Add an HttpStreamParser fuzzer.

net/http/http_stream_parser_fuzzer.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/http/http_stream_parser.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <algorithm>
+#include <string>
+#include <vector>
+
+#include "base/logging.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/message_loop/message_loop.h"
+#include "base/numerics/safe_conversions.h"
+#include "net/base/address_list.h"
+#include "net/base/io_buffer.h"
+#include "net/base/net_errors.h"
+#include "net/base/test_completion_callback.h"
+#include "net/http/http_request_headers.h"
+#include "net/http/http_request_info.h"
+#include "net/http/http_response_info.h"
+#include "net/log/net_log.h"
+#include "net/log/test_net_log.h"
+#include "net/socket/client_socket_handle.h"
+#include "net/socket/socket_test_util.h"
+#include "url/gurl.h"
+
+// Fuzzer for HttpStreamParser.
+//
+// |data| is the data received over a mock HTTP connection through one or more
+// reads, along with metadata about the size of each read, and whether or not
+// the read completely synchronously.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // Needed for thread checks and waits.
+  base::MessageLoopForIO message_loop;
+
+  net::MockWrite writes[] = {

[eroman, 2016/03/28 22:54:57]

Consider extracting this to a constant or function-level static.

[mmenke, 2016/03/29 16:38:37]

Note that we're actually calling the initializer here, so our presubmit checks
may have issues with it.  I've gone ahead and made it an inline constant, but
not sure if compilers are smart enough to recognize it can be evaluated at
compile time.

[mmenke, 2016/03/29 16:40:52]

Oops...SequencedSocketData doesn't like const arguments.  I'll land without this
change, may modify SequencedSocketData's constructor in a followup, but probably
won't get to it.

+      net::MockWrite(net::ASYNC, 0, "GET / HTTP/1.1\r\n\r\n"),
+  };
+
+  // Break the buffer into a sequence of variable sized sync and async
+  // reads.  Use the last bytes of |data| exclusively for determining
+  // the size and type of each read.
+  std::vector<net::MockRead> reads;
+  // Sequence number for socket operations.
+  int last_sequence_number = 0;
+
+  // IoMode for the final read, where the server closes the mock socket.
+  net::IoMode close_socket_io_mode = net::ASYNC;
+
+  // Break |data| up into reads.  The test may or may not make to the final
+  // read, where the server closes the socket.
+
+  // Each read needs a one byte seed to determine read size and whether it
+  // should be sync or async, so if there's only one byte left unused, can't use
+  // it here.  The bytes used to get this metadata are not used as over-the-wire
+  // bytes.
+  while (size > 0) {
+    size_t read_seed = data[size - 1];

[eroman, 2016/03/28 22:54:57]

Why size_t rather than uint8_t ? Is this so it plays nice with the subsequent
std::min ? Fine either way, just curious.

[mmenke, 2016/03/29 16:38:37]

That's exactly it.  I prefer to avoid casts unless necessary.

+    size--;
+    net::IoMode io_mode = net::ASYNC;
+    // Low order bit determines IoMode.
+    if (read_seed & 0x1)
+      io_mode = net::SYNCHRONOUS;
+
+    // Use second bit determine if the last read, when the socket is closed, is

[eroman, 2016/03/28 22:54:57]

bit determine --> bit to determine

[mmenke, 2016/03/29 16:38:37]

Done.

+    // schronous.  Only the second bit of the last time this loop runs matters.

[eroman, 2016/03/28 22:54:57]

sycronous --> synchronous


(and yes, misspelled the misspelling...)

[mmenke, 2016/03/29 16:38:37]

Done (And fixed the next sentence as well)

+    if (read_seed & 0x2) {
+      close_socket_io_mode = net::SYNCHRONOUS;
+    } else {
+      close_socket_io_mode = net::ASYNC;
+    }
+
+    // If there are no more bytes in |data|, next read is the connection close.
+    if (size == 0)
+      break;
+
+    read_seed >>= 2;
+
+    // Last 6 bits determine how many bytes are returned by the read.
+    int read_size = static_cast<int>(std::min(1 + read_seed, size));
+    reads.push_back(net::MockRead(io_mode, reinterpret_cast<const char*>(data),
+                                  read_size, ++last_sequence_number));
+
+    data += read_size;
+    size -= read_size;
+  }
+
+  // Server closes the socket.
+  reads.push_back(net::MockRead(close_socket_io_mode,
+                                net::ERR_CONNECTION_CLOSED,
+                                ++last_sequence_number));
+  net::SequencedSocketData socket_data(reads.data(), reads.size(), writes,
+                                       arraysize(writes));
+  socket_data.set_connect_data(net::MockConnect(net::SYNCHRONOUS, net::OK));
+
+  scoped_ptr<net::MockTCPClientSocket> socket(
+      new net::MockTCPClientSocket(net::AddressList(), nullptr, &socket_data));
+
+  net::TestCompletionCallback callback;
+  CHECK_EQ(net::OK, socket->Connect(callback.callback()));
+
+  net::ClientSocketHandle socket_handle;
+  socket_handle.SetSocket(std::move(socket));
+
+  net::HttpRequestInfo request_info;
+  request_info.method = "GET";
+  request_info.url = GURL("http://localhost/");
+
+  scoped_refptr<net::GrowableIOBuffer> read_buffer(new net::GrowableIOBuffer());
+  // Use a NetLog that listens to events, to get coverage of logging
+  // callbacks.
+  net::BoundTestNetLog net_log;
+  net::HttpStreamParser parser(&socket_handle, &request_info, read_buffer.get(),
+                               net_log.bound());
+
+  net::HttpResponseInfo response_info;
+  int result =
+      parser.SendRequest("GET / HTTP/1.1\r\n", net::HttpRequestHeaders(),
+                         &response_info, callback.callback());
+  CHECK_EQ(net::OK, callback.GetResult(result));
+
+  result = parser.ReadResponseHeaders(callback.callback());
+  result = callback.GetResult(result);
+
+  if (result != net::OK)
+    return 0;
+
+  while (true) {
+    // 64 exactly matches the maximum amount of data returned by a single
+    // MockRead, as created above.
+    scoped_refptr<net::IOBufferWithSize> io_buffer(
+        new net::IOBufferWithSize(64));
+    result = parser.ReadResponseBody(io_buffer.get(), io_buffer->size(),
+                                     callback.callback());
+
+    // Releasing the pointer to IOBuffer immediately is more likely to lead to a
+    // use-after-free.
+    io_buffer = nullptr;
+
+    if (callback.GetResult(result) <= 0)
+      break;
+  }
+
+  return 0;
+}