URLRequest fuzzer.

net/http/http_proxy_client_socket_fuzzer.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_proxy_client_socket.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
 #include <string>
 
 #include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
 #include "net/base/address_list.h"
 #include "net/base/auth.h"
+#include "net/base/fuzzed_data_provider.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/test_completion_callback.h"
 #include "net/http/http_auth_cache.h"
 #include "net/http/http_auth_handler_basic.h"
 #include "net/http/http_auth_handler_digest.h"
 #include "net/http/http_auth_handler_factory.h"
 #include "net/http/http_auth_scheme.h"
 #include "net/log/test_net_log.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/fuzzed_socket.h"
 #include "net/socket/next_proto.h"
 
 // Fuzzer for HttpProxyClientSocket only tests establishing a connection when
 // using the proxy as a tunnel.
 //
 // |data| is used to create a FuzzedSocket to fuzz reads and writes, see that
 // class for details.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   // Use a test NetLog, to exercise logging code.
-  net::BoundTestNetLog bound_test_net_log;
+  net::TestNetLog test_net_log;
+
+  net::FuzzedDataProvider data_provider(data, size);
 
   // Use last byte to determine if the HttpProxyClientSocket should be told the

[eroman, 2016/04/22 22:07:10]

Generalize this comment, or remove it. Where the data came from is an
abstraction of the FuzzedDataProvider layer.

[mmenke, 2016/04/27 19:53:25]

Done.

   // underlying socket is HTTPS.
-  bool is_https_proxy = 0;
-  if (size > 0) {
-    is_https_proxy = !(data[size - 1] & 1);
-    size--;
-  }
+  bool is_https_proxy = !(data_provider.ConsumeBits(8) & 1);

[eroman, 2016/04/22 22:07:10]

Why not "!data_provider.ConsumeBits(1)" ?

Are you concerned with changing the current corpus data?

[mmenke, 2016/04/22 22:59:32]

My concern is stability - the fuzzer works by modifying previous interesting
inputs.  If we remove things in multiples of 8, behavior tends to be more stable
when the input is modified.  Yes, the data may be used for completely different
things, but in the case of multiple reads in a row, for example, the data is
interpreted the exact same way.  If we don't read in multiples of 8, the results
of subsequent operations are basically completely random.

[mmenke, 2016/04/27 19:53:25]

I've updated ConsumeBits to always consume an exact number of bytes.

 
   net::TestCompletionCallback callback;
   std::unique_ptr<net::FuzzedSocket> fuzzed_socket(
-      new net::FuzzedSocket(data, size, bound_test_net_log.bound()));
+      new net::FuzzedSocket(&data_provider, &test_net_log));
   CHECK_EQ(net::OK, fuzzed_socket->Connect(callback.callback()));
 
   std::unique_ptr<net::ClientSocketHandle> socket_handle(
       new net::ClientSocketHandle());
   socket_handle->SetSocket(std::move(fuzzed_socket));
 
   // Create auth handler supporting basic and digest schemes.  Other schemes can
   // make system calls, which doesn't seem like a great idea.
   net::HttpAuthCache auth_cache;
   net::HttpAuthHandlerRegistryFactory auth_handler_factory;
@@ skipping 17 matching lines @@
   // Repeatedly try to log in with the same credentials.
   while (result == net::ERR_PROXY_AUTH_REQUESTED) {
     auth_controller->ResetAuth(net::AuthCredentials(
         base::ASCIIToUTF16("user"), base::ASCIIToUTF16("pass")));
     result = socket.RestartWithAuth(callback.callback());
     result = callback.GetResult(result);
   }
 
   return 0;
 }