Add fuzzer for FDE CSS syntax parser.

xfa/fxfa/parser/xfa_basic_imp.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fxfa/parser/xfa_basic_imp.h"
 
 #include "core/fxcrt/include/fx_ext.h"
 #include "xfa/fgas/crt/fgas_codepage.h"
@@ skipping 539 matching lines @@
 int32_t CXFA_WideTextRead::GetPosition() {
   return m_iPosition * sizeof(FX_WCHAR);
 }
 FX_BOOL CXFA_WideTextRead::IsEOF() const {
   return m_iPosition >= m_wsBuffer.GetLength();
 }
 int32_t CXFA_WideTextRead::ReadString(FX_WCHAR* pStr,
                                       int32_t iMaxLength,
                                       FX_BOOL& bEOS,
                                       int32_t const* pByteSize) {
-  if (iMaxLength > m_wsBuffer.GetLength() - m_iPosition) {
+  if (iMaxLength > m_wsBuffer.GetLength() - m_iPosition)
     iMaxLength = m_wsBuffer.GetLength() - m_iPosition;
-  }
+  if (iMaxLength == 0)

[dsinclair, 2016/06/13 20:05:47]

This is needed because the corpus was seeding with an input of "" and the fuzzer
would immediately crash due to an assert in FXSYS_wcsncpy that the size isn't 0.

[Oliver Chang, 2016/06/13 20:11:19]

It's probably best to do

if (size == 0)
  return 0;

in LLVMFuzzerTestOneInput instead of changing this here.

[dsinclair, 2016/06/13 20:19:22]

I think the check is valid here. We can't proceed if the size is zero, so we can
bail out early. It's just the first issue found by the fuzzer, heh.

+    return 0;
+
   FXSYS_wcsncpy(pStr, m_wsBuffer.c_str() + m_iPosition, iMaxLength);
   m_iPosition += iMaxLength;
   bEOS = IsEOF();
   return iMaxLength;
 }
 uint16_t CXFA_WideTextRead::GetCodePage() const {
   return (sizeof(FX_WCHAR) == 2) ? FX_CODEPAGE_UTF16LE : FX_CODEPAGE_UTF32LE;
 }
 uint16_t CXFA_WideTextRead::SetCodePage(uint16_t wCodePage) {
   return GetCodePage();
 }