URLRequest fuzzer.

net/base/fuzzed_data_provider.h

Index: net/base/fuzzed_data_provider.h
diff --git a/net/base/fuzzed_data_provider.h b/net/base/fuzzed_data_provider.h
new file mode 100644
index 0000000000000000000000000000000000000000..8712d0ad98c0d96efd74e2ecc68c0ca6b6ab7e8b
--- /dev/null
+++ b/net/base/fuzzed_data_provider.h
@@ -0,0 +1,45 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_BASE_FUZZED_DATA_PROVIDER_H
+#define NET_BASE_FUZZED_DATA_PROVIDER_H
+
+#include <stdint.h>
+
+#include "base/macros.h"
+#include "base/strings/string_piece.h"
+
+namespace net {
+
+// Utiliy class to break up fuzzer input for multiple consumers.  Whenever run

[eroman, 2016/04/22 22:07:10]

tyo: Utility

[mmenke, 2016/04/27 19:53:24]

Done.

+// on the same input, provides the same output, as long as its methods are
+// called in the same order, with the same arguments.
+class FuzzedDataProvider {
+ public:
+  FuzzedDataProvider(const uint8_t* data, size_t size);

[eroman, 2016/04/22 22:07:10]

Please describe ownership. (i.e. |data| must outlive |this|).

[mmenke, 2016/04/27 19:53:24]

Done.

+  ~FuzzedDataProvider();
+
+  // Tries to copy the first |bytes| remaining bytes from the input data to
+  // |dest|. If fewer than that many bytes of data remain, writes all the
+  // data that's left. Returns number of bytes written, which may be 0.
+  size_t ConsumeBytes(char* dest, size_t bytes);

[eroman, 2016/04/22 22:07:10]

nit: input is uint8_t but here the output is char*. Should this be either
uint8_t* for consistency, or void* for generality?

[mmenke, 2016/04/25 15:09:19]

Very few places in net use uint8_t - IOBuffer, in particular, uses char*.  void*
means we lose enforcement of type correctness.  I think char* is the way to go
here.  If we decide to change IOBuffer, we can change this as well.

+
+  // Returns a value with the specified number of bits of data. Returns 0 if
+  // there's no input data left. Pulls data from the end of the array. It's
+  // recommended that bits be pulled in multiple of 8 (Through one or more
+  // calls), since the fuzzer generates data by manipulations at the byte level.

[eroman, 2016/04/22 22:07:10]

Please define the range of num_bits.

i.e. is it expected to be <= 32 (largest to fully return result), or is > 32
bits allowed.

In the current implementation more than 32-bits can be consumed, however the
result is truncated to just 32-bits, obviously.

[mmenke, 2016/04/27 19:53:24]

Done.  Added a CHECK, and documented it.

+  uint32_t ConsumeBits(size_t num_bits);
+
+ private:
+  base::StringPiece remaining_data_;
+
+  uint8_t unused_bits_;
+  uint8_t num_unused_bits_;
+
+  DISALLOW_COPY_AND_ASSIGN(FuzzedDataProvider);
+};
+
+}  // namespace net
+
+#endif  // NET_BASE_FUZZED_DATA_PROVIDER_H