Adds a basic fuzzer for Http2DecoderAdapter.

Future improvements could include a dictionary or corpus. PiperOrigin-RevId: 536418050
google · May 30, 2023 · 31bbf1d · 31bbf1d
1 parent 8294639
commit 31bbf1d
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 1 deletion.
diff --git a/build/source_list.bzl b/build/source_list.bzl
@@ -1328,6 +1328,7 @@ fuzzers_srcs = [
     "quic/core/qpack/fuzzer/qpack_round_trip_fuzzer.cc",
     "quic/test_tools/fuzzing/quic_framer_fuzzer.cc",
     "quic/test_tools/fuzzing/quic_framer_process_data_packet_fuzzer.cc",
+    "spdy/core/http2_frame_decoder_adapter_fuzzer.cc",
 ]
 cli_tools_hdrs = [
     "quic/tools/quic_server_factory.h",

diff --git a/build/source_list.gni b/build/source_list.gni
@@ -1328,6 +1328,7 @@ fuzzers_srcs = [
     "src/quiche/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer.cc",
     "src/quiche/quic/test_tools/fuzzing/quic_framer_fuzzer.cc",
     "src/quiche/quic/test_tools/fuzzing/quic_framer_process_data_packet_fuzzer.cc",
+    "src/quiche/spdy/core/http2_frame_decoder_adapter_fuzzer.cc",
 ]
 cli_tools_hdrs = [
     "src/quiche/quic/tools/quic_server_factory.h",

diff --git a/build/source_list.json b/build/source_list.json
@@ -1326,7 +1326,8 @@
     "quiche/quic/core/qpack/fuzzer/qpack_encoder_stream_sender_fuzzer.cc",
     "quiche/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer.cc",
     "quiche/quic/test_tools/fuzzing/quic_framer_fuzzer.cc",
-    "quiche/quic/test_tools/fuzzing/quic_framer_process_data_packet_fuzzer.cc"
+    "quiche/quic/test_tools/fuzzing/quic_framer_process_data_packet_fuzzer.cc",
+    "quiche/spdy/core/http2_frame_decoder_adapter_fuzzer.cc"
   ],
   "cli_tools_hdrs": [
     "quiche/quic/tools/quic_server_factory.h",

diff --git a/quiche/spdy/core/http2_frame_decoder_adapter_fuzzer.cc b/quiche/spdy/core/http2_frame_decoder_adapter_fuzzer.cc
@@ -0,0 +1,13 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "quiche/spdy/core/http2_frame_decoder_adapter.h"
+#include "quiche/spdy/core/spdy_no_op_visitor.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  spdy::SpdyNoOpVisitor visitor;
+  http2::Http2DecoderAdapter decoder;
+  decoder.set_visitor(&visitor);
+  decoder.ProcessInput(reinterpret_cast<const char *>(data), size);
+  return 0;  // Always return 0; other values are reserved for future uses.
+}