ipc/ipc_fuzzing_tests.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <stdio.h>
   6 #include <string>
   7 #include <sstream>
   8
   9 #include "base/message_loop.h"
  10 #include "base/process_util.h"
  11 #include "base/threading/platform_thread.h"
  12 #include "ipc/ipc_channel.h"
  13 #include "ipc/ipc_channel_proxy.h"
  14 #include "ipc/ipc_tests.h"
  15 #include "testing/gtest/include/gtest/gtest.h"
  16 #include "testing/multiprocess_func_list.h"
  17
  18 // IPC messages for testing ---------------------------------------------------
  19
  20 #define IPC_MESSAGE_IMPL
  21 #include "ipc/ipc_message_macros.h"
  22
  23 #define IPC_MESSAGE_START TestMsgStart
  24
  25 // Generic message class that is an int followed by a wstring.
  26 IPC_MESSAGE_CONTROL2(MsgClassIS, int, std::wstring)
  27
  28 // Generic message class that is a wstring followed by an int.
  29 IPC_MESSAGE_CONTROL2(MsgClassSI, std::wstring, int)
  30
  31 // Message to create a mutex in the IPC server, using the received name.
  32 IPC_MESSAGE_CONTROL2(MsgDoMutex, std::wstring, int)
  33
  34 // Used to generate an ID for a message that should not exist.
  35 IPC_MESSAGE_CONTROL0(MsgUnhandled)
  36
  37 // ----------------------------------------------------------------------------
  38
  39 TEST(IPCMessageIntegrity, ReadBeyondBufferStr) {
  40   //This was BUG 984408.
  41   uint32 v1 = kuint32max - 1;
  42   int v2 = 666;
  43   IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
  44   EXPECT_TRUE(m.WriteInt(v1));
  45   EXPECT_TRUE(m.WriteInt(v2));
  46
  47   PickleIterator iter(m);
  48   std::string vs;
  49   EXPECT_FALSE(m.ReadString(&iter, &vs));
  50 }
  51
  52 TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) {
  53   //This was BUG 984408.
  54   uint32 v1 = kuint32max - 1;
  55   int v2 = 777;
  56   IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
  57   EXPECT_TRUE(m.WriteInt(v1));
  58   EXPECT_TRUE(m.WriteInt(v2));
  59
  60   PickleIterator iter(m);
  61   std::wstring vs;
  62   EXPECT_FALSE(m.ReadWString(&iter, &vs));
  63 }
  64
  65 TEST(IPCMessageIntegrity, ReadBytesBadIterator) {
  66   // This was BUG 1035467.
  67   IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
  68   EXPECT_TRUE(m.WriteInt(1));
  69   EXPECT_TRUE(m.WriteInt(2));
  70
  71   PickleIterator iter(m);
  72   const char* data = NULL;
  73   EXPECT_TRUE(m.ReadBytes(&iter, &data, sizeof(int)));
  74 }
  75
  76 TEST(IPCMessageIntegrity, ReadVectorNegativeSize) {
  77   // A slight variation of BUG 984408. Note that the pickling of vector<char>
  78   // has a specialized template which is not vulnerable to this bug. So here
  79   // try to hit the non-specialized case vector<P>.
  80   IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
  81   EXPECT_TRUE(m.WriteInt(-1));   // This is the count of elements.
  82   EXPECT_TRUE(m.WriteInt(1));
  83   EXPECT_TRUE(m.WriteInt(2));
  84   EXPECT_TRUE(m.WriteInt(3));
  85
  86   std::vector<double> vec;
  87   PickleIterator iter(m);
  88   EXPECT_FALSE(ReadParam(&m, &iter, &vec));
  89 }
  90
  91 TEST(IPCMessageIntegrity, ReadVectorTooLarge1) {
  92   // This was BUG 1006367. This is the large but positive length case. Again
  93   // we try to hit the non-specialized case vector<P>.
  94   IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
  95   EXPECT_TRUE(m.WriteInt(0x21000003));   // This is the count of elements.
  96   EXPECT_TRUE(m.WriteInt64(1));
  97   EXPECT_TRUE(m.WriteInt64(2));
  98
  99   std::vector<int64> vec;
 100   PickleIterator iter(m);
 101   EXPECT_FALSE(ReadParam(&m, &iter, &vec));
 102 }
 103
 104 TEST(IPCMessageIntegrity, ReadVectorTooLarge2) {
 105   // This was BUG 1006367. This is the large but positive with an additional
 106   // integer overflow when computing the actual byte size. Again we try to hit
 107   // the non-specialized case vector<P>.
 108   IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL);
 109   EXPECT_TRUE(m.WriteInt(0x71000000));   // This is the count of elements.
 110   EXPECT_TRUE(m.WriteInt64(1));
 111   EXPECT_TRUE(m.WriteInt64(2));
 112
 113   std::vector<int64> vec;
 114   PickleIterator iter(m);
 115   EXPECT_FALSE(ReadParam(&m, &iter, &vec));
 116 }
 117
 118 class SimpleListener : public IPC::Channel::Listener {
 119  public:
 120   SimpleListener() : other_(NULL) {
 121   }
 122   void Init(IPC::Message::Sender* s) {
 123     other_ = s;
 124   }
 125  protected:
 126   IPC::Message::Sender* other_;
 127 };
 128
 129 enum {
 130   FUZZER_ROUTING_ID = 5
 131 };
 132
 133 // The fuzzer server class. It runs in a child process and expects
 134 // only two IPC calls; after that it exits the message loop which
 135 // terminates the child process.
 136 class FuzzerServerListener : public SimpleListener {
 137  public:
 138   FuzzerServerListener() : message_count_(2), pending_messages_(0) {
 139   }
 140   virtual bool OnMessageReceived(const IPC::Message& msg) {
 141     if (msg.routing_id() == MSG_ROUTING_CONTROL) {
 142       ++pending_messages_;
 143       IPC_BEGIN_MESSAGE_MAP(FuzzerServerListener, msg)
 144         IPC_MESSAGE_HANDLER(MsgClassIS, OnMsgClassISMessage)
 145         IPC_MESSAGE_HANDLER(MsgClassSI, OnMsgClassSIMessage)
 146       IPC_END_MESSAGE_MAP()
 147       if (pending_messages_) {
 148         // Probably a problem de-serializing the message.
 149         ReplyMsgNotHandled(msg.type());
 150       }
 151     }
 152     return true;
 153   }
 154
 155  private:
 156   void OnMsgClassISMessage(int value, const std::wstring& text) {
 157     UseData(MsgClassIS::ID, value, text);
 158     RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassIS::ID, value);
 159     Cleanup();
 160   }
 161
 162   void OnMsgClassSIMessage(const std::wstring& text, int value) {
 163     UseData(MsgClassSI::ID, value, text);
 164     RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value);
 165     Cleanup();
 166   }
 167
 168   bool RoundtripAckReply(int routing, uint32 type_id, int reply) {
 169     IPC::Message* message = new IPC::Message(routing, type_id,
 170                                              IPC::Message::PRIORITY_NORMAL);
 171     message->WriteInt(reply + 1);
 172     message->WriteInt(reply);
 173     return other_->Send(message);
 174   }
 175
 176   void Cleanup() {
 177     --message_count_;
 178     --pending_messages_;
 179     if (0 == message_count_)
 180       MessageLoop::current()->Quit();
 181   }
 182
 183   void ReplyMsgNotHandled(uint32 type_id) {
 184     RoundtripAckReply(FUZZER_ROUTING_ID, MsgUnhandled::ID, type_id);
 185     Cleanup();
 186   }
 187
 188   void UseData(int caller, int value, const std::wstring& text) {
 189     std::wostringstream wos;
 190     wos << L"IPC fuzzer:" << caller << " [" << value << L" " << text << L"]\n";
 191     std::wstring output = wos.str();
 192     LOG(WARNING) << output.c_str();
 193   };
 194
 195   int message_count_;
 196   int pending_messages_;
 197 };
 198
 199 class FuzzerClientListener : public SimpleListener {
 200  public:
 201   FuzzerClientListener() : last_msg_(NULL) {
 202   }
 203
 204   virtual bool OnMessageReceived(const IPC::Message& msg) {
 205     last_msg_ = new IPC::Message(msg);
 206     MessageLoop::current()->Quit();
 207     return true;
 208   }
 209
 210   bool ExpectMessage(int value, uint32 type_id) {
 211     if (!MsgHandlerInternal(type_id))
 212       return false;
 213     int msg_value1 = 0;
 214     int msg_value2 = 0;
 215     PickleIterator iter(*last_msg_);
 216     if (!last_msg_->ReadInt(&iter, &msg_value1))
 217       return false;
 218     if (!last_msg_->ReadInt(&iter, &msg_value2))
 219       return false;
 220     if ((msg_value2 + 1) != msg_value1)
 221       return false;
 222     if (msg_value2 != value)
 223       return false;
 224
 225     delete last_msg_;
 226     last_msg_ = NULL;
 227     return true;
 228   }
 229
 230   bool ExpectMsgNotHandled(uint32 type_id) {
 231     return ExpectMessage(type_id, MsgUnhandled::ID);
 232   }
 233
 234  private:
 235   bool MsgHandlerInternal(uint32 type_id) {
 236     MessageLoop::current()->Run();
 237     if (NULL == last_msg_)
 238       return false;
 239     if (FUZZER_ROUTING_ID != last_msg_->routing_id())
 240       return false;
 241     return (type_id == last_msg_->type());
 242   };
 243
 244   IPC::Message* last_msg_;
 245 };
 246
 247 // Runs the fuzzing server child mode. Returns when the preset number
 248 // of messages have been received.
 249 MULTIPROCESS_TEST_MAIN(RunFuzzServer) {
 250   MessageLoopForIO main_message_loop;
 251   FuzzerServerListener listener;
 252   IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_CLIENT, &listener);
 253   CHECK(chan.Connect());
 254   listener.Init(&chan);
 255   MessageLoop::current()->Run();
 256   return 0;
 257 }
 258
 259 class IPCFuzzingTest : public IPCChannelTest {
 260 };
 261
 262 // This test makes sure that the FuzzerClientListener and FuzzerServerListener
 263 // are working properly by generating two well formed IPC calls.
 264 TEST_F(IPCFuzzingTest, SanityTest) {
 265   FuzzerClientListener listener;
 266   IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER,
 267                     &listener);
 268   base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan);
 269   ASSERT_TRUE(server_process);
 270   base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1));
 271   ASSERT_TRUE(chan.Connect());
 272   listener.Init(&chan);
 273
 274   IPC::Message* msg = NULL;
 275   int value = 43;
 276   msg = new MsgClassIS(value, L"expect 43");
 277   chan.Send(msg);
 278   EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID));
 279
 280   msg = new MsgClassSI(L"expect 44", ++value);
 281   chan.Send(msg);
 282   EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID));
 283
 284   EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000));
 285   base::CloseProcessHandle(server_process);
 286 }
 287
 288 // This test uses a payload that is smaller than expected.
 289 // This generates an error while unpacking the IPC buffer which in
 290 // In debug this triggers an assertion and in release it is ignored(!!). Right
 291 // after we generate another valid IPC to make sure framing is working
 292 // properly.
 293 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON)
 294 TEST_F(IPCFuzzingTest, MsgBadPayloadShort) {
 295   FuzzerClientListener listener;
 296   IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER,
 297                     &listener);
 298   base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan);
 299   ASSERT_TRUE(server_process);
 300   base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1));
 301   ASSERT_TRUE(chan.Connect());
 302   listener.Init(&chan);
 303
 304   IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID,
 305                                        IPC::Message::PRIORITY_NORMAL);
 306   msg->WriteInt(666);
 307   chan.Send(msg);
 308   EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID));
 309
 310   msg = new MsgClassSI(L"expect one", 1);
 311   chan.Send(msg);
 312   EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID));
 313
 314   EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000));
 315   base::CloseProcessHandle(server_process);
 316 }
 317 #endif
 318
 319 // This test uses a payload that has too many arguments, but so the payload
 320 // size is big enough so the unpacking routine does not generate an error as
 321 // in the case of MsgBadPayloadShort test.
 322 // This test does not pinpoint a flaw (per se) as by design we don't carry
 323 // type information on the IPC message.
 324 TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) {
 325   FuzzerClientListener listener;
 326   IPC::Channel chan(kFuzzerChannel, IPC::Channel::MODE_SERVER,
 327                     &listener);
 328   base::ProcessHandle server_process = SpawnChild(FUZZER_SERVER, &chan);
 329   ASSERT_TRUE(server_process);
 330   base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1));
 331   ASSERT_TRUE(chan.Connect());
 332   listener.Init(&chan);
 333
 334   IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID,
 335                                        IPC::Message::PRIORITY_NORMAL);
 336   msg->WriteWString(L"d");
 337   msg->WriteInt(0);
 338   msg->WriteInt(0x65);  // Extra argument.
 339
 340   chan.Send(msg);
 341   EXPECT_TRUE(listener.ExpectMessage(0, MsgClassSI::ID));
 342
 343   // Now send a well formed message to make sure the receiver wasn't
 344   // thrown out of sync by the extra argument.
 345   msg = new MsgClassIS(3, L"expect three");
 346   chan.Send(msg);
 347   EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID));
 348
 349   EXPECT_TRUE(base::WaitForSingleProcess(server_process, 5000));
 350   base::CloseProcessHandle(server_process);
 351 }
 352
 353 // This class is for testing the IPC_BEGIN_MESSAGE_MAP_EX macros.
 354 class ServerMacroExTest {
 355  public:
 356   ServerMacroExTest() : unhandled_msgs_(0) {
 357   }
 358
 359   virtual ~ServerMacroExTest() {
 360   }
 361
 362   virtual bool OnMessageReceived(const IPC::Message& msg) {
 363     bool msg_is_ok = false;
 364     IPC_BEGIN_MESSAGE_MAP_EX(ServerMacroExTest, msg, msg_is_ok)
 365       IPC_MESSAGE_HANDLER(MsgClassIS, OnMsgClassISMessage)
 366       IPC_MESSAGE_HANDLER(MsgClassSI, OnMsgClassSIMessage)
 367       IPC_MESSAGE_UNHANDLED(++unhandled_msgs_)
 368     IPC_END_MESSAGE_MAP_EX()
 369     return msg_is_ok;
 370   }
 371
 372   int unhandled_msgs() const {
 373     return unhandled_msgs_;
 374   }
 375
 376  private:
 377   void OnMsgClassISMessage(int value, const std::wstring& text) {
 378   }
 379   void OnMsgClassSIMessage(const std::wstring& text, int value) {
 380   }
 381
 382   int unhandled_msgs_;
 383
 384   DISALLOW_COPY_AND_ASSIGN(ServerMacroExTest);
 385 };
 386
 387 TEST_F(IPCFuzzingTest, MsgMapExMacro) {
 388   IPC::Message* msg = NULL;
 389   ServerMacroExTest server;
 390
 391   // Test the regular messages.
 392   msg = new MsgClassIS(3, L"text3");
 393   EXPECT_TRUE(server.OnMessageReceived(*msg));
 394   delete msg;
 395   msg = new MsgClassSI(L"text2", 2);
 396   EXPECT_TRUE(server.OnMessageReceived(*msg));
 397   delete msg;
 398
 399 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON)
 400   // Test a bad message.
 401   msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID,
 402                          IPC::Message::PRIORITY_NORMAL);
 403   msg->WriteInt(2);
 404   EXPECT_FALSE(server.OnMessageReceived(*msg));
 405   delete msg;
 406
 407   msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID,
 408                          IPC::Message::PRIORITY_NORMAL);
 409   msg->WriteInt(0x64);
 410   msg->WriteInt(0x32);
 411   EXPECT_FALSE(server.OnMessageReceived(*msg));
 412   delete msg;
 413
 414   EXPECT_EQ(0, server.unhandled_msgs());
 415 #endif
 416 }