// Copyright (c) 2012 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include <stdio.h> #include <string> #include <sstream> #include "base/message_loop/message_loop.h" #include "base/threading/platform_thread.h" #include "ipc/ipc_test_base.h" #include "testing/gtest/include/gtest/gtest.h" // IPC messages for testing ---------------------------------------------------- #define IPC_MESSAGE_IMPL #include "ipc/ipc_message_macros.h" #define IPC_MESSAGE_START TestMsgStart // Generic message class that is an int followed by a wstring. IPC_MESSAGE_CONTROL2(MsgClassIS, int, std::wstring) // Generic message class that is a wstring followed by an int. IPC_MESSAGE_CONTROL2(MsgClassSI, std::wstring, int) // Message to create a mutex in the IPC server, using the received name. IPC_MESSAGE_CONTROL2(MsgDoMutex, std::wstring, int) // Used to generate an ID for a message that should not exist. IPC_MESSAGE_CONTROL0(MsgUnhandled) // ----------------------------------------------------------------------------- namespace { TEST(IPCMessageIntegrity, ReadBeyondBufferStr) { //This was BUG 984408. uint32 v1 = kuint32max - 1; int v2 = 666; IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); EXPECT_TRUE(m.WriteInt(v1)); EXPECT_TRUE(m.WriteInt(v2)); PickleIterator iter(m); std::string vs; EXPECT_FALSE(m.ReadString(&iter, &vs)); } TEST(IPCMessageIntegrity, ReadBeyondBufferWStr) { //This was BUG 984408. uint32 v1 = kuint32max - 1; int v2 = 777; IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); EXPECT_TRUE(m.WriteInt(v1)); EXPECT_TRUE(m.WriteInt(v2)); PickleIterator iter(m); std::wstring vs; EXPECT_FALSE(m.ReadWString(&iter, &vs)); } TEST(IPCMessageIntegrity, ReadBytesBadIterator) { // This was BUG 1035467. IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); EXPECT_TRUE(m.WriteInt(1)); EXPECT_TRUE(m.WriteInt(2)); PickleIterator iter(m); const char* data = NULL; EXPECT_TRUE(m.ReadBytes(&iter, &data, sizeof(int))); } TEST(IPCMessageIntegrity, ReadVectorNegativeSize) { // A slight variation of BUG 984408. Note that the pickling of vector<char> // has a specialized template which is not vulnerable to this bug. So here // try to hit the non-specialized case vector<P>. IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); EXPECT_TRUE(m.WriteInt(-1)); // This is the count of elements. EXPECT_TRUE(m.WriteInt(1)); EXPECT_TRUE(m.WriteInt(2)); EXPECT_TRUE(m.WriteInt(3)); std::vector<double> vec; PickleIterator iter(m); EXPECT_FALSE(ReadParam(&m, &iter, &vec)); } TEST(IPCMessageIntegrity, ReadVectorTooLarge1) { // This was BUG 1006367. This is the large but positive length case. Again // we try to hit the non-specialized case vector<P>. IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); EXPECT_TRUE(m.WriteInt(0x21000003)); // This is the count of elements. EXPECT_TRUE(m.WriteInt64(1)); EXPECT_TRUE(m.WriteInt64(2)); std::vector<int64> vec; PickleIterator iter(m); EXPECT_FALSE(ReadParam(&m, &iter, &vec)); } TEST(IPCMessageIntegrity, ReadVectorTooLarge2) { // This was BUG 1006367. This is the large but positive with an additional // integer overflow when computing the actual byte size. Again we try to hit // the non-specialized case vector<P>. IPC::Message m(0, 1, IPC::Message::PRIORITY_NORMAL); EXPECT_TRUE(m.WriteInt(0x71000000)); // This is the count of elements. EXPECT_TRUE(m.WriteInt64(1)); EXPECT_TRUE(m.WriteInt64(2)); std::vector<int64> vec; PickleIterator iter(m); EXPECT_FALSE(ReadParam(&m, &iter, &vec)); } class SimpleListener : public IPC::Listener { public: SimpleListener() : other_(NULL) { } void Init(IPC::Sender* s) { other_ = s; } protected: IPC::Sender* other_; }; enum { FUZZER_ROUTING_ID = 5 }; // The fuzzer server class. It runs in a child process and expects // only two IPC calls; after that it exits the message loop which // terminates the child process. class FuzzerServerListener : public SimpleListener { public: FuzzerServerListener() : message_count_(2), pending_messages_(0) { } virtual bool OnMessageReceived(const IPC::Message& msg) OVERRIDE { if (msg.routing_id() == MSG_ROUTING_CONTROL) { ++pending_messages_; IPC_BEGIN_MESSAGE_MAP(FuzzerServerListener, msg) IPC_MESSAGE_HANDLER(MsgClassIS, OnMsgClassISMessage) IPC_MESSAGE_HANDLER(MsgClassSI, OnMsgClassSIMessage) IPC_END_MESSAGE_MAP() if (pending_messages_) { // Probably a problem de-serializing the message. ReplyMsgNotHandled(msg.type()); } } return true; } private: void OnMsgClassISMessage(int value, const std::wstring& text) { UseData(MsgClassIS::ID, value, text); RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassIS::ID, value); Cleanup(); } void OnMsgClassSIMessage(const std::wstring& text, int value) { UseData(MsgClassSI::ID, value, text); RoundtripAckReply(FUZZER_ROUTING_ID, MsgClassSI::ID, value); Cleanup(); } bool RoundtripAckReply(int routing, uint32 type_id, int reply) { IPC::Message* message = new IPC::Message(routing, type_id, IPC::Message::PRIORITY_NORMAL); message->WriteInt(reply + 1); message->WriteInt(reply); return other_->Send(message); } void Cleanup() { --message_count_; --pending_messages_; if (0 == message_count_) base::MessageLoop::current()->Quit(); } void ReplyMsgNotHandled(uint32 type_id) { RoundtripAckReply(FUZZER_ROUTING_ID, MsgUnhandled::ID, type_id); Cleanup(); } void UseData(int caller, int value, const std::wstring& text) { std::wostringstream wos; wos << L"IPC fuzzer:" << caller << " [" << value << L" " << text << L"]\n"; std::wstring output = wos.str(); LOG(WARNING) << output.c_str(); }; int message_count_; int pending_messages_; }; class FuzzerClientListener : public SimpleListener { public: FuzzerClientListener() : last_msg_(NULL) { } virtual bool OnMessageReceived(const IPC::Message& msg) OVERRIDE { last_msg_ = new IPC::Message(msg); base::MessageLoop::current()->Quit(); return true; } bool ExpectMessage(int value, uint32 type_id) { if (!MsgHandlerInternal(type_id)) return false; int msg_value1 = 0; int msg_value2 = 0; PickleIterator iter(*last_msg_); if (!last_msg_->ReadInt(&iter, &msg_value1)) return false; if (!last_msg_->ReadInt(&iter, &msg_value2)) return false; if ((msg_value2 + 1) != msg_value1) return false; if (msg_value2 != value) return false; delete last_msg_; last_msg_ = NULL; return true; } bool ExpectMsgNotHandled(uint32 type_id) { return ExpectMessage(type_id, MsgUnhandled::ID); } private: bool MsgHandlerInternal(uint32 type_id) { base::MessageLoop::current()->Run(); if (NULL == last_msg_) return false; if (FUZZER_ROUTING_ID != last_msg_->routing_id()) return false; return (type_id == last_msg_->type()); }; IPC::Message* last_msg_; }; // Runs the fuzzing server child mode. Returns when the preset number of // messages have been received. MULTIPROCESS_IPC_TEST_CLIENT_MAIN(FuzzServerClient) { base::MessageLoopForIO main_message_loop; FuzzerServerListener listener; IPC::Channel channel(IPCTestBase::GetChannelName("FuzzServerClient"), IPC::Channel::MODE_CLIENT, &listener); CHECK(channel.Connect()); listener.Init(&channel); base::MessageLoop::current()->Run(); return 0; } class IPCFuzzingTest : public IPCTestBase { }; // This test makes sure that the FuzzerClientListener and FuzzerServerListener // are working properly by generating two well formed IPC calls. TEST_F(IPCFuzzingTest, SanityTest) { Init("FuzzServerClient"); FuzzerClientListener listener; CreateChannel(&listener); listener.Init(channel()); ASSERT_TRUE(ConnectChannel()); ASSERT_TRUE(StartClient()); IPC::Message* msg = NULL; int value = 43; msg = new MsgClassIS(value, L"expect 43"); sender()->Send(msg); EXPECT_TRUE(listener.ExpectMessage(value, MsgClassIS::ID)); msg = new MsgClassSI(L"expect 44", ++value); sender()->Send(msg); EXPECT_TRUE(listener.ExpectMessage(value, MsgClassSI::ID)); EXPECT_TRUE(WaitForClientShutdown()); DestroyChannel(); } // This test uses a payload that is smaller than expected. This generates an // error while unpacking the IPC buffer which in debug trigger an assertion and // in release is ignored (!). Right after we generate another valid IPC to make // sure framing is working properly. #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) TEST_F(IPCFuzzingTest, MsgBadPayloadShort) { Init("FuzzServerClient"); FuzzerClientListener listener; CreateChannel(&listener); listener.Init(channel()); ASSERT_TRUE(ConnectChannel()); ASSERT_TRUE(StartClient()); IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, IPC::Message::PRIORITY_NORMAL); msg->WriteInt(666); sender()->Send(msg); EXPECT_TRUE(listener.ExpectMsgNotHandled(MsgClassIS::ID)); msg = new MsgClassSI(L"expect one", 1); sender()->Send(msg); EXPECT_TRUE(listener.ExpectMessage(1, MsgClassSI::ID)); EXPECT_TRUE(WaitForClientShutdown()); DestroyChannel(); } #endif // This test uses a payload that has too many arguments, but so the payload size // is big enough so the unpacking routine does not generate an error as in the // case of MsgBadPayloadShort test. This test does not pinpoint a flaw (per se) // as by design we don't carry type information on the IPC message. TEST_F(IPCFuzzingTest, MsgBadPayloadArgs) { Init("FuzzServerClient"); FuzzerClientListener listener; CreateChannel(&listener); listener.Init(channel()); ASSERT_TRUE(ConnectChannel()); ASSERT_TRUE(StartClient()); IPC::Message* msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, IPC::Message::PRIORITY_NORMAL); msg->WriteWString(L"d"); msg->WriteInt(0); msg->WriteInt(0x65); // Extra argument. sender()->Send(msg); EXPECT_TRUE(listener.ExpectMessage(0, MsgClassSI::ID)); // Now send a well formed message to make sure the receiver wasn't // thrown out of sync by the extra argument. msg = new MsgClassIS(3, L"expect three"); sender()->Send(msg); EXPECT_TRUE(listener.ExpectMessage(3, MsgClassIS::ID)); EXPECT_TRUE(WaitForClientShutdown()); DestroyChannel(); } // This class is for testing the IPC_BEGIN_MESSAGE_MAP_EX macros. class ServerMacroExTest { public: ServerMacroExTest() : unhandled_msgs_(0) { } virtual ~ServerMacroExTest() { } virtual bool OnMessageReceived(const IPC::Message& msg) { bool msg_is_ok = false; IPC_BEGIN_MESSAGE_MAP_EX(ServerMacroExTest, msg, msg_is_ok) IPC_MESSAGE_HANDLER(MsgClassIS, OnMsgClassISMessage) IPC_MESSAGE_HANDLER(MsgClassSI, OnMsgClassSIMessage) IPC_MESSAGE_UNHANDLED(++unhandled_msgs_) IPC_END_MESSAGE_MAP_EX() return msg_is_ok; } int unhandled_msgs() const { return unhandled_msgs_; } private: void OnMsgClassISMessage(int value, const std::wstring& text) { } void OnMsgClassSIMessage(const std::wstring& text, int value) { } int unhandled_msgs_; DISALLOW_COPY_AND_ASSIGN(ServerMacroExTest); }; TEST_F(IPCFuzzingTest, MsgMapExMacro) { IPC::Message* msg = NULL; ServerMacroExTest server; // Test the regular messages. msg = new MsgClassIS(3, L"text3"); EXPECT_TRUE(server.OnMessageReceived(*msg)); delete msg; msg = new MsgClassSI(L"text2", 2); EXPECT_TRUE(server.OnMessageReceived(*msg)); delete msg; #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON) // Test a bad message. msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassSI::ID, IPC::Message::PRIORITY_NORMAL); msg->WriteInt(2); EXPECT_FALSE(server.OnMessageReceived(*msg)); delete msg; msg = new IPC::Message(MSG_ROUTING_CONTROL, MsgClassIS::ID, IPC::Message::PRIORITY_NORMAL); msg->WriteInt(0x64); msg->WriteInt(0x32); EXPECT_FALSE(server.OnMessageReceived(*msg)); delete msg; EXPECT_EQ(0, server.unhandled_msgs()); #endif } } // namespace