URLRequest fuzzer.

net/base/fuzzed_data_provider.h

Index: net/base/fuzzed_data_provider.h
diff --git a/net/base/fuzzed_data_provider.h b/net/base/fuzzed_data_provider.h
new file mode 100644
index 0000000000000000000000000000000000000000..68ea6214fed38d2f5089a35b021b2f5257d9df8d
--- /dev/null
+++ b/net/base/fuzzed_data_provider.h
@@ -0,0 +1,52 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_BASE_FUZZED_DATA_PROVIDER_H
+#define NET_BASE_FUZZED_DATA_PROVIDER_H
+
+#include <stdint.h>
+
+#include "base/macros.h"
+#include "base/strings/string_piece.h"
+
+namespace net {
+
+// Utility class to break up fuzzer input for multiple consumers.  Whenever run
+// on the same input, provides the same output, as long as its methods are
+// called in the same order, with the same arguments.
+class FuzzedDataProvider {
+ public:
+  // |data| is an array of length |size| that the FuzzedDataProvider wraps to
+  // provide more granular access. |data| must outlive the FuzzedDataProvider.
+  FuzzedDataProvider(const uint8_t* data, size_t size);
+  ~FuzzedDataProvider();
+
+  // Tries to copy the first |bytes| remaining bytes from the input data to
+  // |dest|. If fewer than that many bytes of data remain, writes all the
+  // data that's left. Returns number of bytes written, which may be 0.
+  size_t ConsumeBytes(char* dest, size_t bytes);

[eroman, 2016/04/28 01:32:36]

I think this interface would be easier/safer if it returned a base::StringPiece
rather than copying to |dest|.

We can get away with that since the current implementation just returns slices
into the underlying data, which has to remain alive.

For instance stuff that needs to make a copy could become:

std::string data_read = foo->ConsumeBytes(10).as_string();

(Or use the helpers that append base::StringPiece to std::strings)

Now stuff that just needs to pass around data can feed it without making a copy.

base::StringPiece data_read = foo->ConsumeBytes(10);
TestMyFoo(data_read);  // didn't need to make a copy.

Conceptually csharrison's fuzzer could have consumed this base::StringPiece
interface (except in practice too many of our helpers takes const std::string&
when they could just as easily be taking base::StringPiece, so would have
probably had to copy to a std::string anyway).

Even so, I think this is a bit less fiddly (code now needs to be careful that
|dest| is at least |bytes| long).

WDYT?

[mmenke, 2016/04/28 16:01:38]

SGTM.  Could even provide both interfaces, but I'll stick with just the
StringPiece version for now.

+
+  // Returns a value from |min| to |max| inclusive, extracting a value from the
+  // input data in some unspecified manner. Value may not be uniformly
+  // distributed in the given range. If there's no input data left, always
+  // returns |min|. |min| must be less than or equal to |max|.
+  uint32_t ConsumeValueInRange(uint32_t min, uint32_t max);
+
+  // Returns a value with the specified number of bits of data. Returns 0 if
+  // there's no input data left. |num_bits| must non-zero, and at most 32.
+  // Basically the same as ConsumeValueInRange((1 << num_bits) - 1);
+  uint32_t ConsumeBits(size_t num_bits);
+
+  // Same as ConsumeBits(1), but returns a bool.

[eroman, 2016/04/28 01:32:36]

Might want to mention returns |true| when there is no more data.

[mmenke, 2016/04/28 16:01:38]

Done (Though now it's false).

+  bool ConsumeBool();
+
+ private:
+  base::StringPiece remaining_data_;
+
+  DISALLOW_COPY_AND_ASSIGN(FuzzedDataProvider);
+};
+
+}  // namespace net
+
+#endif  // NET_BASE_FUZZED_DATA_PROVIDER_H