commit 8294639c8d09a3754d5ff214a69614848bd6e1e7
author birenroy <birenroy@google.com> Tue May 30 07:21:34 2023 -0700
committer Copybara-Service <copybara-worker@google.com> Tue May 30 07:23:12 2023 -0700
tree a02d178be6add73b26d2a9165c4b2fb6d6be33e9
parent 8f410c8be441323715e200c7a1c211ba9fdd73c9

Adds a basic fuzzer for Http2FrameDecoder.

Future improvements could include a dictionary or corpus.

PiperOrigin-RevId: 536391596

build/source_list.bzl

diff --git a/build/source_list.bzl b/build/source_list.bzl
index cdae4ca..8122118 100644
--- a/build/source_list.bzl
+++ b/build/source_list.bzl
@@ -1317,6 +1317,7 @@
 ]
 fuzzers_srcs = [
     "common/structured_headers_fuzzer.cc",
+    "http2/decoder/http2_frame_decoder_fuzzer.cc",
     "quic/core/crypto/certificate_view_der_fuzzer.cc",
     "quic/core/crypto/certificate_view_pem_fuzzer.cc",
     "quic/core/qpack/fuzzer/qpack_decoder_fuzzer.cc",

build/source_list.gni

diff --git a/build/source_list.gni b/build/source_list.gni
index b08ad85..2510ffa 100644
--- a/build/source_list.gni
+++ b/build/source_list.gni
@@ -1317,6 +1317,7 @@
 ]
 fuzzers_srcs = [
     "src/quiche/common/structured_headers_fuzzer.cc",
+    "src/quiche/http2/decoder/http2_frame_decoder_fuzzer.cc",
     "src/quiche/quic/core/crypto/certificate_view_der_fuzzer.cc",
     "src/quiche/quic/core/crypto/certificate_view_pem_fuzzer.cc",
     "src/quiche/quic/core/qpack/fuzzer/qpack_decoder_fuzzer.cc",

build/source_list.json

diff --git a/build/source_list.json b/build/source_list.json
index b3f0af3..ecfe4e2 100644
--- a/build/source_list.json
+++ b/build/source_list.json
@@ -1316,6 +1316,7 @@
   ],
   "fuzzers_srcs": [
     "quiche/common/structured_headers_fuzzer.cc",
+    "quiche/http2/decoder/http2_frame_decoder_fuzzer.cc",
     "quiche/quic/core/crypto/certificate_view_der_fuzzer.cc",
     "quiche/quic/core/crypto/certificate_view_pem_fuzzer.cc",
     "quiche/quic/core/qpack/fuzzer/qpack_decoder_fuzzer.cc",

quiche/http2/decoder/http2_frame_decoder_fuzzer.cc

diff --git a/quiche/http2/decoder/http2_frame_decoder_fuzzer.cc b/quiche/http2/decoder/http2_frame_decoder_fuzzer.cc
new file mode 100644
index 0000000..a231e23
--- /dev/null
+++ b/quiche/http2/decoder/http2_frame_decoder_fuzzer.cc
@@ -0,0 +1,14 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "quiche/http2/decoder/decode_buffer.h"
+#include "quiche/http2/decoder/http2_frame_decoder.h"
+#include "quiche/http2/decoder/http2_frame_decoder_listener.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  http2::Http2FrameDecoderNoOpListener listener;
+  http2::Http2FrameDecoder decoder(&listener);
+  http2::DecodeBuffer db(reinterpret_cast<const char *>(data), size);
+  decoder.DecodeFrame(&db);
+  return 0;  // Always return 0; other values are reserved for future uses.
+}