// Copyright 2015 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include #include #include "base/basictypes.h" #include "base/strings/string_util.h" #include "base/strings/utf_string_conversions.h" #include "tools/ipc_fuzzer/fuzzer/mutator.h" #include "tools/ipc_fuzzer/fuzzer/rand_util.h" namespace ipc_fuzzer { template void FuzzIntegralType(T* value, unsigned int frequency) { if (RandEvent(frequency)) { switch (RandInRange(4)) { case 0: (*value) = 0; break; case 1: (*value)--; break; case 2: (*value)++; break; case 3: (*value) = RandU64(); break; } } } template void FuzzStringType(T* value, unsigned int frequency, const T& literal1, const T& literal2) { if (RandEvent(frequency)) { switch (RandInRange(5)) { case 4: (*value) = (*value) + (*value); // FALLTHROUGH case 3: (*value) = (*value) + (*value); // FALLTHROUGH case 2: (*value) = (*value) + (*value); break; case 1: (*value) += literal1; break; case 0: (*value) = literal2; break; } } } void Mutator::FuzzBool(bool* value) { if (RandEvent(frequency_)) (*value) = !(*value); } void Mutator::FuzzInt(int* value) { FuzzIntegralType(value, frequency_); } void Mutator::FuzzLong(long* value) { FuzzIntegralType(value, frequency_); } void Mutator::FuzzSize(size_t* value) { FuzzIntegralType(value, frequency_); } void Mutator::FuzzUChar(unsigned char* value) { FuzzIntegralType(value, frequency_); } void Mutator::FuzzWChar(wchar_t* value) { FuzzIntegralType(value, frequency_); } void Mutator::FuzzUInt16(uint16* value) { FuzzIntegralType(value, frequency_); } void Mutator::FuzzUInt32(uint32* value) { FuzzIntegralType(value, frequency_); } void Mutator::FuzzInt64(int64* value) { FuzzIntegralType(value, frequency_); } void Mutator::FuzzUInt64(uint64* value) { FuzzIntegralType(value, frequency_); } void Mutator::FuzzFloat(float* value) { if (RandEvent(frequency_)) *value = RandDouble(); } void Mutator::FuzzDouble(double* value) { if (RandEvent(frequency_)) *value = RandDouble(); } void Mutator:: FuzzString(std::string* value) { FuzzStringType(value, frequency_, "BORKED", std::string()); } void Mutator::FuzzString16(base::string16* value) { FuzzStringType(value, frequency_, base::WideToUTF16(L"BORKED"), base::WideToUTF16(L"")); } void Mutator::FuzzData(char* data, int length) { if (RandEvent(frequency_)) { for (int i = 0; i < length; ++i) { FuzzIntegralType(&data[i], frequency_); } } } void Mutator::FuzzBytes(void* data, int data_len) { FuzzData(static_cast(data), data_len); } bool Mutator::ShouldGenerate() { // TODO(mbarbella): With a low probability, allow something to be fully // rewritten while mutating instead of always changing the existing value. return false; } } // namespace ipc_fuzzer