1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
10 #include "base/message_loop.h"
11 #include "base/platform_thread.h"
12 #include "base/process_util.h"
13 #include "ipc/ipc_channel.h"
14 #include "ipc/ipc_channel_proxy.h"
15 #include "ipc/ipc_message_utils.h"
16 #include "ipc/ipc_tests.h"
17 #include "testing/gtest/include/gtest/gtest.h"
18 #include "testing/multiprocess_func_list.h"
20 TEST(IPCMessageIntegrity
, ReadBeyondBufferStr
) {
21 //This was BUG 984408.
22 uint32 v1
= kuint32max
- 1;
24 IPC::Message
m(0, 1, IPC::Message::PRIORITY_NORMAL
);
25 EXPECT_TRUE(m
.WriteInt(v1
));
26 EXPECT_TRUE(m
.WriteInt(v2
));
30 EXPECT_FALSE(m
.ReadString(&iter
, &vs
));
33 TEST(IPCMessageIntegrity
, ReadBeyondBufferWStr
) {
34 //This was BUG 984408.
35 uint32 v1
= kuint32max
- 1;
37 IPC::Message
m(0, 1, IPC::Message::PRIORITY_NORMAL
);
38 EXPECT_TRUE(m
.WriteInt(v1
));
39 EXPECT_TRUE(m
.WriteInt(v2
));
43 EXPECT_FALSE(m
.ReadWString(&iter
, &vs
));
46 TEST(IPCMessageIntegrity
, ReadBytesBadIterator
) {
47 // This was BUG 1035467.
48 IPC::Message
m(0, 1, IPC::Message::PRIORITY_NORMAL
);
49 EXPECT_TRUE(m
.WriteInt(1));
50 EXPECT_TRUE(m
.WriteInt(2));
53 const char* data
= NULL
;
54 EXPECT_FALSE(m
.ReadBytes(&iter
, &data
, sizeof(int)));
57 TEST(IPCMessageIntegrity
, ReadVectorNegativeSize
) {
58 // A slight variation of BUG 984408. Note that the pickling of vector<char>
59 // has a specialized template which is not vulnerable to this bug. So here
60 // try to hit the non-specialized case vector<P>.
61 IPC::Message
m(0, 1, IPC::Message::PRIORITY_NORMAL
);
62 EXPECT_TRUE(m
.WriteInt(-1)); // This is the count of elements.
63 EXPECT_TRUE(m
.WriteInt(1));
64 EXPECT_TRUE(m
.WriteInt(2));
65 EXPECT_TRUE(m
.WriteInt(3));
67 std::vector
<double> vec
;
69 EXPECT_FALSE(ReadParam(&m
, &iter
, &vec
));
72 TEST(IPCMessageIntegrity
, ReadVectorTooLarge1
) {
73 // This was BUG 1006367. This is the large but positive length case. Again
74 // we try to hit the non-specialized case vector<P>.
75 IPC::Message
m(0, 1, IPC::Message::PRIORITY_NORMAL
);
76 EXPECT_TRUE(m
.WriteInt(0x21000003)); // This is the count of elements.
77 EXPECT_TRUE(m
.WriteInt64(1));
78 EXPECT_TRUE(m
.WriteInt64(2));
80 std::vector
<int64
> vec
;
82 EXPECT_FALSE(ReadParam(&m
, &iter
, &vec
));
85 TEST(IPCMessageIntegrity
, ReadVectorTooLarge2
) {
86 // This was BUG 1006367. This is the large but positive with an additional
87 // integer overflow when computing the actual byte size. Again we try to hit
88 // the non-specialized case vector<P>.
89 IPC::Message
m(0, 1, IPC::Message::PRIORITY_NORMAL
);
90 EXPECT_TRUE(m
.WriteInt(0x71000000)); // This is the count of elements.
91 EXPECT_TRUE(m
.WriteInt64(1));
92 EXPECT_TRUE(m
.WriteInt64(2));
94 std::vector
<int64
> vec
;
96 EXPECT_FALSE(ReadParam(&m
, &iter
, &vec
));
99 // We don't actually use the messages defined in this file, but we do this
100 // to get to the IPC macros.
101 #define MESSAGES_INTERNAL_FILE "ipc/ipc_sync_message_unittest.h"
102 #include "ipc/ipc_message_macros.h"
106 SERVER_FIRST_IPC_TYPE
, // 1st Test message tag.
107 SERVER_SECOND_IPC_TYPE
, // 2nd Test message tag.
108 SERVER_THIRD_IPC_TYPE
, // 3rd Test message tag.
109 CLIENT_MALFORMED_IPC
, // Sent to client if server detects bad message.
110 CLIENT_UNHANDLED_IPC
// Sent to client if server detects unhanded IPC.
113 // Generic message class that is an int followed by a wstring.
114 class MsgClassIS
: public IPC::MessageWithTuple
< Tuple2
<int, std::wstring
> > {
116 enum { ID
= SERVER_FIRST_IPC_TYPE
};
117 MsgClassIS(const int& arg1
, const std::wstring
& arg2
)
118 : IPC::MessageWithTuple
< Tuple2
<int, std::wstring
> >(
119 MSG_ROUTING_CONTROL
, ID
, MakeRefTuple(arg1
, arg2
)) {}
122 // Generic message class that is a wstring followed by an int.
123 class MsgClassSI
: public IPC::MessageWithTuple
< Tuple2
<std::wstring
, int> > {
125 enum { ID
= SERVER_SECOND_IPC_TYPE
};
126 MsgClassSI(const std::wstring
& arg1
, const int& arg2
)
127 : IPC::MessageWithTuple
< Tuple2
<std::wstring
, int> >(
128 MSG_ROUTING_CONTROL
, ID
, MakeRefTuple(arg1
, arg2
)) {}
131 // Message to create a mutex in the IPC server, using the received name.
132 class MsgDoMutex
: public IPC::MessageWithTuple
< Tuple2
<std::wstring
, int> > {
134 enum { ID
= SERVER_THIRD_IPC_TYPE
};
135 MsgDoMutex(const std::wstring
& mutex_name
, const int& unused
)
136 : IPC::MessageWithTuple
< Tuple2
<std::wstring
, int> >(
137 MSG_ROUTING_CONTROL
, ID
, MakeRefTuple(mutex_name
, unused
)) {}
140 class SimpleListener
: public IPC::Channel::Listener
{
142 SimpleListener() : other_(NULL
) {
144 void Init(IPC::Message::Sender
* s
) {
148 IPC::Message::Sender
* other_
;
152 FUZZER_ROUTING_ID
= 5
155 // The fuzzer server class. It runs in a child process and expects
156 // only two IPC calls; after that it exits the message loop which
157 // terminates the child process.
158 class FuzzerServerListener
: public SimpleListener
{
160 FuzzerServerListener() : message_count_(2), pending_messages_(0) {
162 virtual void OnMessageReceived(const IPC::Message
& msg
) {
163 if (msg
.routing_id() == MSG_ROUTING_CONTROL
) {
165 IPC_BEGIN_MESSAGE_MAP(FuzzerServerListener
, msg
)
166 IPC_MESSAGE_HANDLER(MsgClassIS
, OnMsgClassISMessage
)
167 IPC_MESSAGE_HANDLER(MsgClassSI
, OnMsgClassSIMessage
)
168 IPC_END_MESSAGE_MAP()
169 if (pending_messages_
) {
170 // Probably a problem de-serializing the message.
171 ReplyMsgNotHandled(msg
.type());
177 void OnMsgClassISMessage(int value
, const std::wstring
& text
) {
178 UseData(MsgClassIS::ID
, value
, text
);
179 RoundtripAckReply(FUZZER_ROUTING_ID
, MsgClassIS::ID
, value
);
183 void OnMsgClassSIMessage(const std::wstring
& text
, int value
) {
184 UseData(MsgClassSI::ID
, value
, text
);
185 RoundtripAckReply(FUZZER_ROUTING_ID
, MsgClassSI::ID
, value
);
189 bool RoundtripAckReply(int routing
, int type_id
, int reply
) {
190 IPC::Message
* message
= new IPC::Message(routing
, type_id
,
191 IPC::Message::PRIORITY_NORMAL
);
192 message
->WriteInt(reply
+ 1);
193 message
->WriteInt(reply
);
194 return other_
->Send(message
);
200 if (0 == message_count_
)
201 MessageLoop::current()->Quit();
204 void ReplyMsgNotHandled(int type_id
) {
205 RoundtripAckReply(FUZZER_ROUTING_ID
, CLIENT_UNHANDLED_IPC
, type_id
);
209 void UseData(int caller
, int value
, const std::wstring
& text
) {
210 std::wostringstream wos
;
211 wos
<< L
"IPC fuzzer:" << caller
<< " [" << value
<< L
" " << text
<< L
"]\n";
212 std::wstring output
= wos
.str();
213 LOG(WARNING
) << output
.c_str();
217 int pending_messages_
;
220 class FuzzerClientListener
: public SimpleListener
{
222 FuzzerClientListener() : last_msg_(NULL
) {
225 virtual void OnMessageReceived(const IPC::Message
& msg
) {
226 last_msg_
= new IPC::Message(msg
);
227 MessageLoop::current()->Quit();
230 bool ExpectMessage(int value
, int type_id
) {
231 if (!MsgHandlerInternal(type_id
))
236 if (!last_msg_
->ReadInt(&iter
, &msg_value1
))
238 if (!last_msg_
->ReadInt(&iter
, &msg_value2
))
240 if ((msg_value2
+ 1) != msg_value1
)
242 if (msg_value2
!= value
)
250 bool ExpectMsgNotHandled(int type_id
) {
251 return ExpectMessage(type_id
, CLIENT_UNHANDLED_IPC
);
255 bool MsgHandlerInternal(int type_id
) {
256 MessageLoop::current()->Run();
257 if (NULL
== last_msg_
)
259 if (FUZZER_ROUTING_ID
!= last_msg_
->routing_id())
261 return (type_id
== last_msg_
->type());
264 IPC::Message
* last_msg_
;
267 // Runs the fuzzing server child mode. Returns when the preset number
268 // of messages have been received.
269 MULTIPROCESS_TEST_MAIN(RunFuzzServer
) {
270 MessageLoopForIO main_message_loop
;
271 FuzzerServerListener listener
;
272 IPC::Channel
chan(kFuzzerChannel
, IPC::Channel::MODE_CLIENT
, &listener
);
274 listener
.Init(&chan
);
275 MessageLoop::current()->Run();
279 class IPCFuzzingTest
: public IPCChannelTest
{
282 // This test makes sure that the FuzzerClientListener and FuzzerServerListener
283 // are working properly by generating two well formed IPC calls.
284 TEST_F(IPCFuzzingTest
, SanityTest
) {
285 FuzzerClientListener listener
;
286 IPC::Channel
chan(kFuzzerChannel
, IPC::Channel::MODE_SERVER
,
288 base::ProcessHandle server_process
= SpawnChild(FUZZER_SERVER
, &chan
);
289 ASSERT_TRUE(server_process
);
290 PlatformThread::Sleep(1000);
291 ASSERT_TRUE(chan
.Connect());
292 listener
.Init(&chan
);
294 IPC::Message
* msg
= NULL
;
296 msg
= new MsgClassIS(value
, L
"expect 43");
298 EXPECT_TRUE(listener
.ExpectMessage(value
, MsgClassIS::ID
));
300 msg
= new MsgClassSI(L
"expect 44", ++value
);
302 EXPECT_TRUE(listener
.ExpectMessage(value
, MsgClassSI::ID
));
304 EXPECT_TRUE(base::WaitForSingleProcess(server_process
, 5000));
305 base::CloseProcessHandle(server_process
);
308 // This test uses a payload that is smaller than expected.
309 // This generates an error while unpacking the IPC buffer which in
310 // In debug this triggers an assertion and in release it is ignored(!!). Right
311 // after we generate another valid IPC to make sure framing is working
314 TEST_F(IPCFuzzingTest
, MsgBadPayloadShort
) {
315 FuzzerClientListener listener
;
316 IPC::Channel
chan(kFuzzerChannel
, IPC::Channel::MODE_SERVER
,
318 base::ProcessHandle server_process
= SpawnChild(FUZZER_SERVER
, &chan
);
319 ASSERT_TRUE(server_process
);
320 PlatformThread::Sleep(1000);
321 ASSERT_TRUE(chan
.Connect());
322 listener
.Init(&chan
);
324 IPC::Message
* msg
= new IPC::Message(MSG_ROUTING_CONTROL
, MsgClassIS::ID
,
325 IPC::Message::PRIORITY_NORMAL
);
328 EXPECT_TRUE(listener
.ExpectMsgNotHandled(MsgClassIS::ID
));
330 msg
= new MsgClassSI(L
"expect one", 1);
332 EXPECT_TRUE(listener
.ExpectMessage(1, MsgClassSI::ID
));
334 EXPECT_TRUE(base::WaitForSingleProcess(server_process
, 5000));
335 base::CloseProcessHandle(server_process
);
339 // This test uses a payload that has too many arguments, but so the payload
340 // size is big enough so the unpacking routine does not generate an error as
341 // in the case of MsgBadPayloadShort test.
342 // This test does not pinpoint a flaw (per se) as by design we don't carry
343 // type information on the IPC message.
344 TEST_F(IPCFuzzingTest
, MsgBadPayloadArgs
) {
345 FuzzerClientListener listener
;
346 IPC::Channel
chan(kFuzzerChannel
, IPC::Channel::MODE_SERVER
,
348 base::ProcessHandle server_process
= SpawnChild(FUZZER_SERVER
, &chan
);
349 ASSERT_TRUE(server_process
);
350 PlatformThread::Sleep(1000);
351 ASSERT_TRUE(chan
.Connect());
352 listener
.Init(&chan
);
354 IPC::Message
* msg
= new IPC::Message(MSG_ROUTING_CONTROL
, MsgClassSI::ID
,
355 IPC::Message::PRIORITY_NORMAL
);
356 msg
->WriteWString(L
"d");
358 msg
->WriteInt(0x65); // Extra argument.
361 EXPECT_TRUE(listener
.ExpectMessage(0, MsgClassSI::ID
));
363 // Now send a well formed message to make sure the receiver wasn't
364 // thrown out of sync by the extra argument.
365 msg
= new MsgClassIS(3, L
"expect three");
367 EXPECT_TRUE(listener
.ExpectMessage(3, MsgClassIS::ID
));
369 EXPECT_TRUE(base::WaitForSingleProcess(server_process
, 5000));
370 base::CloseProcessHandle(server_process
);
373 // This class is for testing the IPC_BEGIN_MESSAGE_MAP_EX macros.
374 class ServerMacroExTest
{
376 ServerMacroExTest() : unhandled_msgs_(0) {
378 virtual bool OnMessageReceived(const IPC::Message
& msg
) {
379 bool msg_is_ok
= false;
380 IPC_BEGIN_MESSAGE_MAP_EX(ServerMacroExTest
, msg
, msg_is_ok
)
381 IPC_MESSAGE_HANDLER(MsgClassIS
, OnMsgClassISMessage
)
382 IPC_MESSAGE_HANDLER(MsgClassSI
, OnMsgClassSIMessage
)
383 IPC_MESSAGE_UNHANDLED(++unhandled_msgs_
)
384 IPC_END_MESSAGE_MAP_EX()
388 int unhandled_msgs() const {
389 return unhandled_msgs_
;
393 void OnMsgClassISMessage(int value
, const std::wstring
& text
) {
395 void OnMsgClassSIMessage(const std::wstring
& text
, int value
) {
401 TEST_F(IPCFuzzingTest
, MsgMapExMacro
) {
402 IPC::Message
* msg
= NULL
;
403 ServerMacroExTest server
;
405 // Test the regular messages.
406 msg
= new MsgClassIS(3, L
"text3");
407 EXPECT_TRUE(server
.OnMessageReceived(*msg
));
409 msg
= new MsgClassSI(L
"text2", 2);
410 EXPECT_TRUE(server
.OnMessageReceived(*msg
));
414 // Test a bad message.
415 msg
= new IPC::Message(MSG_ROUTING_CONTROL
, MsgClassSI::ID
,
416 IPC::Message::PRIORITY_NORMAL
);
418 EXPECT_FALSE(server
.OnMessageReceived(*msg
));
421 msg
= new IPC::Message(MSG_ROUTING_CONTROL
, MsgClassIS::ID
,
422 IPC::Message::PRIORITY_NORMAL
);
425 EXPECT_FALSE(server
.OnMessageReceived(*msg
));
428 EXPECT_EQ(0, server
.unhandled_msgs());