Home | History | Annotate | Download | only in ipclist 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include <algorithm>
      6 #include <ostream>
      7 #include <set>
      8 #include <vector>
      9 
     10 #include "base/command_line.h"
     11 #include "base/containers/hash_tables.h"
     12 #include "base/memory/scoped_ptr.h"
     13 #include "base/memory/singleton.h"
     14 #include "base/message_loop/message_loop.h"
     15 #include "base/pickle.h"
     16 #include "base/strings/string_number_conversions.h"
     17 #include "base/strings/string_util.h"
     18 #include "base/strings/utf_string_conversions.h"
     19 #include "base/threading/thread.h"
     20 #include "base/time/time.h"
     21 #include "chrome/common/all_messages.h"
     22 #include "content/common/all_messages.h"
     23 #include "ipc/ipc_message.h"
     24 #include "ipc/ipc_message_utils.h"
     25 #include "ipc/ipc_switches.h"
     26 #include "ipc/ipc_sync_channel.h"
     27 #include "ipc/ipc_sync_message.h"
     28 
     29 #if defined(OS_POSIX)
     30 #include <unistd.h>
     31 #endif
     32 
     33 namespace IPC {
     34 class Message;
     35 
     36 // Interface implemented by those who fuzz basic types.  The types all
     37 // correspond to the types which a pickle from base/pickle.h can pickle,
     38 // plus the floating point types.
     39 class Fuzzer {
     40  public:
     41   // Select a message for fuzzing.
     42   virtual bool FuzzThisMessage(const IPC::Message *msg) = 0;
     43 
     44   // Tweak individual values within a message.
     45   virtual void FuzzBool(bool* value) = 0;
     46   virtual void FuzzInt(int* value) = 0;
     47   virtual void FuzzLong(long* value) = 0;
     48   virtual void FuzzSize(size_t* value) = 0;
     49   virtual void FuzzUChar(unsigned char *value) = 0;
     50   virtual void FuzzUInt16(uint16* value) = 0;
     51   virtual void FuzzUInt32(uint32* value) = 0;
     52   virtual void FuzzInt64(int64* value) = 0;
     53   virtual void FuzzUInt64(uint64* value) = 0;
     54   virtual void FuzzFloat(float *value) = 0;
     55   virtual void FuzzDouble(double *value) = 0;
     56   virtual void FuzzString(std::string* value) = 0;
     57   virtual void FuzzWString(std::wstring* value) = 0;
     58   virtual void FuzzString16(string16* value) = 0;
     59   virtual void FuzzData(char* data, int length) = 0;
     60   virtual void FuzzBytes(void* data, int data_len) = 0;
     61 };
     62 
     63 }  // namespace IPC
     64 
     65 namespace {
     66 
     67 template <typename T>
     68 void FuzzIntegralType(T* value, unsigned int frequency) {
     69   if (rand() % frequency == 0) {
     70     switch (rand() % 4) {
     71       case 0: (*value) = 0; break;
     72       case 1: (*value)--; break;
     73       case 2: (*value)++; break;
     74       case 3: (*value) ^= rand(); break;
     75     }
     76   }
     77 }
     78 
     79 template <typename T>
     80 void FuzzStringType(T* value, unsigned int frequency,
     81                     const T& literal1, const T& literal2) {
     82   if (rand() % frequency == 0) {
     83     switch (rand() % 5) {
     84       case 4: (*value) = (*value) + (*value);   // FALLTHROUGH
     85       case 3: (*value) = (*value) + (*value);   // FALLTHROUGH
     86       case 2: (*value) = (*value) + (*value); break;
     87       case 1: (*value) += literal1; break;
     88       case 0: (*value) = literal2; break;
     89     }
     90   }
     91 }
     92 
     93 }  // namespace
     94 
     95 // One such fuzzer implementation.
     96 class DefaultFuzzer : public IPC::Fuzzer {
     97  public:
     98   static const int DEFAULT_FREQUENCY = 23;
     99 
    100   DefaultFuzzer() : frequency_(DEFAULT_FREQUENCY) {
    101     const char *env_var;
    102     if ((env_var = getenv("CHROME_IPC_FUZZING_LIST"))) {
    103       std::string str = std::string(env_var);
    104       size_t pos;
    105       while ((pos = str.find_first_of(',')) != std::string::npos) {
    106         message_set_.insert(atoi(str.substr(0, pos).c_str()));
    107         str = str.substr(pos+1);
    108       }
    109       message_set_.insert(atoi(str.c_str()));
    110     }
    111 
    112     if ((env_var = getenv("CHROME_IPC_FUZZING_SEED"))) {
    113       int new_seed = atoi(env_var);
    114       if (new_seed)
    115         srand(new_seed);
    116     }
    117 
    118     if ((env_var = getenv("CHROME_IPC_FUZZING_FREQUENCY"))) {
    119       unsigned int new_frequency = atoi(env_var);
    120       if (new_frequency)
    121         frequency_ = new_frequency;
    122     }
    123   }
    124 
    125   virtual ~DefaultFuzzer() {}
    126 
    127   virtual bool FuzzThisMessage(const IPC::Message *msg) OVERRIDE {
    128     return (message_set_.empty() ||
    129             std::find(message_set_.begin(),
    130                       message_set_.end(),
    131                       msg->type()) != message_set_.end());
    132   }
    133 
    134   virtual void FuzzBool(bool* value) OVERRIDE {
    135     if (rand() % frequency_ == 0)
    136       (*value) = !(*value);
    137   }
    138 
    139   virtual void FuzzInt(int* value) OVERRIDE {
    140     FuzzIntegralType<int>(value, frequency_);
    141   }
    142 
    143   virtual void FuzzLong(long* value) OVERRIDE {
    144     FuzzIntegralType<long>(value, frequency_);
    145   }
    146 
    147   virtual void FuzzSize(size_t* value) OVERRIDE {
    148     FuzzIntegralType<size_t>(value, frequency_);
    149   }
    150 
    151   virtual void FuzzUChar(unsigned char* value) OVERRIDE {
    152     FuzzIntegralType<unsigned char>(value, frequency_);
    153   }
    154 
    155   virtual void FuzzUInt16(uint16* value) OVERRIDE {
    156     FuzzIntegralType<uint16>(value, frequency_);
    157   }
    158 
    159   virtual void FuzzUInt32(uint32* value) OVERRIDE {
    160     FuzzIntegralType<uint32>(value, frequency_);
    161   }
    162 
    163   virtual void FuzzInt64(int64* value) OVERRIDE {
    164     FuzzIntegralType<int64>(value, frequency_);
    165   }
    166 
    167   virtual void FuzzUInt64(uint64* value) OVERRIDE {
    168     FuzzIntegralType<uint64>(value, frequency_);
    169   }
    170 
    171   virtual void FuzzFloat(float* value) OVERRIDE {
    172     if (rand() % frequency_ == 0)
    173       (*value) *= rand() / 1000000.0;
    174   }
    175 
    176   virtual void FuzzDouble(double* value) OVERRIDE {
    177     if (rand() % frequency_ == 0)
    178       (*value) *= rand() / 1000000.0;
    179   }
    180 
    181   virtual void FuzzString(std::string* value) OVERRIDE {
    182     FuzzStringType<std::string>(value, frequency_, "BORKED", std::string());
    183   }
    184 
    185   virtual void FuzzWString(std::wstring* value) OVERRIDE {
    186     FuzzStringType<std::wstring>(value, frequency_, L"BORKED", std::wstring());
    187   }
    188 
    189   virtual void FuzzString16(string16* value) OVERRIDE {
    190     FuzzStringType<string16>(value, frequency_,
    191                              WideToUTF16(L"BORKED"),
    192                              WideToUTF16(std::wstring()));
    193   }
    194 
    195   virtual void FuzzData(char* data, int length) OVERRIDE {
    196     if (rand() % frequency_ == 0) {
    197       for (int i = 0; i < length; ++i) {
    198         FuzzIntegralType<char>(&data[i], frequency_);
    199       }
    200     }
    201   }
    202 
    203   virtual void FuzzBytes(void* data, int data_len) OVERRIDE {
    204     FuzzData(static_cast<char*>(data), data_len);
    205   }
    206 
    207  private:
    208   std::set<int> message_set_;
    209   unsigned int frequency_;
    210 };
    211 
    212 
    213 // No-op fuzzer.  Rewrites each message unchanged to check if the message
    214 // re-assembly is legit.
    215 class NoOpFuzzer : public IPC::Fuzzer {
    216  public:
    217   NoOpFuzzer() {}
    218   virtual ~NoOpFuzzer() {}
    219 
    220   virtual bool FuzzThisMessage(const IPC::Message *msg) OVERRIDE {
    221     return true;
    222   }
    223 
    224   virtual void FuzzBool(bool* value) OVERRIDE {}
    225   virtual void FuzzInt(int* value) OVERRIDE {}
    226   virtual void FuzzLong(long* value) OVERRIDE {}
    227   virtual void FuzzSize(size_t* value) OVERRIDE {}
    228   virtual void FuzzUChar(unsigned char* value) OVERRIDE {}
    229   virtual void FuzzUInt16(uint16* value) OVERRIDE {}
    230   virtual void FuzzUInt32(uint32* value) OVERRIDE {}
    231   virtual void FuzzInt64(int64* value) OVERRIDE {}
    232   virtual void FuzzUInt64(uint64* value) OVERRIDE {}
    233   virtual void FuzzFloat(float* value) OVERRIDE {}
    234   virtual void FuzzDouble(double* value) OVERRIDE {}
    235   virtual void FuzzString(std::string* value) OVERRIDE {}
    236   virtual void FuzzWString(std::wstring* value) OVERRIDE {}
    237   virtual void FuzzString16(string16* value) OVERRIDE {}
    238   virtual void FuzzData(char* data, int length) OVERRIDE {}
    239   virtual void FuzzBytes(void* data, int data_len) OVERRIDE {}
    240 };
    241 
    242 class FuzzerFactory {
    243  public:
    244   static IPC::Fuzzer *NewFuzzer(const std::string& name) {
    245     if (name == "no-op")
    246       return new NoOpFuzzer();
    247     else
    248       return new DefaultFuzzer();
    249   }
    250 };
    251 
    252 // Partially-specialized class that knows how to fuzz a given type.
    253 template <class P>
    254 struct FuzzTraits {
    255   static void Fuzz(P* p, IPC::Fuzzer *fuzzer) {}
    256 };
    257 
    258 // Template function to invoke partially-specialized class method.
    259 template <class P>
    260 static void FuzzParam(P* p, IPC::Fuzzer* fuzzer) {
    261   FuzzTraits<P>::Fuzz(p, fuzzer);
    262 }
    263 
    264 // Specializations to fuzz primitive types.
    265 template <>
    266 struct FuzzTraits<bool> {
    267   static void Fuzz(bool* p, IPC::Fuzzer* fuzzer) {
    268     fuzzer->FuzzBool(p);
    269   }
    270 };
    271 
    272 template <>
    273 struct FuzzTraits<int> {
    274   static void Fuzz(int* p, IPC::Fuzzer* fuzzer) {
    275     fuzzer->FuzzInt(p);
    276   }
    277 };
    278 
    279 template <>
    280 struct FuzzTraits<unsigned int> {
    281   static void Fuzz(unsigned int* p, IPC::Fuzzer* fuzzer) {
    282     fuzzer->FuzzInt(reinterpret_cast<int*>(p));
    283   }
    284 };
    285 
    286 template <>
    287 struct FuzzTraits<long> {
    288   static void Fuzz(long* p, IPC::Fuzzer* fuzzer) {
    289     fuzzer->FuzzLong(p);
    290   }
    291 };
    292 
    293 template <>
    294 struct FuzzTraits<unsigned long> {
    295   static void Fuzz(unsigned long* p, IPC::Fuzzer* fuzzer) {
    296     fuzzer->FuzzLong(reinterpret_cast<long*>(p));
    297   }
    298 };
    299 
    300 template <>
    301 struct FuzzTraits<long long> {
    302   static void Fuzz(long long* p, IPC::Fuzzer* fuzzer) {
    303     fuzzer->FuzzInt64(reinterpret_cast<int64*>(p));
    304   }
    305 };
    306 
    307 template <>
    308 struct FuzzTraits<unsigned long long> {
    309   static void Fuzz(unsigned long long* p, IPC::Fuzzer* fuzzer) {
    310     fuzzer->FuzzInt64(reinterpret_cast<int64*>(p));
    311   }
    312 };
    313 
    314 template <>
    315 struct FuzzTraits<short> {
    316   static void Fuzz(short* p, IPC::Fuzzer* fuzzer) {
    317     fuzzer->FuzzUInt16(reinterpret_cast<uint16*>(p));
    318   }
    319 };
    320 
    321 template <>
    322 struct FuzzTraits<unsigned short> {
    323   static void Fuzz(unsigned short* p, IPC::Fuzzer* fuzzer) {
    324     fuzzer->FuzzUInt16(reinterpret_cast<uint16*>(p));
    325   }
    326 };
    327 
    328 template <>
    329 struct FuzzTraits<char> {
    330   static void Fuzz(char* p, IPC::Fuzzer* fuzzer) {
    331     fuzzer->FuzzUChar(reinterpret_cast<unsigned char*>(p));
    332   }
    333 };
    334 
    335 template <>
    336 struct FuzzTraits<unsigned char> {
    337   static void Fuzz(unsigned char* p, IPC::Fuzzer* fuzzer) {
    338     fuzzer->FuzzUChar(p);
    339   }
    340 };
    341 
    342 template <>
    343 struct FuzzTraits<float> {
    344   static void Fuzz(float* p, IPC::Fuzzer* fuzzer) {
    345     fuzzer->FuzzFloat(p);
    346   }
    347 };
    348 
    349 template <>
    350 struct FuzzTraits<double> {
    351   static void Fuzz(double* p, IPC::Fuzzer* fuzzer) {
    352     fuzzer->FuzzDouble(p);
    353   }
    354 };
    355 
    356 template <>
    357 struct FuzzTraits<std::string> {
    358   static void Fuzz(std::string* p, IPC::Fuzzer* fuzzer) {
    359     fuzzer->FuzzString(p);
    360   }
    361 };
    362 
    363 template <>
    364 struct FuzzTraits<std::wstring> {
    365   static void Fuzz(std::wstring* p, IPC::Fuzzer* fuzzer) {
    366     fuzzer->FuzzWString(p);
    367   }
    368 };
    369 
    370 template <>
    371 struct FuzzTraits<string16> {
    372   static void Fuzz(string16* p, IPC::Fuzzer* fuzzer) {
    373     fuzzer->FuzzString16(p);
    374   }
    375 };
    376 
    377 // Specializations to fuzz tuples.
    378 template <class A>
    379 struct FuzzTraits<Tuple1<A> > {
    380   static void Fuzz(Tuple1<A>* p, IPC::Fuzzer* fuzzer) {
    381     FuzzParam(&p->a, fuzzer);
    382   }
    383 };
    384 
    385 template <class A, class B>
    386 struct FuzzTraits<Tuple2<A, B> > {
    387   static void Fuzz(Tuple2<A, B>* p, IPC::Fuzzer* fuzzer) {
    388     FuzzParam(&p->a, fuzzer);
    389     FuzzParam(&p->b, fuzzer);
    390   }
    391 };
    392 
    393 template <class A, class B, class C>
    394 struct FuzzTraits<Tuple3<A, B, C> > {
    395   static void Fuzz(Tuple3<A, B, C>* p, IPC::Fuzzer* fuzzer) {
    396     FuzzParam(&p->a, fuzzer);
    397     FuzzParam(&p->b, fuzzer);
    398     FuzzParam(&p->c, fuzzer);
    399   }
    400 };
    401 
    402 template <class A, class B, class C, class D>
    403 struct FuzzTraits<Tuple4<A, B, C, D> > {
    404   static void Fuzz(Tuple4<A, B, C, D>* p, IPC::Fuzzer* fuzzer) {
    405     FuzzParam(&p->a, fuzzer);
    406     FuzzParam(&p->b, fuzzer);
    407     FuzzParam(&p->c, fuzzer);
    408     FuzzParam(&p->d, fuzzer);
    409   }
    410 };
    411 
    412 template <class A, class B, class C, class D, class E>
    413 struct FuzzTraits<Tuple5<A, B, C, D, E> > {
    414   static void Fuzz(Tuple5<A, B, C, D, E>* p, IPC::Fuzzer* fuzzer) {
    415     FuzzParam(&p->a, fuzzer);
    416     FuzzParam(&p->b, fuzzer);
    417     FuzzParam(&p->c, fuzzer);
    418     FuzzParam(&p->d, fuzzer);
    419     FuzzParam(&p->e, fuzzer);
    420   }
    421 };
    422 
    423 // Specializations to fuzz containers.
    424 template <class A>
    425 struct FuzzTraits<std::vector<A> > {
    426   static void Fuzz(std::vector<A>* p, IPC::Fuzzer* fuzzer) {
    427     for (size_t i = 0; i < p->size(); ++i) {
    428       FuzzParam(&p->at(i), fuzzer);
    429     }
    430   }
    431 };
    432 
    433 template <class A, class B>
    434 struct FuzzTraits<std::map<A, B> > {
    435   static void Fuzz(std::map<A, B>* p, IPC::Fuzzer* fuzzer) {
    436     typename std::map<A, B>::iterator it;
    437     for (it = p->begin(); it != p->end(); ++it) {
    438       FuzzParam(&it->second, fuzzer);
    439     }
    440   }
    441 };
    442 
    443 template <class A, class B>
    444 struct FuzzTraits<std::pair<A, B> > {
    445   static void Fuzz(std::pair<A, B>* p, IPC::Fuzzer* fuzzer) {
    446     FuzzParam(&p->second, fuzzer);
    447   }
    448 };
    449 
    450 // Specializations to fuzz hand-coded tyoes
    451 template <>
    452 struct FuzzTraits<base::FileDescriptor> {
    453   static void Fuzz(base::FileDescriptor* p, IPC::Fuzzer* fuzzer) {
    454     FuzzParam(&p->fd, fuzzer);
    455   }
    456 };
    457 
    458 template <>
    459 struct FuzzTraits<GURL> {
    460   static void Fuzz(GURL *p, IPC::Fuzzer* fuzzer) {
    461     FuzzParam(&p->possibly_invalid_spec(), fuzzer);
    462   }
    463 };
    464 
    465 template <>
    466 struct FuzzTraits<gfx::Point> {
    467   static void Fuzz(gfx::Point *p, IPC::Fuzzer* fuzzer) {
    468     int x = p->x();
    469     int y = p->y();
    470     FuzzParam(&x, fuzzer);
    471     FuzzParam(&y, fuzzer);
    472     p->SetPoint(x, y);
    473   }
    474 };
    475 
    476 template <>
    477 struct FuzzTraits<gfx::Size> {
    478   static void Fuzz(gfx::Size *p, IPC::Fuzzer* fuzzer) {
    479     int w = p->width();
    480     int h = p->height();
    481     FuzzParam(&w, fuzzer);
    482     FuzzParam(&h, fuzzer);
    483     p->SetSize(w, h);
    484   }
    485 };
    486 
    487 template <>
    488 struct FuzzTraits<gfx::Rect> {
    489   static void Fuzz(gfx::Rect *p, IPC::Fuzzer* fuzzer) {
    490     gfx::Point origin = p->origin();
    491     gfx::Size  size = p->size();
    492     FuzzParam(&origin, fuzzer);
    493     FuzzParam(&size, fuzzer);
    494     p->set_origin(origin);
    495     p->set_size(size);
    496   }
    497 };
    498 
    499 // Means for updating message id in pickles.
    500 class PickleCracker : public Pickle {
    501  public:
    502   static void CopyMessageID(PickleCracker *dst, PickleCracker *src) {
    503     memcpy(dst->mutable_payload(), src->payload(), sizeof(int));
    504   }
    505 };
    506 
    507 // Redefine macros to generate fuzzing from traits declarations.
    508 // Null out all the macros that need nulling.
    509 #include "ipc/ipc_message_null_macros.h"
    510 
    511 // STRUCT declarations cause corresponding STRUCT_TRAITS declarations to occur.
    512 #undef IPC_STRUCT_BEGIN_WITH_PARENT
    513 #undef IPC_STRUCT_MEMBER
    514 #undef IPC_STRUCT_END
    515 #define IPC_STRUCT_BEGIN_WITH_PARENT(struct_name, parent)\
    516   IPC_STRUCT_TRAITS_BEGIN(struct_name)
    517 #define IPC_STRUCT_MEMBER(type, name, ...) IPC_STRUCT_TRAITS_MEMBER(name)
    518 #define IPC_STRUCT_END() IPC_STRUCT_TRAITS_END()
    519 
    520 // Set up so next include will generate fuzz trait classes.
    521 #undef IPC_STRUCT_TRAITS_BEGIN
    522 #undef IPC_STRUCT_TRAITS_MEMBER
    523 #undef IPC_STRUCT_TRAITS_PARENT
    524 #undef IPC_STRUCT_TRAITS_END
    525 #define IPC_STRUCT_TRAITS_BEGIN(struct_name) \
    526   template <> \
    527   struct FuzzTraits<struct_name> { \
    528     static void Fuzz(struct_name *p, IPC::Fuzzer* fuzzer) { \
    529 
    530 #define IPC_STRUCT_TRAITS_MEMBER(name) \
    531       FuzzParam(&p->name, fuzzer);
    532 
    533 #define IPC_STRUCT_TRAITS_PARENT(type) \
    534       FuzzParam(static_cast<type*>(p), fuzzer);
    535 
    536 #define IPC_STRUCT_TRAITS_END() \
    537     } \
    538   };
    539 
    540 #undef IPC_ENUM_TRAITS_VALIDATE
    541 #define IPC_ENUM_TRAITS_VALIDATE(enum_name, validation_expression) \
    542   template <> \
    543   struct FuzzTraits<enum_name> { \
    544     static void Fuzz(enum_name* p, IPC::Fuzzer* fuzzer) { \
    545       FuzzParam(reinterpret_cast<int*>(p), fuzzer); \
    546     } \
    547   };
    548 
    549 // Bring them into existence.
    550 #include "chrome/common/all_messages.h"
    551 #include "content/common/all_messages.h"
    552 
    553 // Redefine macros to generate fuzzing funtions
    554 #include "ipc/ipc_message_null_macros.h"
    555 #undef IPC_MESSAGE_DECL
    556 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist)           \
    557   IPC_##kind##_##type##_FUZZ(name, in, out, ilist, olist)
    558 
    559 #define IPC_EMPTY_CONTROL_FUZZ(name, in, out, ilist, olist)                 \
    560   IPC::Message* fuzzer_for_##name(IPC::Message *msg, IPC::Fuzzer* fuzzer) { \
    561     return NULL;                                                            \
    562   }
    563 
    564 #define IPC_EMPTY_ROUTED_FUZZ(name, in, out, ilist, olist)                  \
    565   IPC::Message* fuzzer_for_##name(IPC::Message *msg, IPC::Fuzzer* fuzzer) { \
    566     return NULL;                                                            \
    567   }
    568 
    569 #define IPC_ASYNC_CONTROL_FUZZ(name, in, out, ilist, olist)                 \
    570   IPC::Message* fuzzer_for_##name(IPC::Message *msg, IPC::Fuzzer* fuzzer) { \
    571     name* real_msg = static_cast<name*>(msg);                               \
    572     IPC_TUPLE_IN_##in ilist p;                                              \
    573     name::Read(real_msg, &p);                                               \
    574     FuzzParam(&p, fuzzer);                                                  \
    575     return new name(IPC_MEMBERS_IN_##in(p));                                \
    576   }
    577 
    578 #define IPC_ASYNC_ROUTED_FUZZ(name, in, out, ilist, olist)                  \
    579   IPC::Message* fuzzer_for_##name(IPC::Message *msg, IPC::Fuzzer* fuzzer) { \
    580     name* real_msg = static_cast<name*>(msg);                               \
    581     IPC_TUPLE_IN_##in ilist p;                                              \
    582     name::Read(real_msg, &p);                                               \
    583     FuzzParam(&p, fuzzer);                                                  \
    584     return new name(msg->routing_id()                                       \
    585                     IPC_COMMA_##in                                          \
    586                     IPC_MEMBERS_IN_##in(p));                                \
    587   }
    588 
    589 #define IPC_SYNC_CONTROL_FUZZ(name, in, out, ilist, olist)                  \
    590   IPC::Message* fuzzer_for_##name(IPC::Message *msg, IPC::Fuzzer* fuzzer) { \
    591     name* real_msg = static_cast<name*>(msg);                               \
    592     IPC_TUPLE_IN_##in ilist p;                                              \
    593     name::ReadSendParam(real_msg, &p);                                      \
    594     FuzzParam(&p, fuzzer);                                                  \
    595     name* new_msg = new name(IPC_MEMBERS_IN_##in(p)                         \
    596                              IPC_COMMA_AND_##out(IPC_COMMA_##in)            \
    597                              IPC_MEMBERS_OUT_##out());                      \
    598     PickleCracker::CopyMessageID(                                           \
    599         reinterpret_cast<PickleCracker *>(new_msg),                         \
    600         reinterpret_cast<PickleCracker *>(real_msg));                       \
    601     return new_msg;                                                         \
    602   }
    603 
    604 
    605 #define IPC_SYNC_ROUTED_FUZZ(name, in, out, ilist, olist)                   \
    606   IPC::Message* fuzzer_for_##name(IPC::Message *msg, IPC::Fuzzer* fuzzer) { \
    607     name* real_msg = static_cast<name*>(msg);                               \
    608     IPC_TUPLE_IN_##in ilist p;                                              \
    609     name::ReadSendParam(real_msg, &p);                                      \
    610     FuzzParam(&p, fuzzer);                                                  \
    611     name* new_msg = new name(msg->routing_id()                              \
    612                              IPC_COMMA_OR_##out(IPC_COMMA_##in)             \
    613                              IPC_MEMBERS_IN_##in(p)                         \
    614                              IPC_COMMA_AND_##out(IPC_COMMA_##in)            \
    615                              IPC_MEMBERS_OUT_##out());                      \
    616     PickleCracker::CopyMessageID(                                           \
    617         reinterpret_cast<PickleCracker *>(new_msg),                         \
    618         reinterpret_cast<PickleCracker *>(real_msg));                       \
    619     return new_msg;                                                         \
    620   }
    621 
    622 #define IPC_MEMBERS_IN_0(p)
    623 #define IPC_MEMBERS_IN_1(p)                 p.a
    624 #define IPC_MEMBERS_IN_2(p)                 p.a, p.b
    625 #define IPC_MEMBERS_IN_3(p)                 p.a, p.b, p.c
    626 #define IPC_MEMBERS_IN_4(p)                 p.a, p.b, p.c, p.d
    627 #define IPC_MEMBERS_IN_5(p)                 p.a, p.b, p.c, p.d, p.e
    628 
    629 #define IPC_MEMBERS_OUT_0()
    630 #define IPC_MEMBERS_OUT_1()                NULL
    631 #define IPC_MEMBERS_OUT_2()                NULL, NULL
    632 #define IPC_MEMBERS_OUT_3()                NULL, NULL, NULL
    633 #define IPC_MEMBERS_OUT_4()                NULL, NULL, NULL, NULL
    634 #define IPC_MEMBERS_OUT_5()                NULL, NULL, NULL, NULL, NULL
    635 
    636 #include "chrome/common/all_messages.h"
    637 #include "content/common/all_messages.h"
    638 
    639 typedef IPC::Message* (*FuzzFunction)(IPC::Message*, IPC::Fuzzer*);
    640 typedef base::hash_map<uint32, FuzzFunction> FuzzFunctionMap;
    641 
    642 // Redefine macros to register fuzzing functions into map.
    643 #include "ipc/ipc_message_null_macros.h"
    644 #undef IPC_MESSAGE_DECL
    645 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \
    646   (*map)[static_cast<uint32>(name::ID)] = fuzzer_for_##name;
    647 
    648 void PopulateFuzzFunctionMap(FuzzFunctionMap *map) {
    649 #include "chrome/common/all_messages.h"
    650 #include "content/common/all_messages.h"
    651 }
    652 
    653 class ipcfuzz : public IPC::ChannelProxy::OutgoingMessageFilter {
    654  public:
    655   ipcfuzz() {
    656     const char* env_var = getenv("CHROME_IPC_FUZZING_KIND");
    657     fuzzer_ = FuzzerFactory::NewFuzzer(env_var ? env_var : "");
    658     PopulateFuzzFunctionMap(&fuzz_function_map_);
    659   }
    660 
    661   virtual IPC::Message* Rewrite(IPC::Message* message) OVERRIDE {
    662     if (fuzzer_ && fuzzer_->FuzzThisMessage(message)) {
    663       FuzzFunctionMap::iterator it = fuzz_function_map_.find(message->type());
    664       if (it != fuzz_function_map_.end()) {
    665         IPC::Message* fuzzed_message = (*it->second)(message, fuzzer_);
    666         if (fuzzed_message)  {
    667           delete message;
    668           message = fuzzed_message;
    669         }
    670       }
    671     }
    672     return message;
    673   }
    674 
    675  private:
    676   IPC::Fuzzer* fuzzer_;
    677   FuzzFunctionMap fuzz_function_map_;
    678 };
    679 
    680 ipcfuzz g_ipcfuzz;
    681 
    682 // Entry point avoiding mangled names.
    683 extern "C" {
    684   __attribute__((visibility("default")))
    685   IPC::ChannelProxy::OutgoingMessageFilter* GetFilter(void);
    686 }
    687 
    688 IPC::ChannelProxy::OutgoingMessageFilter* GetFilter(void) {
    689   return &g_ipcfuzz;
    690 }
    691