[libfuzzer] Add fuzzer for FT_New_Memory_Face() from third_party/freetype2.

testing/libfuzzer/fuzzers/ft_new_memory_face_fuzzer.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "third_party/freetype2/src/include/ft2build.h"
+#include "third_party/freetype2/src/include/freetype/freetype.h"
+
+
+FT_Error g_init_freetype_result;

[inferno, 2016/03/09 17:16:43]

nit: s/g_init_freetype_result/g_init_freetype_error to match other variable
names.

[mmoroz, 2016/03/10 10:12:55]

Done.

+
+
+struct InitFreetype {
+  FT_Library* library_;
+  InitFreetype(FT_Library* library) : library_(library) {
+    g_init_freetype_result = FT_Init_FreeType(library);
+  }
+  ~InitFreetype() {
+    FT_Init_FreeType(library_);
+  }
+};
+
+
+FT_Library g_freetype_library;
+InitFreetype g_init_freetype(&g_freetype_library);
+
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

[bungeman-chromium, 2016/03/09 18:34:35]

This already exists better at
https://chromium.googlesource.com/chromium/src/third_party/freetype2/+/master...

which is run continuously on gce, see
https://github.com/google/libfuzzer-bot/blob/master/freetype/README.md

+  if (g_init_freetype_result)
+    return 0;
+
+  FT_Face face;
+  // Get number of faces in font. Usually 0 for random data.
+  FT_Error error = FT_New_Memory_Face(g_freetype_library, data, size, -1,
+                                      &face);
+  if (error)
+    return 0;
+
+  // Go through the faces.
+  for (FT_Long face_index = 0; face_index < face->num_faces + 1; ++face_index) {
+    FT_Face temp_face;
+    error = FT_New_Memory_Face(g_freetype_library, data, size, face_index,
+                               &temp_face);
+    if (error)
+      break;
+    FT_Done_Face(temp_face);    
+  }
+
+  FT_Done_Face(face);
+
+  return 0;
+}