URLRequest fuzzer.

net/socket/socks_client_socket_fuzzer.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
 
 #include "base/logging.h"
 #include "net/base/address_list.h"
+#include "net/base/fuzzed_data_provider.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
 #include "net/dns/host_resolver.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/log/test_net_log.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/fuzzed_socket.h"
 #include "net/socket/socks_client_socket.h"
 
 // Fuzzer for SocksClientSocket.  Only covers the SOCKS4 handshake.
 //
 // |data| is used to create a FuzzedSocket to fuzz reads and writes, see that
 // class for details.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   // Use a test NetLog, to exercise logging code.
-  net::BoundTestNetLog bound_test_net_log;
+  net::TestNetLog test_net_log;
+
+  net::FuzzedDataProvider data_provider(data, size);
 
   // Consume the last byte of |data| to determine if the DNS lookup returns
   // synchronously or asynchronously, and succeeds or fails, and returns an IPv4
   // or IPv6 address.
   net::MockHostResolver mock_host_resolver;
   scoped_refptr<net::RuleBasedHostResolverProc> rules(
       new net::RuleBasedHostResolverProc(nullptr));
-  uint8_t resolver_result = 0;
-  if (size > 0) {
-    resolver_result = data[size - 1];
-    size--;
-  }
-  mock_host_resolver.set_synchronous_mode(!!(resolver_result & 0x1));
-  switch ((resolver_result >> 1) % 3) {
+  mock_host_resolver.set_synchronous_mode(!!data_provider.ConsumeBits(1));
+  switch (data_provider.ConsumeBits(7) % 3) {

[eroman, 2016/04/22 22:07:11]

Shrug, I would use the minimal amount of bits here. i.e.
FuzzedDataProvider::GetNumberInRange()

[mmenke, 2016/04/27 19:53:25]

Done.

     case 0:
       rules->AddRule("*", "127.0.0.1");
       break;
     case 1:
       rules->AddRule("*", "::1");
       break;
     case 2:
       rules->AddSimulatedFailure("*");
       break;
   }
   mock_host_resolver.set_rules(rules.get());
 
   net::TestCompletionCallback callback;
   std::unique_ptr<net::FuzzedSocket> fuzzed_socket(
-      new net::FuzzedSocket(data, size, bound_test_net_log.bound()));
+      new net::FuzzedSocket(&data_provider, &test_net_log));
   CHECK_EQ(net::OK, fuzzed_socket->Connect(callback.callback()));
 
   std::unique_ptr<net::ClientSocketHandle> socket_handle(
       new net::ClientSocketHandle());
   socket_handle->SetSocket(std::move(fuzzed_socket));
 
   net::HostResolver::RequestInfo request_info(net::HostPortPair("foo", 80));
   net::SOCKSClientSocket socket(std::move(socket_handle), request_info,
                                 net::DEFAULT_PRIORITY, &mock_host_resolver);
   int result = socket.Connect(callback.callback());
   callback.GetResult(result);
   return 0;
 }