Add a libfuzzer for usrsctp, an SCTP userland stack.

testing/libfuzzer/fuzzers/usrsctp_fuzzer.cc

Index: testing/libfuzzer/fuzzers/usrsctp_fuzzer.cc
diff --git a/testing/libfuzzer/fuzzers/usrsctp_fuzzer.cc b/testing/libfuzzer/fuzzers/usrsctp_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..e11c3f642d9b214bfb9920573592c566f7b4ea2b
--- /dev/null
+++ b/testing/libfuzzer/fuzzers/usrsctp_fuzzer.cc
@@ -0,0 +1,32 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+

[mmoroz, 2016/06/03 17:53:20]

Could you please include <stddef.h> and <stdint.h>. We tend to include them
explicitly to be sure that uint8_t and size_t are always defined.

[katrielc, 2016/06/03 18:25:45]

Done.

+#include "usrsctp.h"

[mmoroz, 2016/06/03 17:53:20]

Please use the full path, I guess it will be:
#include "third_party/usrsctp/usrsctplib/usrsctplib/usrsctp.h"

[katrielc, 2016/06/03 18:25:45]

Done.

+
+static int ignore1(void* addr,
+                   void* data,
+                   size_t length,
+                   uint8_t tos,
+                   uint8_t set_df) {
+  return 0;
+};

[mmoroz, 2016/06/03 17:53:20]

I think it would be better to have an empty line between function definitions.

[katrielc, 2016/06/03 18:25:45]

Done.

+static void ignore2(const char* format, ...){};
+
+namespace {
+bool usrsctp_initialized = false;
+void InitializeUsrsctp() {

[mmoroz, 2016/06/03 17:53:20]

I recommend to do environment initialization in this way:
https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/gfx_png_image_...

[katrielc, 2016/06/03 18:25:45]

Done. Out of curiosity is this a style-guide thing or is there a particular
reason for it?

+  if (usrsctp_initialized)
+    return;
+
+  usrsctp_init(0, ignore1, ignore2);
+  // usrsctp_sysctl_set_sctp_ecn_enable(0);

[mmoroz, 2016/06/03 17:53:20]

Do we need this line commented out? Could you please add a comment with
explanation (e.g. if it is some TODO or FIXME thing, or what does it mean) or
remove it if it doesn't matter.

[katrielc, 2016/06/03 18:25:46]

Done.

+  usrsctp_initialized = true;
+}
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  InitializeUsrsctp();
+  usrsctp_conninput(nullptr, data, size, 0);
+  return 0;
+}