[libfuzzer] Add expat_xml_parse_fuzzer for third_party/expat.

third_party/expat/fuzz/expat_xml_parse_fuzzer.cc

Index: third_party/expat/fuzz/expat_xml_parse_fuzzer.cc
diff --git a/third_party/expat/fuzz/expat_xml_parse_fuzzer.cc b/third_party/expat/fuzz/expat_xml_parse_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..6f136dfb5b6af64d7c3c01ff25ed54866cb996e5
--- /dev/null
+++ b/third_party/expat/fuzz/expat_xml_parse_fuzzer.cc
@@ -0,0 +1,49 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <expat.h>
+
+static void XMLCALL
+startElement(void* userData, const char* name, const char** atts) {
+  int *depthPtr = (int *)userData;
+  (void)atts;
+
+  for (int i = 0; i < *depthPtr; i++) {
+    (void)name;
+  }
+
+  *depthPtr += 1;
+}
+
+static void XMLCALL
+endElement(void* userData, const char* name) {
+  int* depthPtr = static_cast<int*>(userData);
+  (void)name;
+
+  *depthPtr -= 1;
+}
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  XML_Parser parser = XML_ParserCreate(NULL);

[mmoroz, 2016/05/23 18:06:55]

Probably worth to use several possible values for the encoding parameter (not
only NULL) as Kostya did in google3.

+  if (!parser)
+    return 0;
+  
+  int depth = 0;
+  XML_SetUserData(parser, &depth);
+  XML_SetElementHandler(parser, startElement, endElement);
+
+  const char* dataPtr = reinterpret_cast<const char*>(data);
+
+  if (XML_Parse(parser, dataPtr, size, 1) == XML_STATUS_ERROR) {
+    XML_ErrorString(XML_GetErrorCode(parser));
+    XML_GetCurrentLineNumber(parser);
+  }
+
+  XML_ParserFree(parser);
+  return 0;
+}