54 lines
2.1 KiB
C++
54 lines
2.1 KiB
C++
// Copyright 2016 The Chromium Authors
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#include "net/base/mime_sniffer.h"
|
|
|
|
#include <stddef.h>
|
|
|
|
#include <string>
|
|
|
|
#include <fuzzer/FuzzedDataProvider.h>
|
|
|
|
#include "url/gurl.h"
|
|
|
|
// Fuzzer for the two main mime sniffing functions:
|
|
// SniffMimeType and SniffMimeTypeFromLocalData.
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
|
// net::SniffMimeType DCHECKs if passed an input buffer that's too large,
|
|
// since it's meant to be used only on the first chunk of a file that's being
|
|
// fed into a stream. Set a max size of the input to avoid running into that
|
|
// DCHECK. Use 64k because that's twice the size of a typical read attempt.
|
|
constexpr size_t kMaxSniffLength = 64 * 1024;
|
|
static_assert(kMaxSniffLength >= net::kMaxBytesToSniff,
|
|
"kMaxSniffLength is too small.");
|
|
|
|
FuzzedDataProvider data_provider(data, size);
|
|
|
|
// Divide up the input. It's important not to pass |url_string| to the GURL
|
|
// constructor until after the length check, to prevent the fuzzer from
|
|
// exploring GURL space with invalid inputs.
|
|
//
|
|
// Max lengths of URL and type hint are arbitrary.
|
|
std::string url_string = data_provider.ConsumeRandomLengthString(4 * 1024);
|
|
std::string mime_type_hint = data_provider.ConsumeRandomLengthString(1024);
|
|
net::ForceSniffFileUrlsForHtml force_sniff_file_urls_for_html =
|
|
data_provider.ConsumeBool() ? net::ForceSniffFileUrlsForHtml::kDisabled
|
|
: net::ForceSniffFileUrlsForHtml::kEnabled;
|
|
|
|
// Do nothing if remaining input is too long. An early exit prevents the
|
|
// fuzzer from exploring needlessly long inputs with interesting prefixes.
|
|
if (data_provider.remaining_bytes() > kMaxSniffLength)
|
|
return 0;
|
|
|
|
std::string input = data_provider.ConsumeRemainingBytesAsString();
|
|
|
|
std::string result;
|
|
net::SniffMimeType(input, GURL(url_string), mime_type_hint,
|
|
force_sniff_file_urls_for_html, &result);
|
|
|
|
net::SniffMimeTypeFromLocalData(input, &result);
|
|
|
|
return 0;
|
|
}
|