Add SOCKS4 and SOCKS5 fuzzers.

net/socket/socks_client_socket_fuzzer.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/socket/socks_client_socket.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "base/logging.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/message_loop/message_loop.h"
+#include "net/base/address_list.h"
+#include "net/base/net_errors.h"
+#include "net/base/test_completion_callback.h"
+#include "net/dns/host_resolver.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/log/test_net_log.h"
+#include "net/socket/client_socket_handle.h"
+#include "net/socket/fuzzed_socket.h"
+
+// Fuzzer for SocksClientSocket.  Only covers the SOCKS4 handshake.
+//
+// |data| is used to create a FuzzedSocket to fuzz reads and writes, see that
+// class for details.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // Needed for thread checks and waits.
+  base::MessageLoopForIO message_loop;
+
+  // Use a test NetLog, to exercise logging code.
+  net::BoundTestNetLog bound_test_net_log;
+
+  net::TestCompletionCallback callback;
+  scoped_ptr<net::FuzzedSocket> fuzzed_socket(
+      new net::FuzzedSocket(data, size, bound_test_net_log.bound()));
+  CHECK_EQ(net::OK, fuzzed_socket->Connect(callback.callback()));
+
+  scoped_ptr<net::ClientSocketHandle> socket_handle(
+      new net::ClientSocketHandle());
+  socket_handle->SetSocket(std::move(fuzzed_socket));
+
+  net::HostResolver::RequestInfo request_info(net::HostPortPair("foo", 80));
+  net::MockHostResolver mock_host_resolver;

[eroman, 2016/04/14 17:56:28]

It would be interesting to fuzz the host resolution as well. These states would
be the most interesting I think:

   * syn vs async completion
   * resolution failure
   * IPv4 vs IPv6 result (in theory the implementation requests IPv4 only so
IPv6 result would just exercise the failure case)

The actual hostname itself doesn't need to be an input since we don't use it
other than for resolving.

[mmenke, 2016/04/14 19:01:51]

Done.  I'm returning a fixed address in each case - doesn't seem worth the
effort to do more.

+  net::SOCKSClientSocket socket(std::move(socket_handle), request_info,
+                                net::DEFAULT_PRIORITY, &mock_host_resolver);
+  int result = socket.Connect(callback.callback());
+  callback.GetResult(result);
+  return 0;
+}