| # Copyright 2016 The Chromium Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| # Fuzzers for content/ components. |
| |
| import("//testing/libfuzzer/fuzzer_test.gni") |
| import("//third_party/protobuf/proto_library.gni") |
| |
| # Empty group for package discovery. |
| group("fuzzer") { |
| } |
| |
| source_set("fuzzer_support") { |
| sources = [ |
| "fuzzer_support.cc", |
| "fuzzer_support.h", |
| ] |
| public_deps = [ |
| "//base", |
| "//base/test:test_config", |
| "//content/renderer:for_content_tests", |
| "//content/shell:content_shell_lib", |
| "//content/test:test_support", |
| "//gin", |
| "//tools/v8_context_snapshot", |
| ] |
| configs += [ "//tools/v8_context_snapshot:use_v8_context_snapshot" ] |
| testonly = true |
| } |
| |
| fuzzer_test("origin_trial_token_fuzzer") { |
| sources = [ |
| "origin_trial_token_fuzzer.cc", |
| ] |
| deps = [ |
| "//content/test:test_support", |
| ] |
| dict = |
| "//content/test/data/fuzzer_dictionaries/origin_trial_token_fuzzer.dict" |
| seed_corpus = "//content/test/data/fuzzer_corpus/origin_trial_token_data/" |
| } |
| |
| fuzzer_test("origin_policy_parser_fuzzer") { |
| sources = [ |
| "origin_policy_parser_fuzzer.cc", |
| ] |
| deps = [ |
| "//base", |
| "//base:i18n", |
| "//content/test:test_support", |
| ] |
| dict = |
| "//content/test/data/fuzzer_dictionaries/origin_policy_parser_fuzzer.dict" |
| seed_corpus = "//content/test/data/fuzzer_corpus/origin_policy_parser_data/" |
| } |
| |
| fuzzer_test("renderer_fuzzer") { |
| sources = [ |
| "renderer_fuzzer.cc", |
| ] |
| deps = [ |
| ":fuzzer_support", |
| ] |
| } |
| |
| fuzzer_test("renderer_tree_fuzzer") { |
| sources = [ |
| "renderer_tree_fuzzer.cc", |
| ] |
| deps = [ |
| ":fuzzer_support", |
| ] |
| } |
| |
| fuzzer_test("clear_site_data_fuzzer") { |
| sources = [ |
| "clear_site_data_fuzzer.cc", |
| ] |
| deps = [ |
| "//content/test:test_support", |
| ] |
| seed_corpus = "//content/test/data/fuzzer_corpus/clear_site_data/" |
| } |
| |
| fuzzer_test("renderer_proto_tree_fuzzer") { |
| sources = [ |
| "renderer_proto_tree_fuzzer.cc", |
| ] |
| deps = [ |
| ":fuzzer_support", |
| ":html_tree_proto", |
| "//third_party/libprotobuf-mutator", |
| ] |
| } |
| |
| proto_library("html_tree_proto") { |
| sources = [ |
| "html_tree.proto", |
| ] |
| testonly = true |
| } |
| |
| fuzzer_test("signed_exchange_envelope_fuzzer") { |
| sources = [ |
| "signed_exchange_envelope_fuzzer.cc", |
| ] |
| deps = [ |
| "//base:i18n", |
| "//content/test:test_support", |
| ] |
| seed_corpus = "//content/test/data/sxg/" |
| } |
| |
| fuzzer_test("devtools_protocol_encoding_cbor_fuzzer") { |
| sources = [ |
| "../../browser/devtools/devtools_protocol_encoding.cc", |
| "../../browser/devtools/devtools_protocol_encoding.h", |
| "../../browser/devtools/devtools_protocol_encoding_cbor_fuzzer.cc", |
| ] |
| deps = [ |
| "//base", |
| "//third_party/inspector_protocol:encoding", |
| ] |
| seed_corpus = |
| "../../browser/devtools/devtools_protocol_encoding_cbor_fuzzer_corpus/" |
| } |
| |
| fuzzer_test("devtools_protocol_encoding_json_fuzzer") { |
| sources = [ |
| "../../browser/devtools/devtools_protocol_encoding.cc", |
| "../../browser/devtools/devtools_protocol_encoding.h", |
| "../../browser/devtools/devtools_protocol_encoding_json_fuzzer.cc", |
| ] |
| deps = [ |
| "//base", |
| "//third_party/inspector_protocol:encoding", |
| ] |
| seed_corpus = "//third_party/grpc/src/test/core/json/corpus/" |
| } |
| |
| fuzzer_test("inspector_fuzzer") { |
| sources = [ |
| "../../browser/devtools/inspector_fuzzer.cc", |
| ] |
| deps = [ |
| "//third_party/inspector_protocol:encoding", |
| ] |
| seed_corpus = "//components/cbor/reader_fuzzer_corpus/" |
| } |
| |
| fuzzer_test("signed_exchange_certificate_chain_fuzzer") { |
| sources = [ |
| "../../browser/web_package/signed_exchange_certificate_chain_fuzzer.cc", |
| ] |
| deps = [ |
| "//content/test:test_support", |
| ] |
| seed_corpus = "//content/test/data/fuzzer_corpus/signed_exchange_certificate_chain_data/" |
| } |
| |
| fuzzer_test("appcache_manifest_parser_fuzzer") { |
| sources = [ |
| "appcache_manifest_parser_fuzzer.cc", |
| ] |
| deps = [ |
| "//base:i18n", |
| "//content/test:test_support", |
| ] |
| dict = "//content/test/data/fuzzer_dictionaries/appcache_manifest_parser_fuzzer.dict" |
| seed_corpus = "//third_party/blink/web_tests/http/tests/appcache/resources/" |
| } |
| |
| fuzzer_test("merkle_integrity_source_stream_fuzzer") { |
| sources = [ |
| "merkle_integrity_source_stream_fuzzer.cc", |
| ] |
| |
| # This fuzzer depends on net::FuzzedSourceStream, in net_fuzzer_test_support, |
| # but both it and //content:test_support set up similar globals. As |
| # MerkleIntegritySourceStream does not depend on anything in //content and |
| # will ultimately live in //net, use the //net one instead of the //content |
| # one. |
| deps = [ |
| "//content/browser:for_content_tests", |
| "//content/renderer:for_content_tests", |
| "//content/shell:content_shell_lib", |
| "//content/test:test_support", |
| "//net:net_fuzzer_test_support", |
| "//net:test_support", |
| ] |
| dict = "//content/test/data/fuzzer_dictionaries/merkle_integrity_source_stream_fuzzer.dict" |
| environment_variables = [ "AFL_DRIVER_DONT_DEFER=1" ] |
| } |
| |
| proto_library("appcache_fuzzer_proto") { |
| sources = [ |
| "../../browser/appcache/appcache_fuzzer.proto", |
| ] |
| testonly = true |
| } |
| |
| fuzzer_test("appcache_fuzzer") { |
| sources = [ |
| "../../browser/appcache/appcache_fuzzer.cc", |
| "../../browser/appcache/mock_appcache_storage.cc", |
| "../../browser/appcache/mock_appcache_storage.h", |
| ] |
| |
| deps = [ |
| ":appcache_fuzzer_proto", |
| "//base/test:test_support", |
| "//content/app:both_for_content_tests", |
| "//content/browser:browser", |
| "//content/public/browser:browser_sources", |
| "//content/test:test_support", |
| "//mojo/core/embedder", |
| "//services/network:test_support", |
| "//storage/browser:test_support", |
| "//third_party/libprotobuf-mutator", |
| ] |
| } |
| |
| # Note: this compiles and runs on Mac but may cause |
| # system instability; if you try it out, close other |
| # programs and then reboot afterwards. It should be |
| # possible to make it work on Linux if you use the |
| # --enable-speech-dispatcher flag. |
| if (is_win) { |
| fuzzer_test("tts_platform_fuzzer") { |
| sources = [ |
| "../../browser/speech/mock_tts_controller.cc", |
| "../../browser/speech/tts_mac.mm", |
| "../../browser/speech/tts_platform_fuzzer.cc", |
| "../../browser/speech/tts_platform_impl.cc", |
| "../../browser/speech/tts_platform_impl.h", |
| "../../browser/speech/tts_win.cc", |
| "../../public/browser/tts_controller.h", |
| "../../public/browser/tts_platform.h", |
| "//content/common/content_export.h", |
| ] |
| |
| # TODO(https://crbug.com/927728): Refactor target to not require this. |
| check_includes = false |
| |
| deps = [ |
| "//base", |
| "//base/test:test_support", |
| "//ui/base", |
| "//url:url", |
| ] |
| } |
| } |
| |
| fuzzer_test("speech_audio_encoder_fuzzer") { |
| sources = [ |
| "../../browser/speech/audio_buffer.cc", |
| "../../browser/speech/audio_buffer.h", |
| "../../browser/speech/audio_encoder.cc", |
| "../../browser/speech/audio_encoder.h", |
| "../../browser/speech/audio_encoder_fuzzer.cc", |
| "//content/common/content_export.h", |
| ] |
| |
| deps = [ |
| "//base", |
| "//third_party/flac", |
| ] |
| } |