1// Copyright 2014 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "base/command_line.h"
6#include "base/files/file.h"
7#include "base/files/file_util.h"
8#include "base/strings/string_number_conversions.h"
9#include "net/spdy/fuzzing/hpack_fuzz_util.h"
10
11namespace {
12
13// Specifies a file having HPACK header sets.
14const char kFileToParse[] = "file-to-parse";
15
16// Target file for mutated HPACK header sets.
17const char kFileToWrite[] = "file-to-write";
18
19// Number of bits to flip per 1,024 bytes of input.
20const char kFlipsPerThousand[] = "flips-per-thousand-bytes";
21
22}  // namespace
23
24using base::StringPiece;
25using net::HpackFuzzUtil;
26using std::string;
27
28// Reads length-prefixed input blocks, applies a bit-flipping mutation to each
29// block, and writes length-prefixed blocks to the output file. While blocks
30// themselves are mutated, the length-prefixes of written blocks are not.
31int main(int argc, char** argv) {
32  base::CommandLine::Init(argc, argv);
33  const base::CommandLine& command_line =
34      *base::CommandLine::ForCurrentProcess();
35
36  if (!command_line.HasSwitch(kFileToParse) ||
37      !command_line.HasSwitch(kFileToWrite) ||
38      !command_line.HasSwitch(kFlipsPerThousand)) {
39    LOG(ERROR) << "Usage: " << argv[0]
40               << " --" << kFileToParse << "=/path/to/file.in"
41               << " --" << kFileToWrite << "=/path/to/file.out"
42               << " --" << kFlipsPerThousand << "=10";
43    return -1;
44  }
45  string file_to_parse = command_line.GetSwitchValueASCII(kFileToParse);
46  string file_to_write = command_line.GetSwitchValueASCII(kFileToWrite);
47
48  int flip_ratio = 0;
49  CHECK(base::StringToInt(command_line.GetSwitchValueASCII(kFlipsPerThousand),
50                    &flip_ratio));
51
52  DVLOG(1) << "Reading input from " << file_to_parse;
53  HpackFuzzUtil::Input input;
54  CHECK(base::ReadFileToString(base::FilePath::FromUTF8Unsafe(file_to_parse),
55                               &input.input));
56
57  DVLOG(1) << "Writing output to " << file_to_write;
58  base::File file_out(base::FilePath::FromUTF8Unsafe(file_to_write),
59                      base::File::FLAG_CREATE_ALWAYS | base::File::FLAG_WRITE);
60  CHECK(file_out.IsValid()) << file_out.error_details();
61
62  DVLOG(1) << "Flipping " << flip_ratio << " bits per 1024 input bytes";
63
64  size_t block_count = 0;
65  StringPiece block;
66  while (HpackFuzzUtil::NextHeaderBlock(&input, &block)) {
67    HpackFuzzUtil::FlipBits(
68        reinterpret_cast<uint8*>(const_cast<char*>(block.data())),
69        block.size(),
70        flip_ratio);
71
72    string prefix = HpackFuzzUtil::HeaderBlockPrefix(block.size());
73
74    CHECK_LT(0, file_out.WriteAtCurrentPos(prefix.data(), prefix.size()));
75    CHECK_LT(0, file_out.WriteAtCurrentPos(block.data(), block.size()));
76    ++block_count;
77  }
78  CHECK(file_out.Flush());
79  DVLOG(1) << "Mutated " << block_count << " blocks.";
80  return 0;
81}
82