Add an HttpStreamParser fuzzer.

net/http/http_stream_parser_fuzzer.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/http/http_stream_parser.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <algorithm>
+#include <string>
+#include <vector>
+
+#include "base/logging.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/message_loop/message_loop.h"
+#include "base/numerics/safe_conversions.h"
+#include "net/base/address_list.h"
+#include "net/base/io_buffer.h"
+#include "net/base/net_errors.h"
+#include "net/base/test_completion_callback.h"
+#include "net/http/http_request_headers.h"
+#include "net/http/http_request_info.h"
+#include "net/http/http_response_info.h"
+#include "net/log/net_log.h"
+#include "net/log/test_net_log.h"
+#include "net/socket/client_socket_handle.h"
+#include "net/socket/socket_test_util.h"
+#include "url/gurl.h"
+
+// Fuzzer for HttpStreamParser.
+//
+// |data| is the data received over a mock HTTP connection through one or more
+// reads, along with metadata about the size of each read, and whether or not
+// the read completely synchronously.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // Needed for thread checks and waits.
+  base::MessageLoopForIO message_loop;
+
+  net::MockWrite writes[] = {
+      net::MockWrite(net::ASYNC, 0, "GET / HTTP/1.1\r\n\r\n"),
+  };
+
+  // Break the buffer into a sequence of variable sized sync and async
+  // reads.  Use the last bytes of |data| exclusively for determining
+  // the size and type of each read.
+  std::vector<net::MockRead> reads;
+  // Sequence number for socket operations.
+  int last_sequence_number = 0;
+
+  // IoMode for the final read, where the server closes the mock socket.
+  net::IoMode close_socket_io_mode = net::ASYNC;
+
+  // Break |data| up into reads.  The test may or may not make to the final
+  // read, where the server closes the socket.
+
+  // Each read needs a one byte seed to determine read size and whether it
+  // should be sync or async, so if there's only one byte left unused, can't use
+  // it here.  The bytes used to get this metadata are not used as over-the-wire
+  // bytes.
+  while (size > 0) {
+    size_t read_seed = data[size - 1];
+    size--;
+    net::IoMode io_mode = net::ASYNC;
+    // Low order bit determines IoMode.
+    if (read_seed & 0x1)
+      io_mode = net::SYNCHRONOUS;
+
+    // Use second bit to determine if the last read, when the socket is closed,
+    // is synchronous.  The second bit only matters the last time this loop is
+    // runs.
+    if (read_seed & 0x2) {
+      close_socket_io_mode = net::SYNCHRONOUS;
+    } else {
+      close_socket_io_mode = net::ASYNC;
+    }
+
+    // If there are no more bytes in |data|, next read is the connection close.
+    if (size == 0)
+      break;
+
+    read_seed >>= 2;
+
+    // Last 6 bits determine how many bytes are returned by the read.
+    int read_size = static_cast<int>(std::min(1 + read_seed, size));
+    reads.push_back(net::MockRead(io_mode, reinterpret_cast<const char*>(data),
+                                  read_size, ++last_sequence_number));
+
+    data += read_size;
+    size -= read_size;
+  }
+
+  // Server closes the socket.
+  reads.push_back(net::MockRead(close_socket_io_mode,
+                                net::ERR_CONNECTION_CLOSED,
+                                ++last_sequence_number));
+  net::SequencedSocketData socket_data(reads.data(), reads.size(), writes,
+                                       arraysize(writes));
+  socket_data.set_connect_data(net::MockConnect(net::SYNCHRONOUS, net::OK));
+
+  scoped_ptr<net::MockTCPClientSocket> socket(
+      new net::MockTCPClientSocket(net::AddressList(), nullptr, &socket_data));
+
+  net::TestCompletionCallback callback;
+  CHECK_EQ(net::OK, socket->Connect(callback.callback()));
+
+  net::ClientSocketHandle socket_handle;
+  socket_handle.SetSocket(std::move(socket));
+
+  net::HttpRequestInfo request_info;
+  request_info.method = "GET";
+  request_info.url = GURL("http://localhost/");
+
+  scoped_refptr<net::GrowableIOBuffer> read_buffer(new net::GrowableIOBuffer());
+  // Use a NetLog that listens to events, to get coverage of logging
+  // callbacks.
+  net::BoundTestNetLog net_log;
+  net::HttpStreamParser parser(&socket_handle, &request_info, read_buffer.get(),
+                               net_log.bound());
+
+  net::HttpResponseInfo response_info;
+  int result =
+      parser.SendRequest("GET / HTTP/1.1\r\n", net::HttpRequestHeaders(),
+                         &response_info, callback.callback());
+  CHECK_EQ(net::OK, callback.GetResult(result));
+
+  result = parser.ReadResponseHeaders(callback.callback());
+  result = callback.GetResult(result);
+
+  if (result != net::OK)
+    return 0;
+
+  while (true) {
+    // 64 exactly matches the maximum amount of data returned by a single
+    // MockRead, as created above.
+    scoped_refptr<net::IOBufferWithSize> io_buffer(
+        new net::IOBufferWithSize(64));
+    result = parser.ReadResponseBody(io_buffer.get(), io_buffer->size(),
+                                     callback.callback());
+
+    // Releasing the pointer to IOBuffer immediately is more likely to lead to a
+    // use-after-free.
+    io_buffer = nullptr;
+
+    if (callback.GetResult(result) <= 0)
+      break;
+  }
+
+  return 0;
+}