From 6b922f871f42b061b50f41a0abba7415a041394e Mon Sep 17 00:00:00 2001
From: Ming-Chuan <mingcl@google.com>
Date: Wed, 6 Oct 2021 00:49:35 +0800
Subject: [PATCH] Temporarily remove binder fuzzers it fails to build with old
llvm (#27599)
---
.../transport/binder/end2end/fuzzers/BUILD | 84 ----------
.../binder/end2end/fuzzers/client_fuzzer.cc | 145 -----------------
.../fuzzers/client_fuzzer_corpus/empty | 0
.../binder/end2end/fuzzers/fuzzer_utils.cc | 153 ------------------
.../binder/end2end/fuzzers/fuzzer_utils.h | 146 -----------------
.../binder/end2end/fuzzers/server_fuzzer.cc | 122 --------------
.../crash-missing-authority | Bin 747 -> 0 bytes
.../fuzzers/server_fuzzer_corpus/empty | 0
8 files changed, 650 deletions(-)
delete mode 100644 test/core/transport/binder/end2end/fuzzers/BUILD
delete mode 100644 test/core/transport/binder/end2end/fuzzers/client_fuzzer.cc
delete mode 100644 test/core/transport/binder/end2end/fuzzers/client_fuzzer_corpus/empty
delete mode 100644 test/core/transport/binder/end2end/fuzzers/fuzzer_utils.cc
delete mode 100644 test/core/transport/binder/end2end/fuzzers/fuzzer_utils.h
delete mode 100644 test/core/transport/binder/end2end/fuzzers/server_fuzzer.cc
delete mode 100644 test/core/transport/binder/end2end/fuzzers/server_fuzzer_corpus/crash-missing-authority
delete mode 100644 test/core/transport/binder/end2end/fuzzers/server_fuzzer_corpus/empty
diff --git a/test/core/transport/binder/end2end/fuzzers/BUILD b/test/core/transport/binder/end2end/fuzzers/BUILD
deleted file mode 100644
index 43db13f681b..00000000000
--- a/test/core/transport/binder/end2end/fuzzers/BUILD
+++ /dev/null
@@ -1,84 +0,0 @@
-# Copyright 2021 gRPC authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-load("//bazel:grpc_build_system.bzl", "grpc_cc_library", "grpc_package")
-load("//test/core/util:grpc_fuzzer.bzl", "grpc_fuzzer")
-
-grpc_package(
- name = "test/core/transport/binder/end2end/fuzzers",
- features = [
- "layering_check",
- ],
-)
-
-licenses(["notice"])
-
-grpc_cc_library(
- name = "fuzzer_utils",
- srcs = ["fuzzer_utils.cc"],
- hdrs = ["fuzzer_utils.h"],
- external_deps = [
- "absl/memory",
- "absl/status",
- ],
- tags = [
- "no_mac",
- "no_windows",
- ],
- deps = [
- "//:gpr",
- "//src/core/ext/transport/binder/wire_format:binder",
- "//src/core/ext/transport/binder/wire_format:wire_reader",
- ],
-)
-
-grpc_fuzzer(
- name = "client_fuzzer",
- srcs = ["client_fuzzer.cc"],
- corpus = "client_fuzzer_corpus",
- language = "C++",
- tags = [
- "no_mac",
- "no_windows",
- ],
- deps = [
- ":fuzzer_utils",
- "//:gpr",
- "//:gpr_base",
- "//:grpc++_base",
- "//:grpc_base",
- "//src/core/ext/transport/binder/transport:binder_transport",
- "//test/core/util:grpc_test_util",
- ],
-)
-
-grpc_fuzzer(
- name = "server_fuzzer",
- srcs = ["server_fuzzer.cc"],
- corpus = "server_fuzzer_corpus",
- language = "C++",
- tags = [
- "no_mac",
- "no_windows",
- ],
- deps = [
- ":fuzzer_utils",
- "//:gpr",
- "//:gpr_base",
- "//:grpc++_base",
- "//:grpc_base",
- "//src/core/ext/transport/binder/transport:binder_transport",
- "//test/core/util:grpc_test_util",
- ],
-)
diff --git a/test/core/transport/binder/end2end/fuzzers/client_fuzzer.cc b/test/core/transport/binder/end2end/fuzzers/client_fuzzer.cc
deleted file mode 100644
index 40a6d2c2276..00000000000
--- a/test/core/transport/binder/end2end/fuzzers/client_fuzzer.cc
+++ /dev/null
@@ -1,145 +0,0 @@
-// Copyright 2021 gRPC authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include <thread>
-#include <utility>
-
-#include "absl/memory/memory.h"
-
-#include <grpc/grpc.h>
-
-#include "src/core/ext/transport/binder/transport/binder_transport.h"
-#include "src/core/lib/iomgr/executor.h"
-#include "src/core/lib/surface/channel.h"
-#include "test/core/transport/binder/end2end/fuzzers/fuzzer_utils.h"
-
-bool squelch = true;
-bool leak_check = true;
-
-static void* tag(intptr_t t) { return reinterpret_cast<void*>(t); }
-
-static void dont_log(gpr_log_func_args*) {}
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- grpc_test_only_set_slice_hash_seed(0);
- if (squelch) gpr_set_log_function(dont_log);
- grpc_init();
- {
- // Copied and modified from grpc/test/core/end2end/fuzzers/client_fuzzer.cc
- grpc_core::ExecCtx exec_ctx;
- grpc_core::Executor::SetThreadingAll(false);
-
- grpc_completion_queue* cq = grpc_completion_queue_create_for_next(nullptr);
- grpc_transport* client_transport = grpc_create_binder_transport_client(
- absl::make_unique<grpc_binder::fuzzing::BinderForFuzzing>(data, size));
- grpc_arg authority_arg = grpc_channel_arg_string_create(
- const_cast<char*>(GRPC_ARG_DEFAULT_AUTHORITY),
- const_cast<char*>("test-authority"));
- grpc_channel_args* args =
- grpc_channel_args_copy_and_add(nullptr, &authority_arg, 1);
- grpc_channel* channel =
- grpc_channel_create("test-target", args, GRPC_CLIENT_DIRECT_CHANNEL,
- client_transport, nullptr, 0, nullptr);
- grpc_channel_args_destroy(args);
- grpc_slice host = grpc_slice_from_static_string("localhost");
- grpc_call* call = grpc_channel_create_call(
- channel, nullptr, 0, cq, grpc_slice_from_static_string("/foo"), &host,
- gpr_inf_future(GPR_CLOCK_REALTIME), nullptr);
- grpc_metadata_array initial_metadata_recv;
- grpc_metadata_array_init(&initial_metadata_recv);
- grpc_byte_buffer* response_payload_recv = nullptr;
- grpc_metadata_array trailing_metadata_recv;
- grpc_metadata_array_init(&trailing_metadata_recv);
- grpc_status_code status;
- grpc_slice details = grpc_empty_slice();
-
- grpc_op ops[6];
- memset(ops, 0, sizeof(ops));
- grpc_op* op = ops;
- op->op = GRPC_OP_SEND_INITIAL_METADATA;
- op->data.send_initial_metadata.count = 0;
- op->flags = 0;
- op->reserved = nullptr;
- op++;
- op->op = GRPC_OP_SEND_CLOSE_FROM_CLIENT;
- op->flags = 0;
- op->reserved = nullptr;
- op++;
- op->op = GRPC_OP_RECV_INITIAL_METADATA;
- op->data.recv_initial_metadata.recv_initial_metadata =
- &initial_metadata_recv;
- op->flags = 0;
- op->reserved = nullptr;
- op++;
- op->op = GRPC_OP_RECV_MESSAGE;
- op->data.recv_message.recv_message = &response_payload_recv;
- op->flags = 0;
- op->reserved = nullptr;
- op++;
- op->op = GRPC_OP_RECV_STATUS_ON_CLIENT;
- op->data.recv_status_on_client.trailing_metadata = &trailing_metadata_recv;
- op->data.recv_status_on_client.status = &status;
- op->data.recv_status_on_client.status_details = &details;
- op->flags = 0;
- op->reserved = nullptr;
- op++;
- grpc_call_error error =
- grpc_call_start_batch(call, ops, (size_t)(op - ops), tag(1), nullptr);
- int requested_calls = 1;
- GPR_ASSERT(GRPC_CALL_OK == error);
- grpc_event ev;
- while (true) {
- grpc_core::ExecCtx::Get()->Flush();
- ev = grpc_completion_queue_next(cq, gpr_inf_past(GPR_CLOCK_REALTIME),
- nullptr);
- switch (ev.type) {
- case GRPC_QUEUE_TIMEOUT:
- goto done;
- case GRPC_QUEUE_SHUTDOWN:
- break;
- case GRPC_OP_COMPLETE:
- requested_calls--;
- break;
- }
- }
-
- done:
- if (requested_calls) {
- grpc_call_cancel(call, nullptr);
- }
- grpc_binder::fuzzing::JoinFuzzingThread();
- for (int i = 0; i < requested_calls; i++) {
- ev = grpc_completion_queue_next(cq, gpr_inf_past(GPR_CLOCK_REALTIME),
- nullptr);
- GPR_ASSERT(ev.type == GRPC_OP_COMPLETE);
- }
- grpc_completion_queue_shutdown(cq);
- for (int i = 0; i < requested_calls; i++) {
- ev = grpc_completion_queue_next(cq, gpr_inf_past(GPR_CLOCK_REALTIME),
- nullptr);
- GPR_ASSERT(ev.type == GRPC_QUEUE_SHUTDOWN);
- }
- grpc_call_unref(call);
- grpc_completion_queue_destroy(cq);
- grpc_metadata_array_destroy(&initial_metadata_recv);
- grpc_metadata_array_destroy(&trailing_metadata_recv);
- grpc_slice_unref(details);
- grpc_channel_destroy(channel);
- if (response_payload_recv != nullptr) {
- grpc_byte_buffer_destroy(response_payload_recv);
- }
- }
- grpc_shutdown();
- return 0;
-}
diff --git a/test/core/transport/binder/end2end/fuzzers/client_fuzzer_corpus/empty b/test/core/transport/binder/end2end/fuzzers/client_fuzzer_corpus/empty
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/test/core/transport/binder/end2end/fuzzers/fuzzer_utils.cc b/test/core/transport/binder/end2end/fuzzers/fuzzer_utils.cc
deleted file mode 100644
index e11b6e3652f..00000000000
--- a/test/core/transport/binder/end2end/fuzzers/fuzzer_utils.cc
+++ /dev/null
@@ -1,153 +0,0 @@
-// Copyright 2021 gRPC authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "test/core/transport/binder/end2end/fuzzers/fuzzer_utils.h"
-
-namespace grpc_binder {
-namespace fuzzing {
-
-namespace {
-
-std::thread* g_fuzzing_thread = nullptr;
-
-template <typename... Args>
-void CreateFuzzingThread(Args&&... args) {
- GPR_ASSERT(g_fuzzing_thread == nullptr);
- g_fuzzing_thread = new std::thread(std::forward<Args>(args)...);
-}
-
-} // namespace
-
-void JoinFuzzingThread() {
- if (g_fuzzing_thread) {
- g_fuzzing_thread->join();
- delete g_fuzzing_thread;
- g_fuzzing_thread = nullptr;
- }
-}
-
-int32_t ReadableParcelForFuzzing::GetDataSize() const {
- return data_provider_->ConsumeIntegral<int32_t>();
-}
-
-absl::Status ReadableParcelForFuzzing::ReadInt32(int32_t* data) {
- if (consumed_data_size_ >= kParcelDataSizeLimit) {
- return absl::InternalError("Parcel size limit exceeds");
- }
- if (!is_setup_transport_ && data_provider_->ConsumeBool()) {
- return absl::InternalError("error");
- }
- *data = data_provider_->ConsumeIntegral<int32_t>();
- consumed_data_size_ += sizeof(int32_t);
- return absl::OkStatus();
-}
-
-absl::Status ReadableParcelForFuzzing::ReadInt64(int64_t* data) {
- if (consumed_data_size_ >= kParcelDataSizeLimit) {
- return absl::InternalError("Parcel size limit exceeds");
- }
- if (!is_setup_transport_ && data_provider_->ConsumeBool()) {
- return absl::InternalError("error");
- }
- *data = data_provider_->ConsumeIntegral<int64_t>();
- consumed_data_size_ += sizeof(int64_t);
- return absl::OkStatus();
-}
-
-absl::Status ReadableParcelForFuzzing::ReadBinder(
- std::unique_ptr<Binder>* binder) {
- if (consumed_data_size_ >= kParcelDataSizeLimit) {
- return absl::InternalError("Parcel size limit exceeds");
- }
- if (!is_setup_transport_ && data_provider_->ConsumeBool()) {
- return absl::InternalError("error");
- }
- *binder = absl::make_unique<BinderForFuzzing>();
- consumed_data_size_ += sizeof(void*);
- return absl::OkStatus();
-}
-
-absl::Status ReadableParcelForFuzzing::ReadByteArray(std::string* data) {
- if (consumed_data_size_ >= kParcelDataSizeLimit) {
- return absl::InternalError("Parcel size limit exceeds");
- }
- if (!is_setup_transport_ && data_provider_->ConsumeBool()) {
- return absl::InternalError("error");
- }
- *data = data_provider_->ConsumeRandomLengthString(100);
- consumed_data_size_ += data->size();
- return absl::OkStatus();
-}
-
-absl::Status ReadableParcelForFuzzing::ReadString(std::string* data) {
- if (consumed_data_size_ >= kParcelDataSizeLimit) {
- return absl::InternalError("Parcel size limit exceeds");
- }
- if (!is_setup_transport_ && data_provider_->ConsumeBool()) {
- return absl::InternalError("error");
- }
- *data = data_provider_->ConsumeRandomLengthString(100);
- consumed_data_size_ += data->size();
- return absl::OkStatus();
-}
-
-void FuzzingLoop(
- const uint8_t* data, size_t size,
- grpc_core::RefCountedPtr<grpc_binder::WireReader> wire_reader_ref,
- grpc_binder::TransactionReceiver::OnTransactCb callback) {
- FuzzedDataProvider data_provider(data, size);
- {
- // Send SETUP_TRANSPORT request.
- std::unique_ptr<grpc_binder::ReadableParcel> parcel =
- absl::make_unique<ReadableParcelForFuzzing>(
- &data_provider,
- /*is_setup_transport=*/true);
- callback(static_cast<transaction_code_t>(
- grpc_binder::BinderTransportTxCode::SETUP_TRANSPORT),
- parcel.get(), /*uid=*/data_provider.ConsumeIntegral<int>())
- .IgnoreError();
- }
- while (data_provider.remaining_bytes() > 0) {
- transaction_code_t tx_code =
- data_provider.ConsumeIntegralInRange<transaction_code_t>(
- 0, LAST_CALL_TRANSACTION);
- std::unique_ptr<grpc_binder::ReadableParcel> parcel =
- absl::make_unique<ReadableParcelForFuzzing>(
- &data_provider,
- /*is_setup_transport=*/false);
- callback(tx_code, parcel.get(),
- /*uid=*/data_provider.ConsumeIntegral<int>())
- .IgnoreError();
- }
- wire_reader_ref = nullptr;
-}
-
-TranasctionReceiverForFuzzing::TranasctionReceiverForFuzzing(
- const uint8_t* data, size_t size,
- grpc_core::RefCountedPtr<WireReader> wire_reader_ref,
- TransactionReceiver::OnTransactCb cb) {
- gpr_log(GPR_INFO, "Construct TranasctionReceiverForFuzzing");
- CreateFuzzingThread(FuzzingLoop, data, size, std::move(wire_reader_ref),
- std::move(cb));
-}
-
-std::unique_ptr<TransactionReceiver> BinderForFuzzing::ConstructTxReceiver(
- grpc_core::RefCountedPtr<WireReader> wire_reader_ref,
- TransactionReceiver::OnTransactCb cb) const {
- return absl::make_unique<TranasctionReceiverForFuzzing>(data_, size_,
- wire_reader_ref, cb);
-}
-
-} // namespace fuzzing
-} // namespace grpc_binder
diff --git a/test/core/transport/binder/end2end/fuzzers/fuzzer_utils.h b/test/core/transport/binder/end2end/fuzzers/fuzzer_utils.h
deleted file mode 100644
index 396439ac1ad..00000000000
--- a/test/core/transport/binder/end2end/fuzzers/fuzzer_utils.h
+++ /dev/null
@@ -1,146 +0,0 @@
-// Copyright 2021 gRPC authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#ifndef GRPC_TEST_CORE_TRANSPORT_BINDER_END2END_FUZZERS_FUZZER_UTILS_H
-#define GRPC_TEST_CORE_TRANSPORT_BINDER_END2END_FUZZERS_FUZZER_UTILS_H
-
-#include <fuzzer/FuzzedDataProvider.h>
-
-#include <memory>
-#include <string>
-#include <thread>
-#include <vector>
-
-#include "absl/memory/memory.h"
-#include "absl/status/status.h"
-
-#include <grpc/support/log.h>
-
-#include "src/core/ext/transport/binder/wire_format/binder.h"
-#include "src/core/ext/transport/binder/wire_format/wire_reader.h"
-
-namespace grpc_binder {
-namespace fuzzing {
-
-// A WritableParcel implementation that simply does nothing. Don't use
-// MockWritableParcel here since capturing calls is expensive.
-class NoOpWritableParcel : public WritableParcel {
- public:
- int32_t GetDataSize() const override { return 0; }
- absl::Status WriteInt32(int32_t /*data*/) override {
- return absl::OkStatus();
- }
- absl::Status WriteInt64(int64_t /*data*/) override {
- return absl::OkStatus();
- }
- absl::Status WriteBinder(HasRawBinder* /*binder*/) override {
- return absl::OkStatus();
- }
- absl::Status WriteString(absl::string_view /*s*/) override {
- return absl::OkStatus();
- }
- absl::Status WriteByteArray(const int8_t* /*buffer*/,
- int32_t /*length*/) override {
- return absl::OkStatus();
- }
-};
-
-// Binder implementation used in fuzzing.
-//
-// Most of its the functionalities are no-op, except ConstructTxReceiver now
-// returns a TranasctionReceiverForFuzzing.
-class BinderForFuzzing : public Binder {
- public:
- BinderForFuzzing() : input_(absl::make_unique<NoOpWritableParcel>()) {}
-
- BinderForFuzzing(const uint8_t* data, size_t size)
- : data_(data),
- size_(size),
- input_(absl::make_unique<NoOpWritableParcel>()) {}
-
- void Initialize() override {}
- absl::Status PrepareTransaction() override { return absl::OkStatus(); }
-
- absl::Status Transact(BinderTransportTxCode /*tx_code*/) override {
- return absl::OkStatus();
- }
-
- std::unique_ptr<TransactionReceiver> ConstructTxReceiver(
- grpc_core::RefCountedPtr<WireReader> wire_reader_ref,
- TransactionReceiver::OnTransactCb cb) const override;
-
- WritableParcel* GetWritableParcel() const override { return input_.get(); }
- void* GetRawBinder() override { return nullptr; }
-
- private:
- const uint8_t* data_;
- size_t size_;
- std::unique_ptr<WritableParcel> input_;
-};
-
-// ReadableParcel implementation used in fuzzing.
-//
-// It consumes a FuzzedDataProvider, and returns fuzzed data upon user's
-// requests. Each operation can also fail per fuzzer's request by checking the
-// next bool in the data stream.
-class ReadableParcelForFuzzing : public ReadableParcel {
- public:
- ReadableParcelForFuzzing(FuzzedDataProvider* data_provider,
- bool is_setup_transport)
- : data_provider_(data_provider),
- is_setup_transport_(is_setup_transport),
- consumed_data_size_(0) {}
-
- int32_t GetDataSize() const override;
- absl::Status ReadInt32(int32_t* data) override;
- absl::Status ReadInt64(int64_t* data) override;
- absl::Status ReadBinder(std::unique_ptr<Binder>* binder) override;
- absl::Status ReadByteArray(std::string* data) override;
- absl::Status ReadString(std::string* data) override;
-
- private:
- FuzzedDataProvider* data_provider_;
- // Whether this parcel contains a SETUP_TRANSPORT request. If it is, we will
- // avoid returning errors in the Read* functions so that the fuzzer will not
- // be blocked waiting for the correct request.
- bool is_setup_transport_;
-
- static constexpr size_t kParcelDataSizeLimit = 1024 * 1024;
- size_t consumed_data_size_;
-};
-
-void JoinFuzzingThread();
-
-void FuzzingLoop(const uint8_t* data, size_t size,
- grpc_core::RefCountedPtr<WireReader> wire_reader_ref,
- TransactionReceiver::OnTransactCb callback);
-
-// TransactionReceiver implementation used in fuzzing.
-//
-// When constructed, start sending fuzzed requests to the client. When all the
-// bytes are consumed, the reference to WireReader will be released.
-class TranasctionReceiverForFuzzing : public TransactionReceiver {
- public:
- TranasctionReceiverForFuzzing(
- const uint8_t* data, size_t size,
- grpc_core::RefCountedPtr<WireReader> wire_reader_ref,
- TransactionReceiver::OnTransactCb cb);
-
- void* GetRawBinder() override { return nullptr; }
-};
-
-} // namespace fuzzing
-} // namespace grpc_binder
-
-#endif // GRPC_TEST_CORE_TRANSPORT_BINDER_END2END_FUZZERS_FUZZER_UTILS_H
diff --git a/test/core/transport/binder/end2end/fuzzers/server_fuzzer.cc b/test/core/transport/binder/end2end/fuzzers/server_fuzzer.cc
deleted file mode 100644
index 82da7073ff1..00000000000
--- a/test/core/transport/binder/end2end/fuzzers/server_fuzzer.cc
+++ /dev/null
@@ -1,122 +0,0 @@
-// Copyright 2021 gRPC authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include <grpc/grpc.h>
-
-#include "src/core/ext/transport/binder/transport/binder_transport.h"
-#include "src/core/lib/iomgr/executor.h"
-#include "src/core/lib/slice/slice_internal.h"
-#include "src/core/lib/surface/server.h"
-#include "test/core/transport/binder/end2end/fuzzers/fuzzer_utils.h"
-
-bool squelch = true;
-bool leak_check = true;
-
-static void* tag(intptr_t t) { return reinterpret_cast<void*>(t); }
-
-static void dont_log(gpr_log_func_args* /*args*/) {}
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- grpc_test_only_set_slice_hash_seed(0);
- if (squelch) gpr_set_log_function(dont_log);
- grpc_init();
- {
- // Copied and modified from grpc/test/core/end2end/fuzzers/server_fuzzer.cc
- grpc_core::ExecCtx exec_ctx;
- grpc_core::Executor::SetThreadingAll(false);
-
- grpc_server* server = grpc_server_create(nullptr, nullptr);
- grpc_completion_queue* cq = grpc_completion_queue_create_for_next(nullptr);
- grpc_server_register_completion_queue(server, cq, nullptr);
- // TODO(ctiller): add more registered methods (one for POST, one for PUT)
- grpc_server_register_method(server, "/reg", nullptr, {}, 0);
- grpc_server_start(server);
- grpc_transport* server_transport = grpc_create_binder_transport_server(
- absl::make_unique<grpc_binder::fuzzing::BinderForFuzzing>(data, size));
- server->core_server->SetupTransport(server_transport, nullptr, nullptr,
- nullptr);
-
- grpc_call* call1 = nullptr;
- grpc_call_details call_details1;
- grpc_metadata_array request_metadata1;
- grpc_call_details_init(&call_details1);
- grpc_metadata_array_init(&request_metadata1);
- int requested_calls = 0;
-
- GPR_ASSERT(GRPC_CALL_OK ==
- grpc_server_request_call(server, &call1, &call_details1,
- &request_metadata1, cq, cq, tag(1)));
- requested_calls++;
-
- grpc_event ev;
- while (true) {
- grpc_core::ExecCtx::Get()->Flush();
- ev = grpc_completion_queue_next(cq, gpr_inf_past(GPR_CLOCK_REALTIME),
- nullptr);
- switch (ev.type) {
- case GRPC_QUEUE_TIMEOUT:
- goto done;
- case GRPC_QUEUE_SHUTDOWN:
- break;
- case GRPC_OP_COMPLETE:
- if (ev.tag == tag(1)) {
- requested_calls--;
- // TODO(ctiller): keep reading that call!
- }
- break;
- }
- }
-
- done:
- grpc_binder::fuzzing::JoinFuzzingThread();
- if (call1 != nullptr) grpc_call_unref(call1);
- grpc_call_details_destroy(&call_details1);
- grpc_metadata_array_destroy(&request_metadata1);
- grpc_server_shutdown_and_notify(server, cq, tag(0xdead));
- grpc_server_cancel_all_calls(server);
- grpc_millis deadline = grpc_core::ExecCtx::Get()->Now() + 5000;
- for (int i = 0; i <= requested_calls; i++) {
- // A single grpc_completion_queue_next might not be sufficient for getting
- // the tag from shutdown, because we might potentially get blocked by
- // an operation happening on the timer thread.
- // For example, the deadline timer might expire, leading to the timer
- // thread trying to cancel the RPC and thereby acquiring a few references
- // to the call. This will prevent the shutdown to complete till the timer
- // thread releases those references.
- // As a solution, we are going to keep performing a cq_next for a
- // liberal period of 5 seconds for the timer thread to complete its work.
- do {
- ev = grpc_completion_queue_next(cq, gpr_inf_past(GPR_CLOCK_REALTIME),
- nullptr);
- grpc_core::ExecCtx::Get()->InvalidateNow();
- } while (ev.type != GRPC_OP_COMPLETE &&
- grpc_core::ExecCtx::Get()->Now() < deadline);
- GPR_ASSERT(ev.type == GRPC_OP_COMPLETE);
- }
- grpc_completion_queue_shutdown(cq);
- for (int i = 0; i <= requested_calls; i++) {
- do {
- ev = grpc_completion_queue_next(cq, gpr_inf_past(GPR_CLOCK_REALTIME),
- nullptr);
- grpc_core::ExecCtx::Get()->InvalidateNow();
- } while (ev.type != GRPC_QUEUE_SHUTDOWN &&
- grpc_core::ExecCtx::Get()->Now() < deadline);
- GPR_ASSERT(ev.type == GRPC_QUEUE_SHUTDOWN);
- }
- grpc_server_destroy(server);
- grpc_completion_queue_destroy(cq);
- }
- grpc_shutdown();
- return 0;
-}
diff --git a/test/core/transport/binder/end2end/fuzzers/server_fuzzer_corpus/crash-missing-authority b/test/core/transport/binder/end2end/fuzzers/server_fuzzer_corpus/crash-missing-authority
deleted file mode 100644
index 6e51d213d7d6e9d8bcb6ddf9f4db169410ec4f5f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001
literal 747
zcmZ`%ze@sf6n~P02rUf~4K3NlMUb^L-5`jNgiA}7;*|+TCWn3vi7=a8qd}oXI56%H
z2pU@s9QqGh0v96)588aa_dSiv=mYoOyZ8HZ?|O(B@PUL6f`p35mwN=;-a=G4&;T+@
zkVf?L>lG=*#o<`9+LX4+y&3@Xv$qh9b3aCB8kF1VP}??TD*$L&R;|jFIte+DA{F5&
za~pZ294Cc$3&oQW49YMu#6mb!5TdPXgufY@7I~=G>%8?ZmH-B`;FVP07vlAVm+O(6
zj%yUyA&}TuH=^-$INk3H!>|*t>WGsYA1*+-Sz4K*2}-ZFR>|gyRod)vIl%}e9B2Q<
zF$o8$RF<{bG)>3xYeEQ3L!|FKhbZF7B++9vL54YURv?di0bFJJPtizh`yMlvCHc`g
zbqH`k)ra=b?slDp;l<Bnxv(y!d!oV2|0l|qv*$;pWHQVI2VB&5;fFT~q@(7F$JU8E
zPqx*i<mSRaY>hZ1*u1=C6I=AayCHO)jL#Um5ZJ*acVjFUp)TDr0%r)(2x3CIgm^A=
SGa&=-n)LCjrBnW+(xq>{J0jBn
diff --git a/test/core/transport/binder/end2end/fuzzers/server_fuzzer_corpus/empty b/test/core/transport/binder/end2end/fuzzers/server_fuzzer_corpus/empty
deleted file mode 100644
index e69de29bb2d..00000000000