Add SOCKS4 and SOCKS5 fuzzers.

net/socket/socks_client_socket_fuzzer.cc

Index: net/socket/socks_client_socket_fuzzer.cc
diff --git a/net/socket/socks_client_socket_fuzzer.cc b/net/socket/socks_client_socket_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..1c16921e6e0d56263b1230518542f679300e9425
--- /dev/null
+++ b/net/socket/socks_client_socket_fuzzer.cc
@@ -0,0 +1,73 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/socket/socks_client_socket.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "base/logging.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/message_loop/message_loop.h"
+#include "net/base/address_list.h"
+#include "net/base/net_errors.h"
+#include "net/base/test_completion_callback.h"
+#include "net/dns/host_resolver.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/log/test_net_log.h"
+#include "net/socket/client_socket_handle.h"
+#include "net/socket/fuzzed_socket.h"
+
+// Fuzzer for SocksClientSocket.  Only covers the SOCKS4 handshake.
+//
+// |data| is used to create a FuzzedSocket to fuzz reads and writes, see that
+// class for details.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // Needed for thread checks and waits.
+  base::MessageLoopForIO message_loop;
+
+  // Use a test NetLog, to exercise logging code.
+  net::BoundTestNetLog bound_test_net_log;
+
+  // Consume the last byte of |data| to determine if the DNS lookup returns
+  // synchronously or asynchronously, and succeeds or fails, and returns an IPv4
+  // or IPv6 address.
+  net::MockHostResolver mock_host_resolver;
+  scoped_refptr<net::RuleBasedHostResolverProc> rules(
+      new net::RuleBasedHostResolverProc(nullptr));
+  uint8_t resolver_result = 0;
+  if (size > 0) {
+    resolver_result = data[size - 1];
+    size--;
+  }
+  mock_host_resolver.set_synchronous_mode(!!(resolver_result & 0x1));
+  switch ((resolver_result >> 1) % 3) {
+    case 0:
+      rules->AddRule("*", "127.0.0.1");
+      break;
+    case 1:
+      rules->AddRule("*", "::1");
+      break;
+    case 2:
+      rules->AddSimulatedFailure("*");
+      break;
+  }
+  mock_host_resolver.set_rules(rules.get());
+
+  net::TestCompletionCallback callback;
+  scoped_ptr<net::FuzzedSocket> fuzzed_socket(
+      new net::FuzzedSocket(data, size, bound_test_net_log.bound()));
+  CHECK_EQ(net::OK, fuzzed_socket->Connect(callback.callback()));
+
+  scoped_ptr<net::ClientSocketHandle> socket_handle(
+      new net::ClientSocketHandle());
+  socket_handle->SetSocket(std::move(fuzzed_socket));
+
+  net::HostResolver::RequestInfo request_info(net::HostPortPair("foo", 80));
+  net::SOCKSClientSocket socket(std::move(socket_handle), request_info,
+                                net::DEFAULT_PRIORITY, &mock_host_resolver);
+  int result = socket.Connect(callback.callback());
+  callback.GetResult(result);
+  return 0;
+}