URLRequest fuzzer.

net/base/fuzzed_data_provider.h

Index: net/base/fuzzed_data_provider.h
diff --git a/net/base/fuzzed_data_provider.h b/net/base/fuzzed_data_provider.h
new file mode 100644
index 0000000000000000000000000000000000000000..8712d0ad98c0d96efd74e2ecc68c0ca6b6ab7e8b
--- /dev/null
+++ b/net/base/fuzzed_data_provider.h
@@ -0,0 +1,45 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_BASE_FUZZED_DATA_PROVIDER_H
+#define NET_BASE_FUZZED_DATA_PROVIDER_H
+
+#include <stdint.h>
+
+#include "base/macros.h"
+#include "base/strings/string_piece.h"
+
+namespace net {
+
+// Utiliy class to break up fuzzer input for multiple consumers.  Whenever run
+// on the same input, provides the same output, as long as its methods are
+// called in the same order, with the same arguments.
+class FuzzedDataProvider {
+ public:
+  FuzzedDataProvider(const uint8_t* data, size_t size);
+  ~FuzzedDataProvider();
+
+  // Tries to copy the first |bytes| remaining bytes from the input data to
+  // |dest|. If fewer than that many bytes of data remain, writes all the
+  // data that's left. Returns number of bytes written, which may be 0.
+  size_t ConsumeBytes(char* dest, size_t bytes);
+
+  // Returns a value with the specified number of bits of data. Returns 0 if
+  // there's no input data left. Pulls data from the end of the array. It's
+  // recommended that bits be pulled in multiple of 8 (Through one or more
+  // calls), since the fuzzer generates data by manipulations at the byte level.
+  uint32_t ConsumeBits(size_t num_bits);
+
+ private:
+  base::StringPiece remaining_data_;
+
+  uint8_t unused_bits_;
+  uint8_t num_unused_bits_;
+
+  DISALLOW_COPY_AND_ASSIGN(FuzzedDataProvider);
+};
+
+}  // namespace net
+
+#endif  // NET_BASE_FUZZED_DATA_PROVIDER_H