Add a fuzzer for TemplateURLParser/Open Search Descriptions.

Add a fuzzer for TemplateURLParser/Open Search Descriptions.

BUG=625746
Review-Url: https://codereview.chromium.org/2123733002
Cr-Commit-Position: refs/heads/master@{#459727}
Committed: https://chromium.googlesource.com/chromium/src/+/588a32ac7a5824a30aea437bf85a1f7615dfcbc3

[dominicc (has gone to gerrit), 2016-07-05 06:26:07]

dominicc@chromium.org changed reviewers:
+ aizatsky@chromium.org

[dominicc (has gone to gerrit), 2016-07-05 06:26:07]

PTAL

My first fuzzer, advice appreciated.

Open Search Descriptions are XML documents from the interwebs parsed by libxml's
SAX parser in browser without any user intervention so it seems worthwhile
fuzzing them.

[aizatsky, 2016-07-06 18:45:53]

https://codereview.chromium.org/2123733002/diff/20001/testing/libfuzzer/fuzze...
File testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc (right):

https://codereview.chromium.org/2123733002/diff/20001/testing/libfuzzer/fuzze...
testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc:30: extern "C" int
LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
Let's add

struct FuzzerFixedParams {
  bool show_in_default_list;
  uint32_t seed;

  etc.
}

and use it to extract fixed parameters.

https://codereview.chromium.org/2123733002/diff/20001/testing/libfuzzer/fuzze...
testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc:31: if (size < 5) {
should be sizeof(FuzzerFixedParams)

https://codereview.chromium.org/2123733002/diff/20001/testing/libfuzzer/fuzze...
testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc:36: bool
show_in_default_list = data[0] & 1;
use bit field in params struct.

https://codereview.chromium.org/2123733002/diff/20001/testing/libfuzzer/fuzze...
testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc:40: PseudoRandomFilter
filter(*reinterpret_cast<const int32_t*>(data));
these 4 bytes would go into rng and which doesn't have any smoothness. I suggest
you simply use input string hash as a seed rather than waste 4 bytes of genes:

  std::string str = std::string(reinterpret_cast<const char*>(data), size);
  std::size_t data_hash = std::hash<std::string>()(str);

[dominicc (has gone to gerrit), 2017-03-08 07:21:36]

The CQ bit was checked by dominicc@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-08 07:21:55]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[dominicc (has gone to gerrit), 2017-03-08 07:22:38]

Thanks for the feedback! Sorry for the slow reply. Please take another look.

[commit-bot: I haz the power, 2017-03-08 07:45:39]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-08 07:45:40]

Dry run: Try jobs failed on following builders:
  linux_chromium_chromeos_ozone_rel_ng on master.tryserver.chromium.linux
(JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[dominicc (has gone to gerrit), 2017-03-16 05:12:30]

The CQ bit was checked by dominicc@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-16 05:12:51]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-16 05:51:23]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-16 05:51:24]

Dry run: Try jobs failed on following builders:
  cast_shell_linux on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/cast_shell_linu...)

[aizatsky, 2017-03-20 20:14:05]

https://codereview.chromium.org/2123733002/diff/60001/testing/libfuzzer/fuzze...
File testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc (right):

https://codereview.chromium.org/2123733002/diff/60001/testing/libfuzzer/fuzze...
testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc:31: std::size_t
data_hash =
with this approach every input bit change would result in different seed =>
different parameters kept.

I suggest you use first 4 bytes of the data as seed and the rest as a string.

[dominicc (has gone to gerrit), 2017-03-23 04:39:29]

The CQ bit was checked by dominicc@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-23 04:39:38]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[dominicc (has gone to gerrit), 2017-03-23 04:39:53]

On 2017/03/20 at 20:14:05, aizatsky wrote:
>
https://codereview.chromium.org/2123733002/diff/60001/testing/libfuzzer/fuzze...
> File testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc (right):
> 
>
https://codereview.chromium.org/2123733002/diff/60001/testing/libfuzzer/fuzze...
> testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc:31: std::size_t
data_hash =
> with this approach every input bit change would result in different seed =>
different parameters kept.
> 
> I suggest you use first 4 bytes of the data as seed and the rest as a string.

Done; PTAL. Thanks!

[commit-bot: I haz the power, 2017-03-23 04:55:18]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-23 04:55:19]

Dry run: Try jobs failed on following builders:
  chromeos_daisy_chromium_compile_only_ng on master.tryserver.chromium.linux
(JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/chromeos_daisy_...)

[aizatsky, 2017-03-23 21:04:02]

lgtm

[dominicc (has gone to gerrit), 2017-03-24 04:50:38]

The CQ bit was checked by dominicc@chromium.org

[commit-bot: I haz the power, 2017-03-24 04:50:59]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-24 05:48:00]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-24 05:48:02]

Try jobs failed on following builders:
  linux_chromium_chromeos_ozone_rel_ng on master.tryserver.chromium.linux
(JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[dominicc (has gone to gerrit), 2017-03-24 08:56:28]

The CQ bit was checked by dominicc@chromium.org

[commit-bot: I haz the power, 2017-03-24 08:56:41]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-24 09:04:32]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-24 09:04:33]

Try jobs failed on following builders:
  linux_chromium_chromeos_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[dominicc (has gone to gerrit), 2017-03-27 08:08:20]

The CQ bit was checked by dominicc@chromium.org

[dominicc (has gone to gerrit), 2017-03-27 08:08:20]

The patchset sent to the CQ was uploaded after l-g-t-m from
aizatsky@chromium.org
Link to the patchset: https://codereview.chromium.org/2123733002/#ps100001
(title: "Bring patch to head.")

[commit-bot: I haz the power, 2017-03-27 08:08:32]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-27 09:06:32]

CQ is committing da patch.

Bot data: {"patchset_id": 100001, "attempt_start_ts": 1490602100474350,
"parent_rev": "6965a1a18751e9c2331051dbe2d986ad392f5250", "commit_rev":
"588a32ac7a5824a30aea437bf85a1f7615dfcbc3"}

[commit-bot: I haz the power, 2017-03-27 09:07:41]

Description was changed from

==========
Add a fuzzer for TemplateURLParser/Open Search Descriptions.

BUG=625746
==========

to

==========
Add a fuzzer for TemplateURLParser/Open Search Descriptions.

BUG=625746

Review-Url: https://codereview.chromium.org/2123733002
Cr-Commit-Position: refs/heads/master@{#459727}
Committed:
https://chromium.googlesource.com/chromium/src/+/588a32ac7a5824a30aea437bf85a...
==========

[commit-bot: I haz the power, 2017-03-27 09:07:42]

Committed patchset #6 (id:100001) as
https://chromium.googlesource.com/chromium/src/+/588a32ac7a5824a30aea437bf85a...