media: Add fuzzer test for bit_reader

media/base/bit_reader_fuzzertest.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+
+#include "base/hash.h"
+#include "base/numerics/safe_conversions.h"
+#include "media/base/bit_reader.h"
+#include "media/base/test_random.h"
+
+// Given |value|, return a number between |min| and |max|, inclusive.
+int DetermineNumBits(int value, int min, int max) {
+  DCHECK_GT(max, min);
+  int range = max - min + 1;
+  return (value % range) + min;
+}
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  media::BitReader reader(data, base::checked_cast<int>(size));
+
+  // Need a simple random number generator to generate the number of bits to
+  // read/skip in a reproducible way (given the same |data|).

[DaleCurtis, 2016/03/04 18:54:36]

Add a comment that Hash() is used to ensure the seed varies significantly over
minor changes within the source material.

[jrummell, 2016/03/04 23:47:13]

Done.

+  media::TestRandom rnd(base::Hash(reinterpret_cast<const char*>(data), size));
+
+  // Read and skip through the data in |reader|.
+  while (reader.bits_available() > 0) {
+    if (rnd.Rand() & 1) {
+      // Read up to 64 bits. This may fail if there is not enough bits
+      // remaining, but it doesn't matter (testing for failures is also good).
+      uint64_t value;
+      if (!reader.ReadBits(DetermineNumBits(rnd.Rand(), 1, 64), &value))

[DaleCurtis, 2016/03/04 18:54:36]

I think this is clearer w/o the helper function actually: ReadBits(rnd.Rand() %
64 + 1, &value)

[jrummell, 2016/03/04 23:47:13]

Done.

+        break;
+    } else {
+      // Skip up to 128 bits. As above, this may fail.
+      if (!reader.SkipBits(DetermineNumBits(rnd.Rand(), 1, 128)))

[DaleCurtis, 2016/03/04 18:54:36]

Ditto:

ReadBits(rnd.Rand() % 128 + 1);

[jrummell, 2016/03/04 23:47:13]

Done.

+        break;
+    }
+  }
+  return 0;
+}