URLRequest fuzzer.

net/url_request/url_request_fuzzer.cc

Index: net/url_request/url_request_fuzzer.cc
diff --git a/net/url_request/url_request_fuzzer.cc b/net/url_request/url_request_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..272b7bb189caf1010670cfa1d7448d6d936dbdb3
--- /dev/null
+++ b/net/url_request/url_request_fuzzer.cc
@@ -0,0 +1,37 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/url_request/url_request.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+
+#include "base/run_loop.h"
+#include "net/base/fuzzed_data_provider.h"
+#include "net/base/request_priority.h"
+#include "net/socket/fuzzed_socket_factory.h"
+#include "net/url_request/url_request.h"
+#include "net/url_request/url_request_context.h"
+#include "net/url_request/url_request_test_util.h"
+#include "url/gurl.h"
+
+// Integration fuzzer for URLRequest's handling of HTTP requests.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  net::FuzzedDataProvider data_provider(data, size);
+  net::TestURLRequestContext url_request_context(true);
+  net::FuzzedSocketFactory fuzzed_socket_factory(&data_provider);
+  url_request_context.set_client_socket_factory(&fuzzed_socket_factory);
+  url_request_context.Init();
+
+  net::TestDelegate delegate;
+
+  std::unique_ptr<net::URLRequest> url_request(
+      url_request_context.CreateRequest(GURL("http://foo/"),

[eroman, 2016/04/22 22:07:11]

neato!

Some suggestions for the future:
  * Fuzz the protocol -- http, ftp, https
  * Fuzz the proxy configuration -- direct, proxy
  * Include upload data
  * Fuzz cancellation (especially within the Delegate in response to redirects
and the like).
  * Fuzz deferring redirects and the like.

[mmenke, 2016/04/25 15:09:19]

Yea, I agree with all of these.

+                                        net::DEFAULT_PRIORITY, &delegate));
+  url_request->Start();
+  base::RunLoop().RunUntilIdle();
+  return 0;
+}