URLRequest fuzzer.

net/socket/socks_client_socket_fuzzer.cc

Index: net/socket/socks_client_socket_fuzzer.cc
diff --git a/net/socket/socks_client_socket_fuzzer.cc b/net/socket/socks_client_socket_fuzzer.cc
index 2bc905bc96912124c76b81c9f65837187331166f..b7fbd14dd90d99091723a6c92d67bf0b8fe77d85 100644
--- a/net/socket/socks_client_socket_fuzzer.cc
+++ b/net/socket/socks_client_socket_fuzzer.cc
@@ -9,6 +9,7 @@
 
 #include "base/logging.h"
 #include "net/base/address_list.h"
+#include "net/base/fuzzed_data_provider.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
 #include "net/dns/host_resolver.h"
@@ -24,7 +25,9 @@
 // class for details.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   // Use a test NetLog, to exercise logging code.
-  net::BoundTestNetLog bound_test_net_log;
+  net::TestNetLog test_net_log;
+
+  net::FuzzedDataProvider data_provider(data, size);
 
   // Consume the last byte of |data| to determine if the DNS lookup returns
   // synchronously or asynchronously, and succeeds or fails, and returns an IPv4
@@ -32,13 +35,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   net::MockHostResolver mock_host_resolver;
   scoped_refptr<net::RuleBasedHostResolverProc> rules(
       new net::RuleBasedHostResolverProc(nullptr));
-  uint8_t resolver_result = 0;
-  if (size > 0) {
-    resolver_result = data[size - 1];
-    size--;
-  }
-  mock_host_resolver.set_synchronous_mode(!!(resolver_result & 0x1));
-  switch ((resolver_result >> 1) % 3) {
+  mock_host_resolver.set_synchronous_mode(!!data_provider.ConsumeBits(1));
+  switch (data_provider.ConsumeBits(7) % 3) {

[eroman, 2016/04/22 22:07:11]

Shrug, I would use the minimal amount of bits here. i.e.
FuzzedDataProvider::GetNumberInRange()

[mmenke, 2016/04/27 19:53:25]

Done.

     case 0:
       rules->AddRule("*", "127.0.0.1");
       break;
@@ -53,7 +51,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
 
   net::TestCompletionCallback callback;
   std::unique_ptr<net::FuzzedSocket> fuzzed_socket(
-      new net::FuzzedSocket(data, size, bound_test_net_log.bound()));
+      new net::FuzzedSocket(&data_provider, &test_net_log));
   CHECK_EQ(net::OK, fuzzed_socket->Connect(callback.callback()));
 
   std::unique_ptr<net::ClientSocketHandle> socket_handle(