuzzed_source_stream.h b/net/filter/fuzzed_source_stream.h
index 4b26829..fea1ee3 100644
--- a/net/filter/fuzzed_source_stream.h
+++ b/net/filter/fuzzed_source_stream.h
@@ -12,9 +12,7 @@
#include "net/base/completion_once_callback.h"
#include "net/filter/source_stream.h"
-namespace base {
class FuzzedDataProvider;
-} // namespace base
namespace net {
@@ -26,7 +24,7 @@
public:
// |data_provider| is used to determine behavior of the FuzzedSourceStream.
// It must remain valid until after the FuzzedSocket is destroyed.
- explicit FuzzedSourceStream(base::FuzzedDataProvider* data_provider);
+ explicit FuzzedSourceStream(FuzzedDataProvider* data_provider);
~FuzzedSourceStream() override;
// SourceStream implementation
@@ -41,7 +39,7 @@
scoped_refptr<IOBuffer> read_buf,
int result);
- base::FuzzedDataProvider* data_provider_;
+ FuzzedDataProvider* data_provider_;
// Whether there is a pending Read().
bool read_pending_;
diff --git a/net/filter/gzip_source_stream_fuzzer.cc b/net/filter/gzip_source_stream_fuzzer.cc
index 1fde1d8a..a6dd834 100644
--- a/net/filter/gzip_source_stream_fuzzer.cc
+++ b/net/filter/gzip_source_stream_fuzzer.cc
@@ -8,17 +8,17 @@
#include "base/logging.h"
#include "base/memory/ref_counted.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/io_buffer.h"
#include "net/base/test_completion_callback.h"
#include "net/filter/fuzzed_source_stream.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Fuzzer for GzipSourceStream.
//
// |data| is used to create a FuzzedSourceStream.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
net::TestCompletionCallback callback;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
std::unique_ptr<net::FuzzedSourceStream> fuzzed_source_stream(
new net::FuzzedSourceStream(&data_provider));
diff --git a/net/http/http_proxy_client_socket_fuzzer.cc b/net/http/http_proxy_client_socket_fuzzer.cc
index 57a50f6..45c36cc 100644
--- a/net/http/http_proxy_client_socket_fuzzer.cc
+++ b/net/http/http_proxy_client_socket_fuzzer.cc
@@ -12,7 +12,6 @@
#include "base/logging.h"
#include "base/strings/utf_string_conversions.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/address_list.h"
#include "net/base/auth.h"
#include "net/base/host_port_pair.h"
@@ -26,6 +25,7 @@
#include "net/socket/fuzzed_socket.h"
#include "net/socket/next_proto.h"
#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Fuzzer for HttpProxyClientSocket only tests establishing a connection when
// using the proxy as a tunnel.
@@ -36,7 +36,7 @@
// Use a test NetLog, to exercise logging code.
net::TestNetLog test_net_log;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
net::TestCompletionCallback callback;
std::unique_ptr<net::FuzzedSocket> fuzzed_socket(
diff --git a/net/http/http_stream_parser_fuzzer.cc b/net/http/http_stream_parser_fuzzer.cc
index 1cfcb270..3f99250d 100644
--- a/net/http/http_stream_parser_fuzzer.cc
+++ b/net/http/http_stream_parser_fuzzer.cc
@@ -15,7 +15,6 @@
#include "base/logging.h"
#include "base/macros.h"
#include "base/memory/ref_counted.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/io_buffer.h"
#include "net/base/net_errors.h"
#include "net/base/test_completion_callback.h"
@@ -25,6 +24,7 @@
#include "net/log/test_net_log.h"
#include "net/socket/fuzzed_socket.h"
#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
#include "url/gurl.h"
// Fuzzer for HttpStreamParser.
@@ -33,7 +33,7 @@
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
net::TestCompletionCallback callback;
net::BoundTestNetLog bound_test_net_log;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
net::FuzzedSocket fuzzed_socket(&data_provider,
bound_test_net_log.bound().net_log());
CHECK_EQ(net::OK, fuzzed_socket.Connect(callback.callback()));
diff --git a/net/ntlm/ntlm_client_fuzzer.cc b/net/ntlm/ntlm_client_fuzzer.cc
index 89977fd..0990e3c 100644
--- a/net/ntlm/ntlm_client_fuzzer.cc
+++ b/net/ntlm/ntlm_client_fuzzer.cc
@@ -9,20 +9,19 @@
#include <vector>
#include "base/containers/span.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/ntlm/ntlm_client.h"
#include "net/ntlm/ntlm_test_data.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
-base::string16 ConsumeRandomLengthString16(
- base::FuzzedDataProvider& data_provider,
- size_t max_chars) {
+base::string16 ConsumeRandomLengthString16(FuzzedDataProvider& data_provider,
+ size_t max_chars) {
std::string bytes = data_provider.ConsumeRandomLengthString(max_chars * 2);
return base::string16(reinterpret_cast<const base::char16*>(bytes.data()),
bytes.size() / 2);
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider fdp(data, size);
+ FuzzedDataProvider fdp(data, size);
bool is_v2 = fdp.ConsumeBool();
uint64_t client_time = fdp.ConsumeIntegral<uint64_t>();
net::ntlm::NtlmClient client((net::ntlm::NtlmFeatures(is_v2)));
@@ -41,7 +40,8 @@
std::string channel_bindings = fdp.ConsumeRandomLengthString(150);
std::string spn =
fdp.ConsumeRandomLengthString(net::ntlm::kMaxFqdnLen + 5 + 1);
- std::vector<uint8_t> challenge_msg_bytes = fdp.ConsumeRemainingBytes();
+ std::vector<uint8_t> challenge_msg_bytes =
+ fdp.ConsumeRemainingBytes<uint8_t>();
client.GenerateAuthenticateMessage(
domain, username, password, hostname, channel_bindings, spn, client_time,
diff --git a/net/quic/platform/impl/quic_fuzzed_data_provider_impl.h b/net/quic/platform/impl/quic_fuzzed_data_provider_impl.h
index 4689fef3..bfd3ab8 100644
--- a/net/quic/platform/impl/quic_fuzzed_data_provider_impl.h
+++ b/net/quic/platform/impl/quic_fuzzed_data_provider_impl.h
@@ -5,11 +5,11 @@
#ifndef NET_QUIC_PLATFORM_IMPL_QUIC_FUZZED_DATA_PROVIDER_IMPL_H_
#define NET_QUIC_PLATFORM_IMPL_QUIC_FUZZED_DATA_PROVIDER_IMPL_H_
-#include "base/test/fuzzed_data_provider.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace quic {
-using QuicFuzzedDataProviderImpl = base::FuzzedDataProvider;
+using QuicFuzzedDataProviderImpl = FuzzedDataProvider;
} // namespace quic
diff --git a/net/quic/quic_stream_factory_fuzzer.cc b/net/quic/quic_stream_factory_fuzzer.cc
index b91b834..5c5d5aa 100644
--- a/net/quic/quic_stream_factory_fuzzer.cc
+++ b/net/quic/quic_stream_factory_fuzzer.cc
@@ -4,8 +4,6 @@
#include "net/quic/quic_stream_factory.h"
-#include "base/test/fuzzed_data_provider.h"
-
#include "base/stl_util.h"
#include "net/base/network_isolation_key.h"
#include "net/base/test_completion_callback.h"
@@ -28,6 +26,7 @@
#include "net/third_party/quiche/src/quic/test_tools/mock_clock.h"
#include "net/third_party/quiche/src/quic/test_tools/mock_random.h"
#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace net {
@@ -83,7 +82,7 @@
static struct Env* env = new Env();
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
std::unique_ptr<ContextHostResolver> host_resolver =
CreateFuzzedContextHostResolver(HostResolver::ManagerOptions(), nullptr,
diff --git a/net/quic/quic_transport_parameters_fuzzer.cc b/net/quic/quic_transport_parameters_fuzzer.cc
index 91d95fca..3fe7a56 100644
--- a/net/quic/quic_transport_parameters_fuzzer.cc
+++ b/net/quic/quic_transport_parameters_fuzzer.cc
@@ -7,16 +7,17 @@
#include <vector>
-#include "base/test/fuzzed_data_provider.h"
#include "net/third_party/quiche/src/quic/core/crypto/transport_parameters.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
auto perspective = data_provider.ConsumeBool() ? quic::Perspective::IS_CLIENT
: quic::Perspective::IS_SERVER;
quic::TransportParameters transport_parameters;
- std::vector<uint8_t> remaining_bytes = data_provider.ConsumeRemainingBytes();
+ std::vector<uint8_t> remaining_bytes =
+ data_provider.ConsumeRemainingBytes<uint8_t>();
quic::ParseTransportParameters(remaining_bytes.data(), remaining_bytes.size(),
perspective, &transport_parameters);
return 0;
diff --git a/net/server/http_server_fuzzer.cc b/net/server/http_server_fuzzer.cc
index 53e0899..e8c57af 100644
--- a/net/server/http_server_fuzzer.cc
+++ b/net/server/http_server_fuzzer.cc
@@ -5,18 +5,18 @@
#include "base/logging.h"
#include "base/macros.h"
#include "base/run_loop.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/net_errors.h"
#include "net/log/test_net_log.h"
#include "net/server/http_server.h"
#include "net/socket/fuzzed_server_socket.h"
#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace {
class WaitTillHttpCloseDelegate : public net::HttpServer::Delegate {
public:
- WaitTillHttpCloseDelegate(base::FuzzedDataProvider* data_provider,
+ WaitTillHttpCloseDelegate(FuzzedDataProvider* data_provider,
const base::Closure& done_closure)
: server_(nullptr),
data_provider_(data_provider),
@@ -81,7 +81,7 @@
};
net::HttpServer* server_;
- base::FuzzedDataProvider* const data_provider_;
+ FuzzedDataProvider* const data_provider_;
base::Closure done_closure_;
const uint8_t action_flags_;
@@ -95,7 +95,7 @@
// |data| is used to create a FuzzedServerSocket.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
net::TestNetLog test_net_log;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
std::unique_ptr<net::ServerSocket> server_socket(
std::make_unique<net::FuzzedServerSocket>(&data_provider, &test_net_log));
diff --git a/net/socket/fuzzed_datagram_client_socket.cc b/net/socket/fuzzed_datagram_client_socket.cc
index 6b011f8..aea50374 100644
--- a/net/socket/fuzzed_datagram_client_socket.cc
+++ b/net/socket/fuzzed_datagram_client_socket.cc
@@ -11,12 +11,12 @@
#include "base/location.h"
#include "base/logging.h"
#include "base/strings/string_piece.h"
-#include "base/test/fuzzed_data_provider.h"
#include "base/threading/thread_task_runner_handle.h"
#include "net/base/io_buffer.h"
#include "net/base/ip_address.h"
#include "net/base/net_errors.h"
#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace net {
@@ -29,7 +29,7 @@
ERR_MSG_TOO_BIG};
FuzzedDatagramClientSocket::FuzzedDatagramClientSocket(
- base::FuzzedDataProvider* data_provider)
+ FuzzedDataProvider* data_provider)
: data_provider_(data_provider), weak_factory_(this) {}
FuzzedDatagramClientSocket::~FuzzedDatagramClientSocket() = default;
diff --git a/net/socket/fuzzed_datagram_client_socket.h b/net/socket/fuzzed_datagram_client_socket.h
index 62c68db..9659bec 100644
--- a/net/socket/fuzzed_datagram_client_socket.h
+++ b/net/socket/fuzzed_datagram_client_socket.h
@@ -16,9 +16,7 @@
#include "net/log/net_log_with_source.h"
#include "net/traffic_annotation/network_traffic_annotation.h"
-namespace base {
class FuzzedDataProvider;
-}
namespace net {
@@ -30,7 +28,7 @@
class FuzzedDatagramClientSocket : public DatagramClientSocket {
public:
// |data_provider| must outlive the created socket.
- explicit FuzzedDatagramClientSocket(base::FuzzedDataProvider* data_provider);
+ explicit FuzzedDatagramClientSocket(FuzzedDataProvider* data_provider);
~FuzzedDatagramClientSocket() override;
// DatagramClientSocket implementation:
@@ -83,7 +81,7 @@
void OnReadComplete(net::CompletionOnceCallback callback, int result);
void OnWriteComplete(net::CompletionOnceCallback callback, int result);
- base::FuzzedDataProvider* data_provider_;
+ FuzzedDataProvider* data_provider_;
bool connected_ = false;
bool read_pending_ = false;
diff --git a/net/socket/fuzzed_server_socket.cc b/net/socket/fuzzed_server_socket.cc
index cffa433d..7e2d4b9 100644
--- a/net/socket/fuzzed_server_socket.cc
+++ b/net/socket/fuzzed_server_socket.cc
@@ -13,7 +13,7 @@
namespace net {
-FuzzedServerSocket::FuzzedServerSocket(base::FuzzedDataProvider* data_provider,
+FuzzedServerSocket::FuzzedServerSocket(FuzzedDataProvider* data_provider,
net::NetLog* net_log)
: data_provider_(data_provider),
net_log_(net_log),
diff --git a/net/socket/fuzzed_server_socket.h b/net/socket/fuzzed_server_socket.h
index 0d9cd16..006fa85 100644
--- a/net/socket/fuzzed_server_socket.h
+++ b/net/socket/fuzzed_server_socket.h
@@ -16,9 +16,7 @@
#include "net/base/ip_endpoint.h"
#include "net/socket/server_socket.h"
-namespace base {
class FuzzedDataProvider;
-}
namespace net {
@@ -34,8 +32,7 @@
// |data_provider| is used as to determine behavior of the socket. It
// must remain valid until after both this object and the StreamSocket
// produced by Accept are destroyed.
- FuzzedServerSocket(base::FuzzedDataProvider* data_provider,
- net::NetLog* net_log);
+ FuzzedServerSocket(FuzzedDataProvider* data_provider, net::NetLog* net_log);
~FuzzedServerSocket() override;
int Listen(const IPEndPoint& address, int backlog) override;
@@ -48,7 +45,7 @@
void DispatchAccept(std::unique_ptr<StreamSocket>* socket,
CompletionOnceCallback callback);
- base::FuzzedDataProvider* data_provider_;
+ FuzzedDataProvider* data_provider_;
net::NetLog* net_log_;
IPEndPoint listening_on_;
diff --git a/net/socket/fuzzed_socket.cc b/net/socket/fuzzed_socket.cc
index b974d9c4..a71a6d5 100644
--- a/net/socket/fuzzed_socket.cc
+++ b/net/socket/fuzzed_socket.cc
@@ -9,11 +9,11 @@
#include "base/bind.h"
#include "base/location.h"
#include "base/logging.h"
-#include "base/test/fuzzed_data_provider.h"
#include "base/threading/thread_task_runner_handle.h"
#include "net/base/io_buffer.h"
#include "net/log/net_log_source_type.h"
#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace net {
@@ -36,7 +36,7 @@
} // namespace
-FuzzedSocket::FuzzedSocket(base::FuzzedDataProvider* data_provider,
+FuzzedSocket::FuzzedSocket(FuzzedDataProvider* data_provider,
net::NetLog* net_log)
: data_provider_(data_provider),
net_log_(NetLogWithSource::Make(net_log, NetLogSourceType::SOCKET)),
diff --git a/net/socket/fuzzed_socket.h b/net/socket/fuzzed_socket.h
index abe5961..63d069e 100644
--- a/net/socket/fuzzed_socket.h
+++ b/net/socket/fuzzed_socket.h
@@ -17,9 +17,7 @@
#include "net/socket/transport_client_socket.h"
#include "net/traffic_annotation/network_traffic_annotation.h"
-namespace base {
class FuzzedDataProvider;
-}
namespace net {
@@ -43,7 +41,7 @@
public:
// |data_provider| is used as to determine behavior of the FuzzedSocket. It
// must remain valid until after the FuzzedSocket is destroyed.
- FuzzedSocket(base::FuzzedDataProvider* data_provider, net::NetLog* net_log);
+ FuzzedSocket(FuzzedDataProvider* data_provider, net::NetLog* net_log);
~FuzzedSocket() override;
// If set to true, the socket will fuzz the result of the Connect() call.
@@ -104,7 +102,7 @@
// See https://crbug.com/823012
bool ForceSync() const;
- base::FuzzedDataProvider* data_provider_;
+ FuzzedDataProvider* data_provider_;
// If true, the result of the Connect() call is fuzzed - it can succeed or
// fail with a variety of connection errors, and it can complete synchronously
diff --git a/net/socket/fuzzed_socket_factory.cc b/net/socket/fuzzed_socket_factory.cc
index 7736fa4..31d776a 100644
--- a/net/socket/fuzzed_socket_factory.cc
+++ b/net/socket/fuzzed_socket_factory.cc
@@ -5,7 +5,6 @@
#include "net/socket/fuzzed_socket_factory.h"
#include "base/logging.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/address_list.h"
#include "net/base/ip_endpoint.h"
#include "net/base/net_errors.h"
@@ -16,6 +15,7 @@
#include "net/socket/fuzzed_socket.h"
#include "net/socket/ssl_client_socket.h"
#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace net {
@@ -105,8 +105,7 @@
} // namespace
-FuzzedSocketFactory::FuzzedSocketFactory(
- base::FuzzedDataProvider* data_provider)
+FuzzedSocketFactory::FuzzedSocketFactory(FuzzedDataProvider* data_provider)
: data_provider_(data_provider), fuzz_connect_result_(true) {}
FuzzedSocketFactory::~FuzzedSocketFactory() = default;
diff --git a/net/socket/fuzzed_socket_factory.h b/net/socket/fuzzed_socket_factory.h
index 4002d006..28fc0a2 100644
--- a/net/socket/fuzzed_socket_factory.h
+++ b/net/socket/fuzzed_socket_factory.h
@@ -11,9 +11,7 @@
#include "base/macros.h"
#include "net/socket/client_socket_factory.h"
-namespace base {
class FuzzedDataProvider;
-}
namespace net {
@@ -33,7 +31,7 @@
// creates. Other objects can also continue to consume |data_provider|, as
// long as their calls into it are made on the CLientSocketFactory's thread
// and the calls are deterministic.
- explicit FuzzedSocketFactory(base::FuzzedDataProvider* data_provider);
+ explicit FuzzedSocketFactory(FuzzedDataProvider* data_provider);
~FuzzedSocketFactory() override;
std::unique_ptr<DatagramClientSocket> CreateDatagramClientSocket(
@@ -70,7 +68,7 @@
void set_fuzz_connect_result(bool v) { fuzz_connect_result_ = v; }
private:
- base::FuzzedDataProvider* data_provider_;
+ FuzzedDataProvider* data_provider_;
bool fuzz_connect_result_;
DISALLOW_COPY_AND_ASSIGN(FuzzedSocketFactory);
diff --git a/net/socket/socks5_client_socket_fuzzer.cc b/net/socket/socks5_client_socket_fuzzer.cc
index ad2a9a9..a2fb1cc5 100644
--- a/net/socket/socks5_client_socket_fuzzer.cc
+++ b/net/socket/socks5_client_socket_fuzzer.cc
@@ -8,7 +8,7 @@
#include <memory>
#include "base/logging.h"
-#include "base/test/fuzzed_data_provider.h"
+
#include "net/base/address_list.h"
#include "net/base/net_errors.h"
#include "net/base/test_completion_callback.h"
@@ -16,6 +16,7 @@
#include "net/socket/fuzzed_socket.h"
#include "net/socket/socks5_client_socket.h"
#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Fuzzer for Socks5ClientSocket. Only covers the SOCKS5 greeet and
// handshake.
@@ -26,7 +27,7 @@
// Use a test NetLog, to exercise logging code.
net::TestNetLog test_net_log;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
net::TestCompletionCallback callback;
std::unique_ptr<net::FuzzedSocket> fuzzed_socket(
diff --git a/net/socket/socks_client_socket_fuzzer.cc b/net/socket/socks_client_socket_fuzzer.cc
index 6f300f9..be5764c 100644
--- a/net/socket/socks_client_socket_fuzzer.cc
+++ b/net/socket/socks_client_socket_fuzzer.cc
@@ -8,7 +8,6 @@
#include <memory>
#include "base/logging.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/address_list.h"
#include "net/base/net_errors.h"
#include "net/base/test_completion_callback.h"
@@ -18,6 +17,7 @@
#include "net/socket/fuzzed_socket.h"
#include "net/socket/socks_client_socket.h"
#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Fuzzer for SocksClientSocket. Only covers the SOCKS4 handshake.
//
@@ -27,7 +27,7 @@
// Use a test NetLog, to exercise logging code.
net::TestNetLog test_net_log;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
// Determine if the DNS lookup returns synchronously or asynchronously,
// succeeds or fails, and returns an IPv4 or IPv6 address.
diff --git a/net/spdy/fuzzing/hpack_decoder_fuzzer.cc b/net/spdy/fuzzing/hpack_decoder_fuzzer.cc
index 16df5e0..1c481d6 100644
--- a/net/spdy/fuzzing/hpack_decoder_fuzzer.cc
+++ b/net/spdy/fuzzing/hpack_decoder_fuzzer.cc
@@ -8,8 +8,8 @@
#include <list>
#include <vector>
-#include "base/test/fuzzed_data_provider.h"
#include "net/third_party/quiche/src/http2/hpack/decoder/hpack_decoder.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
@@ -17,7 +17,7 @@
if (size < 4)
return 0;
- base::FuzzedDataProvider fuzzed_data_provider(data, size);
+ FuzzedDataProvider fuzzed_data_provider(data, size);
size_t max_string_size =
fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 10 * size);
http2::HpackDecoder decoder(http2::HpackDecoderNoOpListener::NoOpListener(),
diff --git a/net/spdy/fuzzing/http2_frame_decoder_fuzzer.cc b/net/spdy/fuzzing/http2_frame_decoder_fuzzer.cc
index f89de197..3941773 100644
--- a/net/spdy/fuzzing/http2_frame_decoder_fuzzer.cc
+++ b/net/spdy/fuzzing/http2_frame_decoder_fuzzer.cc
@@ -8,12 +8,12 @@
#include <list>
#include <vector>
-#include "base/test/fuzzed_data_provider.h"
#include "net/third_party/quiche/src/http2/decoder/http2_frame_decoder.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider fuzzed_data_provider(data, size);
+ FuzzedDataProvider fuzzed_data_provider(data, size);
http2::Http2FrameDecoder decoder;
// Store all chunks in a function scope list, as the API requires the caller
diff --git a/net/spdy/spdy_session_fuzzer.cc b/net/spdy/spdy_session_fuzzer.cc
index 417cd9a..8f42b451 100644
--- a/net/spdy/spdy_session_fuzzer.cc
+++ b/net/spdy/spdy_session_fuzzer.cc
@@ -5,7 +5,6 @@
#include "base/logging.h"
#include "base/run_loop.h"
#include "base/stl_util.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/host_port_pair.h"
#include "net/base/net_errors.h"
#include "net/base/request_priority.h"
@@ -19,6 +18,7 @@
#include "net/spdy/spdy_test_util_common.h"
#include "net/ssl/ssl_config.h"
#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace {
@@ -59,7 +59,7 @@
class FuzzedSocketFactoryWithMockSSLData : public FuzzedSocketFactory {
public:
explicit FuzzedSocketFactoryWithMockSSLData(
- base::FuzzedDataProvider* data_provider);
+ FuzzedDataProvider* data_provider);
void AddSSLSocketDataProvider(SSLSocketDataProvider* socket);
@@ -74,7 +74,7 @@
};
FuzzedSocketFactoryWithMockSSLData::FuzzedSocketFactoryWithMockSSLData(
- base::FuzzedDataProvider* data_provider)
+ FuzzedDataProvider* data_provider)
: FuzzedSocketFactory(data_provider) {}
void FuzzedSocketFactoryWithMockSSLData::AddSSLSocketDataProvider(
@@ -102,7 +102,7 @@
// |data| is used to create a FuzzedServerSocket.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
net::BoundTestNetLog bound_test_net_log;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
net::FuzzedSocketFactoryWithMockSSLData socket_factory(&data_provider);
socket_factory.set_fuzz_connect_result(false);
diff --git a/net/third_party/uri_template/uri_template_fuzzer.cc b/net/third_party/uri_template/uri_template_fuzzer.cc
index e444a0f..148dbba 100644
--- a/net/third_party/uri_template/uri_template_fuzzer.cc
+++ b/net/third_party/uri_template/uri_template_fuzzer.cc
@@ -4,11 +4,11 @@
#include "net/third_party/uri_template/uri_template.h"
-#include "base/test/fuzzed_data_provider.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider fuzzed_data(data, size);
+ FuzzedDataProvider fuzzed_data(data, size);
std::string uri_template = fuzzed_data.ConsumeRandomLengthString(256);
// Construct a map containing variable names and corresponding values.
std::unordered_map<std::string, std::string> parameters;
diff --git a/net/url_request/url_request_data_job_fuzzer.cc b/net/url_request/url_request_data_job_fuzzer.cc
index 1d119c9..0bf92f81 100644
--- a/net/url_request/url_request_data_job_fuzzer.cc
+++ b/net/url_request/url_request_data_job_fuzzer.cc
@@ -9,7 +9,6 @@
#include "base/memory/singleton.h"
#include "base/run_loop.h"
-#include "base/test/fuzzed_data_provider.h"
#include "base/threading/thread_task_runner_handle.h"
#include "net/http/http_request_headers.h"
#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
@@ -17,6 +16,7 @@
#include "net/url_request/url_request.h"
#include "net/url_request/url_request_job_factory_impl.h"
#include "net/url_request/url_request_test_util.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace {
@@ -43,7 +43,7 @@
}
int CreateAndReadFromDataURLRequest(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider provider(data, size);
+ FuzzedDataProvider provider(data, size);
read_lengths_.clear();
// Allocate an IOBuffer with fuzzed size.
diff --git a/net/url_request/url_request_ftp_fuzzer.cc b/net/url_request/url_request_ftp_fuzzer.cc
index e0f16dc..f2a9e8cf 100644
--- a/net/url_request/url_request_ftp_fuzzer.cc
+++ b/net/url_request/url_request_ftp_fuzzer.cc
@@ -7,7 +7,6 @@
#include "base/macros.h"
#include "base/run_loop.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/request_priority.h"
#include "net/dns/context_host_resolver.h"
#include "net/dns/fuzzed_host_resolver_util.h"
@@ -22,6 +21,7 @@
#include "net/url_request/url_request_context.h"
#include "net/url_request/url_request_job_factory_impl.h"
#include "net/url_request/url_request_test_util.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
#include "url/gurl.h"
namespace {
@@ -54,7 +54,7 @@
// Integration fuzzer for URLRequestFtpJob.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
net::TestURLRequestContext url_request_context(true);
net::FuzzedSocketFactory fuzzed_socket_factory(&data_provider);
url_request_context.set_client_socket_factory(&fuzzed_socket_factory);
diff --git a/net/url_request/url_request_fuzzer.cc b/net/url_request/url_request_fuzzer.cc
index a8fb3ab..e53ac14 100644
--- a/net/url_request/url_request_fuzzer.cc
+++ b/net/url_request/url_request_fuzzer.cc
@@ -10,13 +10,13 @@
#include <memory>
#include "base/run_loop.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/request_priority.h"
#include "net/socket/fuzzed_socket_factory.h"
#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
#include "net/url_request/url_request.h"
#include "net/url_request/url_request_context.h"
#include "net/url_request/url_request_test_util.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
#include "url/gurl.h"
@@ -35,7 +35,7 @@
if (size > kMaxInputSize)
return 0;
- base::FuzzedDataProvider data_provider(data, size);
+ FuzzedDataProvider data_provider(data, size);
net::TestURLRequestContext url_request_context(true);
net::FuzzedSocketFactory fuzzed_socket_factory(&data_provider);
url_request_context.set_client_socket_factory(&fuzzed_socket_factory);
diff --git a/net/websockets/websocket_deflate_stream_fuzzer.cc b/net/websockets/websocket_deflate_stream_fuzzer.cc
index 195ad38..3c20868 100644
--- a/net/websockets/websocket_deflate_stream_fuzzer.cc
+++ b/net/websockets/websocket_deflate_stream_fuzzer.cc
@@ -12,7 +12,6 @@
#include "base/memory/scoped_refptr.h"
#include "base/strings/string_number_conversions.h"
#include "base/strings/string_piece.h"
-#include "base/test/fuzzed_data_provider.h"
#include "net/base/io_buffer.h"
#include "net/base/net_errors.h"
#include "net/websockets/websocket_deflate_parameters.h"
@@ -22,6 +21,7 @@
#include "net/websockets/websocket_extension.h"
#include "net/websockets/websocket_frame.h"
#include "net/websockets/websocket_stream.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
namespace net {
@@ -43,7 +43,7 @@
class WebSocketFuzzedStream final : public WebSocketStream {
public:
- explicit WebSocketFuzzedStream(base::FuzzedDataProvider* fuzzed_data_provider)
+ explicit WebSocketFuzzedStream(FuzzedDataProvider* fuzzed_data_provider)
: fuzzed_data_provider_(fuzzed_data_provider) {}
int ReadFrames(std::vector<std::unique_ptr<WebSocketFrame>>* frames,
@@ -90,11 +90,11 @@
return frame;
}
- base::FuzzedDataProvider* fuzzed_data_provider_;
+ FuzzedDataProvider* fuzzed_data_provider_;
};
void WebSocketDeflateStreamFuzz(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider fuzzed_data_provider(data, size);
+ FuzzedDataProvider fuzzed_data_provider(data, size);
uint8_t flags = fuzzed_data_provider.ConsumeIntegral<uint8_t>();
bool server_no_context_takeover = flags & 0x1;
bool client_no_context_takeover = (flags >> 1) & 0x1;
diff --git a/net/websockets/websocket_frame_parser_fuzzer.cc b/net/websockets/websocket_frame_parser_fuzzer.cc
index 90c5d92bc..acb3db3f 100644
--- a/net/websockets/websocket_frame_parser_fuzzer.cc
+++ b/net/websockets/websocket_frame_parser_fuzzer.cc
@@ -7,12 +7,12 @@
#include <vector>
-#include "base/test/fuzzed_data_provider.h"
#include "net/websockets/websocket_frame_parser.h"
+#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"
// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- base::FuzzedDataProvider fuzzed_data_provider(data, size);
+ FuzzedDataProvider fuzzed_data_provider(data, size);
net::WebSocketFrameParser parser;
std::vector<std::unique_ptr<net::WebSocketFrameChunk>> frame_chunks;
while (fuzzed_data_provider.remaining_bytes() > 0) {
diff --git a/testing/libfuzzer/getting_started.md b/testing/libfuzzer/getting_started.md
index 918723f..aec1f4b 100644
--- a/testing/libfuzzer/getting_started.md
+++ b/testing/libfuzzer/getting_started.md
@@ -302,8 +302,10 @@
}
```
-There is [base::FuzzedDataProvider] class that might be helpful for writing
-fuzz targets using that approach.
+There is [FuzzedDataProvider] class that might be helpful for writing fuzz
+targets using that approach. In order to use it, add
+`#include "third_party/libFuzzer/src/utils/FuzzedDataProvider.h"` to your fuzz
+target source file.
## Submitting Fuzz Target to ClusterFuzz
@@ -335,5 +337,5 @@
[Build Config]: reference.md#Builder-configurations
[its own documentation]: http://llvm.org/docs/LibFuzzer.html#output
[Getting Started with libprotobuf-mutator in Chromium]: libprotobuf-mutator.md
-[base::FuzzedDataProvider]: https://cs.chromium.org/chromium/src/base/test/fuzzed_data_provider.h
+[FuzzedDataProvider]: https://cs.chromium.org/chromium/src/third_party/libFuzzer/src/utils/FuzzedDataProvider.h
[code coverage report]: efficient_fuzzer.md#Code-Coverage
