fuzzer for QUIC net::CryptoFramer::ParseMessage implemented

fuzzer for QUIC net::CryptoFramer::ParseMessage implemented

R=aizatsky@chromium.org, inferno@chromium.org, krasin@chromium.org
BUG=566504
Committed: https://crrev.com/4617e91a29d423fc85827a9f6bb769620c11d9fd
Cr-Commit-Position: refs/heads/master@{#364708}

[inferno, 2015-12-10 17:21:58]

inferno@chromium.org changed reviewers:
+ rch@chromium.org

[inferno, 2015-12-10 17:21:58]

lgtm

[mmoroz, 2015-12-10 17:27:59]

On 2015/12/10 17:21:58, inferno wrote:
> lgtm

<vector> isn't needed there. Will remove that include.

[aizatsky, 2015-12-10 19:30:51]

lgtm

[Ryan Hamilton, 2015-12-10 19:54:25]

Is this called at all now?

I suspect this LGTM but I'm not quite sure about the context :>

[aarya, 2015-12-10 21:08:44]

On 2015/12/10 19:54:25, Ryan Hamilton wrote:
> Is this called at all now?
> 
> I suspect this LGTM but I'm not quite sure about the context :>

Max, please verify if this function is used. Otherwise, no need of a fuzzer for
this.

Ryan, for context please check
https://code.google.com/p/chromium/issues/detail?id=566504#c4. Basically
libfuzzer allows us to fuzz individual functions and we take initial state
building from unittests. If you have any ideas on functions that do complex
parsing / should be fuzzed, please sugggest in the bug.

[mmoroz, 2015-12-11 11:10:15]

On 2015/12/10 21:08:44, aarya wrote:
> On 2015/12/10 19:54:25, Ryan Hamilton wrote:
> > Is this called at all now?
> > 
> > I suspect this LGTM but I'm not quite sure about the context :>
> 
> Max, please verify if this function is used. Otherwise, no need of a fuzzer
for
> this.

As I understand it is being used at least in the following chain:
QuicChromiumClientSession creates logger_(new QuicConnectionLogger(<...>) ).
There are methods OnCryptoHandshakeMessageReceived() and
OnCryptoHandshakeMessageSent both using
NetLogQuicCryptoHandshakeMessageCallback, where the following method is called:
dict->SetString("quic_crypto_handshake_message", message->DebugString());
then message->DebugString() calls for
CryptoHandshakeMessage::DebugStringInternal(), where
CryptoFramer::ParseMessage() used for some messages types.

Actually I've taken that fuzzer from google3. So for me it seems worth to fuzz.

[inferno, 2015-12-11 15:05:58]

On 2015/12/11 11:10:15, mmoroz wrote:
> On 2015/12/10 21:08:44, aarya wrote:
> > On 2015/12/10 19:54:25, Ryan Hamilton wrote:
> > > Is this called at all now?
> > > 
> > > I suspect this LGTM but I'm not quite sure about the context :>
> > 
> > Max, please verify if this function is used. Otherwise, no need of a fuzzer
> for
> > this.
> 
> As I understand it is being used at least in the following chain:
> QuicChromiumClientSession creates logger_(new QuicConnectionLogger(<...>) ).
> There are methods OnCryptoHandshakeMessageReceived() and
> OnCryptoHandshakeMessageSent both using
> NetLogQuicCryptoHandshakeMessageCallback, where the following method is
called:
> dict->SetString("quic_crypto_handshake_message", message->DebugString());
> then message->DebugString() calls for
> CryptoHandshakeMessage::DebugStringInternal(), where
> CryptoFramer::ParseMessage() used for some messages types.
> 
> Actually I've taken that fuzzer from google3. So for me it seems worth to
fuzz.

Sounds good then.

[inferno, 2015-12-11 15:06:01]

The CQ bit was checked by inferno@chromium.org

[commit-bot: I haz the power, 2015-12-11 15:06:32]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1508343005/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1508343005/20001

[commit-bot: I haz the power, 2015-12-11 15:51:44]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-12-11 15:52:45]

Description was changed from

==========
fuzzer for QUIC net::CryptoFramer::ParseMessage implemented

R=aizatsky@chromium.org, inferno@chromium.org, krasin@chromium.org
BUG=566504
==========

to

==========
fuzzer for QUIC net::CryptoFramer::ParseMessage implemented

R=aizatsky@chromium.org, inferno@chromium.org, krasin@chromium.org
BUG=566504

Committed: https://crrev.com/4617e91a29d423fc85827a9f6bb769620c11d9fd
Cr-Commit-Position: refs/heads/master@{#364708}
==========

[commit-bot: I haz the power, 2015-12-11 15:52:46]

Patchset 2 (id:??) landed as
https://crrev.com/4617e91a29d423fc85827a9f6bb769620c11d9fd
Cr-Commit-Position: refs/heads/master@{#364708}