Coverage Report

Created: 2026-04-01 06:50

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/perfetto/test/producer_socket_fuzzer.cc
Line
Count
Source
1
/*
2
 * Copyright (C) 2019 The Android Open Source Project
3
 *
4
 * Licensed under the Apache License, Version 2.0 (the "License");
5
 * you may not use this file except in compliance with the License.
6
 * You may obtain a copy of the License at
7
 *
8
 *      http://www.apache.org/licenses/LICENSE-2.0
9
 *
10
 * Unless required by applicable law or agreed to in writing, software
11
 * distributed under the License is distributed on an "AS IS" BASIS,
12
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
 * See the License for the specific language governing permissions and
14
 * limitations under the License.
15
 */
16
17
#include "perfetto/base/build_config.h"
18
#include "perfetto/ext/base/unix_socket.h"
19
#include "src/base/test/test_task_runner.h"
20
#include "test/test_helper.h"
21
22
namespace perfetto {
23
namespace socket_fuzz {
24
namespace {
25
26
class FakeEventListener : public base::UnixSocket::EventListener {
27
 public:
28
  FakeEventListener(const uint8_t* data,
29
                    size_t size,
30
                    std::function<void()> data_sent_callback)
31
6
      : data_(data), size_(size), data_sent_(data_sent_callback) {}
32
33
  void OnNewIncomingConnection(base::UnixSocket*,
34
0
                               std::unique_ptr<base::UnixSocket>) override {
35
0
    PERFETTO_CHECK(false);
36
0
  }
37
38
6
  void OnConnect(base::UnixSocket* self, bool connected) override {
39
6
    PERFETTO_CHECK(connected && self->is_connected());
40
6
    self->Send(data_, size_, self->fd());
41
6
    data_sent_();
42
6
  }
43
44
0
  void OnDisconnect(base::UnixSocket*) override { PERFETTO_CHECK(false); }
45
0
  void OnDataAvailable(base::UnixSocket*) override { PERFETTO_CHECK(false); }
46
47
 private:
48
  const uint8_t* data_;
49
  const size_t size_;
50
  std::function<void()> data_sent_;
51
};
52
53
6
int FuzzSharedMemory(const uint8_t* data, size_t size) {
54
6
  if (!data)
55
0
    return 0;
56
6
  base::TestTaskRunner task_runner;
57
58
6
  TestHelper helper(&task_runner);
59
6
  helper.StartServiceIfRequired();
60
61
6
  FakeEventListener fake_event_listener(
62
6
      data, size, task_runner.CreateCheckpoint("data_sent"));
63
64
6
  std::unique_ptr<base::UnixSocket> sock = base::UnixSocket::Connect(
65
6
      helper.GetDefaultModeProducerSocketName(), &fake_event_listener,
66
6
      &task_runner, base::SockFamily::kUnix, base::SockType::kStream);
67
68
6
  task_runner.RunUntilCheckpoint("data_sent");
69
6
  return 0;
70
6
}
71
}  // namespace
72
}  // namespace socket_fuzz
73
}  // namespace perfetto
74
75
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size);
76
77
13.5k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
78
13.5k
  return perfetto::socket_fuzz::FuzzSharedMemory(data, size);
79
13.5k
}