1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
|
// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <stdio.h>
#include <iostream>
#include <string>
#include <sstream>
#include "base/message_loop.h"
#include "base/platform_thread.h"
#include "base/process_util.h"
#include "ipc/ipc_channel.h"
#include "ipc/ipc_channel_proxy.h"
#include "ipc/ipc_message_utils.h"
#include "ipc/ipc_tests.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "testing/multiprocess_func_list.h"
TEST(IPCMessageIntegrity, ReadBeyondBufferStr) {
//This was BUG 984408.
uint32 v1 = kuint32max - 1;
int v2 = 666;
IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
EXPECT_TRUE(m.WriteInt(v1));
EXPECT_TRUE(m.WriteInt(v2));
void* iter = NULL;
std::string vs;
EXPECT_FALSE(m.ReadString(&iter, &vs));
}
TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) {
//This was BUG 984408.
uint32 v1 = kuint32max - 1;
int v2 = 777;
IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
EXPECT_TRUE(m.WriteInt(v1));
EXPECT_TRUE(m.WriteInt(v2));
void* iter = NULL;
std::wstring vs;
EXPECT_FALSE(m.ReadWString(&iter, &vs));
}
TEST(IPCMessageIntegrity, ReadBytesBadIterator) {
// This was BUG 1035467.
IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
EXPECT_TRUE(m.WriteInt(1));
EXPECT_TRUE(m.WriteInt(2));
void* iter = NULL;
const char* data = NULL;
EXPECT_FALSE(m.ReadBytes(&iter, &data, sizeof(int)));
}
TEST(IPCMessageIntegrity, ReadVectorNegativeSize) {
// A slight variation of BUG 984408. Note that the pickling of vector<char>
// has a specialized template which is not vulnerable to this bug. So here
// try to hit the non-specialized case vector<P>.
IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
EXPECT_TRUE(m.WriteInt(-1)); // This is the count of elements.
EXPECT_TRUE(m.WriteInt(1));
EXPECT_TRUE(m.WriteInt(2));
EXPECT_TRUE(m.WriteInt(3));
std::vector<double> vec;
void* iter = 0;
EXPECT_FALSE(ReadParam(&m, &iter, &vec));
}
TEST(IPCMessageIntegrity, ReadVectorTooLarge1) {
// This was BUG 1006367. This is the large but positive length case. Again
// we try to hit the non-specialized case vector<P>.
IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
EXPECT_TRUE(m.WriteInt(0x21000003)); // This is the count of elements.
EXPECT_TRUE(m.WriteInt64(1));
EXPECT_TRUE(m.WriteInt64(2));
std::vector<int64> vec;
void* iter = 0;
EXPECT_FALSE(ReadParam(&m, &iter, &vec));
}
TEST(IPCMessageIntegrity, ReadVectorTooLarge2) {
// This was BUG 1006367. This is the large but positive with an additional
// integer overflow when computing the actual byte size. Again we try to hit
// the non-specialized case vector<P>.
IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
EXPECT_TRUE(m.WriteInt(0x71000000)); // This is the count of elements.
EXPECT_TRUE(m.WriteInt64(1));
EXPECT_TRUE(m.WriteInt64(2));
std::vector<int64> vec;
void* iter = 0;
EXPECT_FALSE(ReadParam(&m, &iter, &vec));
}
// We don't actually use the messages defined in this file, but we do this
// to get to the IPC macros.
#if 0
// This for tools which parse #include lines, but cannot process when we
// include via a macro name.
#include "ipc/ipc_sync_message_unittest.h"
#endif
#define MESSAGES_INTERNAL_FILE "ipc/ipc_sync_message_unittest.h"
#include "ipc/ipc_message_macros.h"
enum IPCMessageIds {
UNUSED_IPC_TYPE,
SERVER_FIRST_IPC_TYPE, // 1st Test message tag.
SERVER_SECOND_IPC_TYPE, // 2nd Test message tag.
SERVER_THIRD_IPC_TYPE, // 3rd Test message tag.
CLIENT_MALFORMED_IPC, // Sent to client if server detects bad message.
CLIENT_UNHANDLED_IPC // Sent to client if server detects unhanded IPC.
};
// Generic message class that is an int followed by a wstring.
class MsgClassIS : public IPC::MessageWithTuple< Tuple2<int, std::wstring> > {
public:
enum { ID = SERVER_FIRST_IPC_TYPE };
MsgClassIS(const int& arg1, const std::wstring& arg2)
: IPC::MessageWithTuple< Tuple2<int, std::wstring> >(
MSG_ROUTING_CONTROL, ID, MakeTuple(arg1, arg2)) {}
};
// Generic message class that is a wstring followed by an int.
class MsgClassSI : public IPC::MessageWithTuple< Tuple2<std::wstring, int> > {
public:
enum { ID = SERVER_SECOND_IPC_TYPE };
MsgClassSI(const std::wstring& arg1, const int& arg2)
: IPC::MessageWithTuple< Tuple2<std::wstring, int> >(
MSG_ROUTING_CONTROL, ID, MakeTuple(arg1, arg2)) {}
};
// Message to create a mutex in the IPC server, using the received name.
class MsgDoMutex : public IPC::MessageWithTuple< Tuple2<std::wstring, int> > {
public:
enum { ID = SERVER_THIRD_IPC_TYPE };
MsgDoMutex(const std::wstring& mutex_name, const int& unused)
: IPC::MessageWithTuple< Tuple2<std::wstring, int> >(
MSG_ROUTING_CONTROL, ID, MakeTuple(mutex_name, unused)) {}
};
class SimpleListener : public IPC::Channel::Listener {
public:
SimpleListener() : other_(NULL) {
}
void Init(IPC::Message::Sender* s) {
other_ = s;
}
protected:
IPC::Message::Sender* other_;
};
enum {
FUZZER_ROUTING_ID = 5
};
// The fuzzer server class. It runs in a child process and expects
// only two IPC calls; after that it exits the message loop which
// terminates the child process.
class FuzzerServerListener : public SimpleListener {
public:
FuzzerServerListener() : message_count_(2), pending_messages_(0) {
}
virtual void OnMessageReceived(const IPC::Message& msg) {
if (msg.routing_id() == MSG_ROUTING_CONTROL) {
++pending_messages_;
IPC_BEGIN_MESSAGE_MAP(FuzzerServerListener, msg)
IPC_MESSAGE_HANDLER(MsgClassIS, OnMsgClassISMessage)
IPC_MESSAGE_HANDLER(MsgClassSI, OnMsgClassSIMessage)
IPC_END_MESSAGE_MAP()
if (pending_messages_) {
// Probably a problem de-serializing the message.
ReplyMsgNotHandled(msg.type());
}
}
}
private:
void OnMsgClassISMessage(int value, const std::wstring& text) {
UseData(MsgClassIS::ID, value, text);
RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassIS::ID, value);
Cleanup();
}
void OnMsgClassSIMessage(const std::wstring& text, int value) {
UseData(MsgClassSI::ID, value, text);
RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value);
Cleanup();
}
bool RoundtripAckReply(int routing, int type_id, int reply) {
IPC::Message* message = new IPC::Message(routing, type_id,
IPC::Message::PRIORITY_NORMAL);
message->WriteInt(reply + 1);
message->WriteInt(reply);
return other_->Send(message);
}
void Cleanup() {
--message_count_;
--pending_messages_;
if (0 == message_count_)
MessageLoop::current()->Quit();
}
void ReplyMsgNotHandled(int type_id) {
RoundtripAckReply(FUZZER_ROUTING_ID, CLIENT_UNHANDLED_IPC, type_id);
Cleanup();
}
void UseData(int caller, int value, const std::wstring& text) {
std::wostringstream wos;
wos << L"IPC fuzzer:" << caller << " [" << value << L" " << text << L"]\n";
std::wstring output = wos.str();
LOG(WARNING) << output.c_str();
};
int message_count_;
int pending_messages_;
};
class FuzzerClientListener : public SimpleListener {
public:
FuzzerClientListener() : last_msg_(NULL) {
}
virtual void OnMessageReceived(const IPC::Message& msg) {
last_msg_ = new IPC::Message(msg);
MessageLoop::current()->Quit();
}
bool ExpectMessage(int value, int type_id) {
if (!MsgHandlerInternal(type_id))
return false;
int msg_value1 = 0;
int msg_value2 = 0;
void* iter = NULL;
if (!last_msg_->ReadInt(&iter, &msg_value1))
return false;
if (!last_msg_->ReadInt(&iter, &msg_value2))
return false;
if ((msg_value2 + 1) != msg_value1)
return false;
if (msg_value2 != value)
return false;
delete last_msg_;
last_msg_ = NULL;
return true;
}
bool ExpectMsgNotHandled(int type_id) {
return ExpectMessage(type_id, CLIENT_UNHANDLED_IPC);
}
private:
bool MsgHandlerInternal(int type_id) {
MessageLoop::current()->Run();
if (NULL == last_msg_)
return false;
if (FUZZER_ROUTING_ID != last_msg_->routing_id())
return false;
return (type_id == last_msg_->type());
};
IPC::Message* last_msg_;
};
// Runs the fuzzing server child mode. Returns when the preset number
// of messages have been received.
MULTIPROCESS_TEST_MAIN(RunFuzzServer) {
MessageLoopForIO main_message_loop;
FuzzerServerListener listener;
IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_CLIENT, &listener);
chan.Connect();
listener.Init(&chan);
MessageLoop::current()->Run();
return 0;
}
class IPCFuzzingTest : public IPCChannelTest {
};
// This test makes sure that the FuzzerClientListener and FuzzerServerListener
// are working properly by generating two well formed IPC calls.
TEST_F(IPCFuzzingTest, SanityTest) {
FuzzerClientListener listener;
IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER,
&listener);
base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan);
ASSERT_TRUE(server_process);
PlatformThread::Sleep(1000);
ASSERT_TRUE(chan.Connect());
listener.Init(&chan);
IPC::Message* msg = NULL;
int value = 43;
msg = new MsgClassIS(value, L"expect 43");
chan.Send(msg);
EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID));
msg = new MsgClassSI(L"expect 44", ++value);
chan.Send(msg);
EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID));
EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000));
base::CloseProcessHandle(server_process);
}
// This test uses a payload that is smaller than expected.
// This generates an error while unpacking the IPC buffer which in
// In debug this triggers an assertion and in release it is ignored(!!). Right
// after we generate another valid IPC to make sure framing is working
// properly.
#ifdef NDEBUG
TEST_F(IPCFuzzingTest, MsgBadPayloadShort) {
FuzzerClientListener listener;
IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER,
&listener);
base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan);
ASSERT_TRUE(server_process);
PlatformThread::Sleep(1000);
ASSERT_TRUE(chan.Connect());
listener.Init(&chan);
IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID,
IPC::Message::PRIORITY_NORMAL);
msg->WriteInt(666);
chan.Send(msg);
EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID));
msg = new MsgClassSI(L"expect one", 1);
chan.Send(msg);
EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID));
EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000));
base::CloseProcessHandle(server_process);
}
#endif // NDEBUG
// This test uses a payload that has too many arguments, but so the payload
// size is big enough so the unpacking routine does not generate an error as
// in the case of MsgBadPayloadShort test.
// This test does not pinpoint a flaw (per se) as by design we don't carry
// type information on the IPC message.
TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) {
FuzzerClientListener listener;
IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER,
&listener);
base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan);
ASSERT_TRUE(server_process);
PlatformThread::Sleep(1000);
ASSERT_TRUE(chan.Connect());
listener.Init(&chan);
IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID,
IPC::Message::PRIORITY_NORMAL);
msg->WriteWString(L"d");
msg->WriteInt(0);
msg->WriteInt(0x65); // Extra argument.
chan.Send(msg);
EXPECT_TRUE(listener.ExpectMessage(0, MsgClassSI::ID));
// Now send a well formed message to make sure the receiver wasn't
// thrown out of sync by the extra argument.
msg = new MsgClassIS(3, L"expect three");
chan.Send(msg);
EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID));
EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000));
base::CloseProcessHandle(server_process);
}
// This class is for testing the IPC_BEGIN_MESSAGE_MAP_EX macros.
class ServerMacroExTest {
public:
ServerMacroExTest() : unhandled_msgs_(0) {
}
virtual bool OnMessageReceived(const IPC::Message& msg) {
bool msg_is_ok = false;
IPC_BEGIN_MESSAGE_MAP_EX(ServerMacroExTest, msg, msg_is_ok)
IPC_MESSAGE_HANDLER(MsgClassIS, OnMsgClassISMessage)
IPC_MESSAGE_HANDLER(MsgClassSI, OnMsgClassSIMessage)
IPC_MESSAGE_UNHANDLED(++unhandled_msgs_)
IPC_END_MESSAGE_MAP_EX()
return msg_is_ok;
}
int unhandled_msgs() const {
return unhandled_msgs_;
}
private:
void OnMsgClassISMessage(int value, const std::wstring& text) {
}
void OnMsgClassSIMessage(const std::wstring& text, int value) {
}
int unhandled_msgs_;
};
TEST_F(IPCFuzzingTest, MsgMapExMacro) {
IPC::Message* msg = NULL;
ServerMacroExTest server;
// Test the regular messages.
msg = new MsgClassIS(3, L"text3");
EXPECT_TRUE(server.OnMessageReceived(*msg));
delete msg;
msg = new MsgClassSI(L"text2", 2);
EXPECT_TRUE(server.OnMessageReceived(*msg));
delete msg;
#ifdef NDEBUG
// Test a bad message.
msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID,
IPC::Message::PRIORITY_NORMAL);
msg->WriteInt(2);
EXPECT_FALSE(server.OnMessageReceived(*msg));
delete msg;
msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID,
IPC::Message::PRIORITY_NORMAL);
msg->WriteInt(0x64);
msg->WriteInt(0x32);
EXPECT_FALSE(server.OnMessageReceived(*msg));
delete msg;
EXPECT_EQ(0, server.unhandled_msgs());
#endif
}
|