net/spdy/fuzzing/hpack_fuzz_mutator.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/command_line.h"
   6 #include "base/files/file.h"
   7 #include "base/files/file_util.h"
   8 #include "base/strings/string_number_conversions.h"
   9 #include "net/spdy/fuzzing/hpack_fuzz_util.h"
  10
  11 namespace {
  12
  13 // Specifies a file having HPACK header sets.
  14 const char kFileToParse[] = "file-to-parse";
  15
  16 // Target file for mutated HPACK header sets.
  17 const char kFileToWrite[] = "file-to-write";
  18
  19 // Number of bits to flip per 1,024 bytes of input.
  20 const char kFlipsPerThousand[] = "flips-per-thousand-bytes";
  21
  22 }  // namespace
  23
  24 using base::StringPiece;
  25 using net::HpackFuzzUtil;
  26 using std::string;
  27
  28 // Reads length-prefixed input blocks, applies a bit-flipping mutation to each
  29 // block, and writes length-prefixed blocks to the output file. While blocks
  30 // themselves are mutated, the length-prefixes of written blocks are not.
  31 int main(int argc, char** argv) {
  32   base::CommandLine::Init(argc, argv);
  33   const base::CommandLine& command_line =
  34       *base::CommandLine::ForCurrentProcess();
  35
  36   if (!command_line.HasSwitch(kFileToParse) ||
  37       !command_line.HasSwitch(kFileToWrite) ||
  38       !command_line.HasSwitch(kFlipsPerThousand)) {
  39     LOG(ERROR) << "Usage: " << argv[0]
  40                << " --" << kFileToParse << "=/path/to/file.in"
  41                << " --" << kFileToWrite << "=/path/to/file.out"
  42                << " --" << kFlipsPerThousand << "=10";
  43     return -1;
  44   }
  45   string file_to_parse = command_line.GetSwitchValueASCII(kFileToParse);
  46   string file_to_write = command_line.GetSwitchValueASCII(kFileToWrite);
  47
  48   int flip_ratio = 0;
  49   CHECK(base::StringToInt(command_line.GetSwitchValueASCII(kFlipsPerThousand),
  50                     &flip_ratio));
  51
  52   DVLOG(1) << "Reading input from " << file_to_parse;
  53   HpackFuzzUtil::Input input;
  54   CHECK(base::ReadFileToString(base::FilePath::FromUTF8Unsafe(file_to_parse),
  55                                &input.input));
  56
  57   DVLOG(1) << "Writing output to " << file_to_write;
  58   base::File file_out(base::FilePath::FromUTF8Unsafe(file_to_write),
  59                       base::File::FLAG_CREATE_ALWAYS | base::File::FLAG_WRITE);
  60   CHECK(file_out.IsValid()) << file_out.error_details();
  61
  62   DVLOG(1) << "Flipping " << flip_ratio << " bits per 1024 input bytes";
  63
  64   size_t block_count = 0;
  65   StringPiece block;
  66   while (HpackFuzzUtil::NextHeaderBlock(&input, &block)) {
  67     HpackFuzzUtil::FlipBits(
  68         reinterpret_cast<uint8*>(const_cast<char*>(block.data())),
  69         block.size(),
  70         flip_ratio);
  71
  72     string prefix = HpackFuzzUtil::HeaderBlockPrefix(block.size());
  73
  74     CHECK_LT(0, file_out.WriteAtCurrentPos(prefix.data(), prefix.size()));
  75     CHECK_LT(0, file_out.WriteAtCurrentPos(block.data(), block.size()));
  76     ++block_count;
  77   }
  78   CHECK(file_out.Flush());
  79   DVLOG(1) << "Mutated " << block_count << " blocks.";
  80   return 0;
  81 }