Add a fuzzer for TemplateURLParser/Open Search Descriptions.

testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc

Index: testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc
diff --git a/testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc b/testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..e7ece0228f1482639c17d583381014bc40fc9c5d
--- /dev/null
+++ b/testing/libfuzzer/fuzzers/template_url_parser_fuzzer.cc
@@ -0,0 +1,47 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <random>
+#include <string>
+
+#include "components/search_engines/search_terms_data.h"
+#include "components/search_engines/template_url_parser.h"
+
+class PseudoRandomFilter : public TemplateURLParser::ParameterFilter {
+public:
+  PseudoRandomFilter(uint32_t seed)
+    : generator_(seed)
+    , bool_pool_(0, 1) {}
+  ~PseudoRandomFilter() override = default;
+
+  bool KeepParameter(const std::string&, const std::string&) override {
+    return bool_pool_(generator_);
+  }
+
+private:
+  std::mt19937 generator_;
+  std::uniform_int_distribution<bool> bool_pool_;
+};
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

[aizatsky, 2016/07/06 18:45:53]

Let's add

struct FuzzerFixedParams {
  bool show_in_default_list;
  uint32_t seed;

  etc.
}

and use it to extract fixed parameters.

+  if (size < 5) {

[aizatsky, 2016/07/06 18:45:53]

should be sizeof(FuzzerFixedParams)

+    // This fuzzer needs five bytes for required parameters.
+    return 0;
+  }
+
+  bool show_in_default_list = data[0] & 1;

[aizatsky, 2016/07/06 18:45:53]

use bit field in params struct.

+  data++;
+  size--;
+
+  PseudoRandomFilter filter(*reinterpret_cast<const int32_t*>(data));

[aizatsky, 2016/07/06 18:45:53]

these 4 bytes would go into rng and which doesn't have any smoothness. I suggest
you simply use input string hash as a seed rather than waste 4 bytes of genes:

  std::string str = std::string(reinterpret_cast<const char*>(data), size);
  std::size_t data_hash = std::hash<std::string>()(str);

+  data += sizeof(int32_t);
+  size -= sizeof(int32_t);
+
+  TemplateURLParser::Parse(SearchTermsData(), show_in_default_list,
+                           reinterpret_cast<const char*>(data), size, &filter);
+  return 0;
+}