Commit 36571a8d authored by Kevin Bailey's avatar Kevin Bailey Committed by Commit Bot

[omnibox] Narrow AutocompleteInput fuzzer input

Change fuzzer to avoid data we know AutocompleteInput isn't designed
to handle.

Change-Id: I755db8375adf0f629af6a656d9494033cae5bb39
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1876551Reviewed-by: default avatarTommy Li <tommycli@chromium.org>
Commit-Queue: Kevin Bailey <krb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#709181}
parent e1ab9e9b
......@@ -10,6 +10,7 @@
#include "base/at_exit.h"
#include "base/i18n/icu_util.h"
#include "base/strings/string16.h"
#include "base/strings/utf_string_conversion_utils.h"
#include "components/omnibox/browser/test_scheme_classifier.h"
#include "third_party/metrics_proto/omnibox_event.pb.h"
......@@ -23,10 +24,20 @@ struct IcuEnvironment {
IcuEnvironment icu_env;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
// Enforce a reasonable bound on what we believe it takes to trigger
// an error.
if (size > 4096)
return 0;
// This fuzzer creates a random UTF16 string, for testing primarily against
// AutocompleteInput::Parse().
base::string16 s(reinterpret_cast<const base::string16::value_type*>(data),
size / sizeof(base::string16::value_type));
// Some characters are considered illegal and, while our code handles them
// fine, fuzzing runs with DCHECKs enabled which will trigger on them.
for (auto c : s) {
if (!base::IsValidCharacter(c))
return 0;
}
AutocompleteInput input(s, metrics::OmniboxEventProto::OTHER,
TestSchemeClassifier());
return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment