Merge pull request #8579 from ctiller/apifuzzit

Add resource quota configuration to API fuzzer

build.yaml

@@ -2110,7 +2110,7 @@ targets:
   - gpr_test_util
   - gpr
   corpus_dirs:
-  - test/core/http/corpus
+  - test/core/http/request_corpus
   maxlen: 2048
 - name: http_response_fuzzer_test
   build: fuzzer
@@ -2123,7 +2123,7 @@ targets:
   - gpr_test_util
   - gpr
   corpus_dirs:
-  - test/core/http/corpus
+  - test/core/http/response_corpus
   maxlen: 2048
 - name: httpcli_format_request_test
   build: test

src/core/lib/channel/http_server_filter.c

@@ -162,7 +162,6 @@ static grpc_mdelem *server_filter(void *user_data, grpc_mdelem *md) {
     /* Retrieve the payload from the value of the 'grpc-internal-payload-bin'
        header field */
     calld->seen_payload_bin = 1;
-    gpr_slice_buffer_init(&calld->read_slice_buffer);
     gpr_slice_buffer_add(&calld->read_slice_buffer,
                          gpr_slice_ref(md->value->slice));
     grpc_slice_buffer_stream_init(&calld->read_stream,
@@ -314,13 +313,17 @@ static grpc_error *init_call_elem(grpc_exec_ctx *exec_ctx,
   grpc_closure_init(&calld->hs_on_recv, hs_on_recv, elem);
   grpc_closure_init(&calld->hs_on_complete, hs_on_complete, elem);
   grpc_closure_init(&calld->hs_recv_message_ready, hs_recv_message_ready, elem);
+  gpr_slice_buffer_init(&calld->read_slice_buffer);
   return GRPC_ERROR_NONE;
 }
 
 /* Destructor for call_data */
 static void destroy_call_elem(grpc_exec_ctx *exec_ctx, grpc_call_element *elem,
                               const grpc_call_final_info *final_info,
-                              void *ignored) {}
+                              void *ignored) {
+  call_data *calld = elem->call_data;
+  gpr_slice_buffer_destroy(&calld->read_slice_buffer);
+}
 
 /* Constructor for channel_data */
 static void init_channel_elem(grpc_exec_ctx *exec_ctx,

src/core/lib/transport/metadata.c

@@ -687,6 +687,11 @@ size_t grpc_mdstr_length(const grpc_mdstr *s) { return GRPC_MDSTR_LENGTH(s); }
 grpc_mdstr *grpc_mdstr_ref(grpc_mdstr *gs DEBUG_ARGS) {
   internal_string *s = (internal_string *)gs;
   if (is_mdstr_static(gs)) return gs;
+#ifdef GRPC_METADATA_REFCOUNT_DEBUG
+  gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG, "STR   REF:%p:%zu->%zu: '%s'",
+          (void *)s, gpr_atm_no_barrier_load(&s->refcnt),
+          gpr_atm_no_barrier_load(&s->refcnt) + 1, grpc_mdstr_as_c_string(gs));
+#endif
   GPR_ASSERT(gpr_atm_full_fetch_add(&s->refcnt, 1) > 0);
   return gs;
 }
@@ -694,6 +699,11 @@ grpc_mdstr *grpc_mdstr_ref(grpc_mdstr *gs DEBUG_ARGS) {
 void grpc_mdstr_unref(grpc_mdstr *gs DEBUG_ARGS) {
   internal_string *s = (internal_string *)gs;
   if (is_mdstr_static(gs)) return;
+#ifdef GRPC_METADATA_REFCOUNT_DEBUG
+  gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG, "STR UNREF:%p:%zu->%zu: '%s'",
+          (void *)s, gpr_atm_no_barrier_load(&s->refcnt),
+          gpr_atm_no_barrier_load(&s->refcnt) - 1, grpc_mdstr_as_c_string(gs));
+#endif
   if (1 == gpr_atm_full_fetch_add(&s->refcnt, -1)) {
     strtab_shard *shard =
         &g_strtab_shard[SHARD_IDX(s->hash, LOG2_STRTAB_SHARD_COUNT)];

test/core/end2end/fuzzers/api_fuzzer.c

@@ -55,6 +55,21 @@ bool leak_check = true;
 
 static void dont_log(gpr_log_func_args *args) {}
 
+////////////////////////////////////////////////////////////////////////////////
+// global state
+
+static gpr_timespec g_now;
+static grpc_server *g_server;
+static grpc_channel *g_channel;
+static grpc_resource_quota *g_resource_quota;
+
+extern gpr_timespec (*gpr_now_impl)(gpr_clock_type clock_type);
+
+static gpr_timespec now_impl(gpr_clock_type clock_type) {
+  GPR_ASSERT(clock_type != GPR_TIMESPAN);
+  return g_now;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // input_stream: allows easy access to input bytes, and allows reading a little
 //               past the end (avoiding needing to check everywhere)
@@ -150,13 +165,28 @@ static grpc_channel_args *read_args(input_stream *inp) {
   size_t n = next_byte(inp);
   grpc_arg *args = gpr_malloc(sizeof(*args) * n);
   for (size_t i = 0; i < n; i++) {
-    bool is_string = next_byte(inp) & 1;
-    args[i].type = is_string ? GRPC_ARG_STRING : GRPC_ARG_INTEGER;
-    args[i].key = read_string(inp);
-    if (is_string) {
-      args[i].value.string = read_string(inp);
-    } else {
-      args[i].value.integer = read_int(inp);
+    switch (next_byte(inp)) {
+      case 1:
+        args[i].type = GRPC_ARG_STRING;
+        args[i].key = read_string(inp);
+        args[i].value.string = read_string(inp);
+        break;
+      case 2:
+        args[i].type = GRPC_ARG_INTEGER;
+        args[i].key = read_string(inp);
+        args[i].value.integer = read_int(inp);
+        break;
+      case 3:
+        args[i].type = GRPC_ARG_POINTER;
+        args[i].key = gpr_strdup(GRPC_ARG_RESOURCE_QUOTA);
+        args[i].value.pointer.vtable = grpc_resource_quota_arg_vtable();
+        args[i].value.pointer.p = g_resource_quota;
+        grpc_resource_quota_ref(g_resource_quota);
+        break;
+      default:
+        end(inp);
+        n = i;
+        break;
     }
   }
   grpc_channel_args *a = gpr_malloc(sizeof(*a));
@@ -167,21 +197,6 @@ static grpc_channel_args *read_args(input_stream *inp) {
 
 static bool is_eof(input_stream *inp) { return inp->cur == inp->end; }
 
-////////////////////////////////////////////////////////////////////////////////
-// global state
-
-static gpr_timespec g_now;
-static grpc_server *g_server;
-static grpc_channel *g_channel;
-static grpc_resource_quota *g_resource_quota;
-
-extern gpr_timespec (*gpr_now_impl)(gpr_clock_type clock_type);
-
-static gpr_timespec now_impl(gpr_clock_type clock_type) {
-  GPR_ASSERT(clock_type != GPR_TIMESPAN);
-  return g_now;
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // dns resolution
 

test/core/end2end/fuzzers/api_fuzzer_corpus/5928c7d56230ac7c10860c64ebfa6aa243f2966c

@@ -0,0 +1 @@
+<EFBFBD>

test/core/end2end/fuzzers/api_fuzzer_corpus/6fc72a2c1ff9a11539ae35b197a79786496c2257

@@ -0,0 +1 @@
+