Introduce gpu_fuzzer to fuzz the GPU command buffers

gpu/command_buffer/service/common_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/common_decoder.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
 
 #include "base/numerics/safe_math.h"
 #include "gpu/command_buffer/service/cmd_buffer_engine.h"
 
 namespace gpu {
+namespace {
+static const size_t kDefaultMaxBucketSize = 1u << 30;  // 1 GB
+}
 
 const CommonDecoder::CommandInfo CommonDecoder::command_info[] = {
 #define COMMON_COMMAND_BUFFER_CMD_OP(name)                       \
   {                                                              \
     &CommonDecoder::Handle##name, cmd::name::kArgFlags,          \
         cmd::name::cmd_flags,                                    \
         sizeof(cmd::name) / sizeof(CommandBufferEntry) - 1,      \
   }                                                              \
   ,  /* NOLINT */
   COMMON_COMMAND_BUFFER_CMDS(COMMON_COMMAND_BUFFER_CMD_OP)
@@ skipping 90 matching lines @@
   DCHECK(_count && _string && _length);
   *_count = count;
   *_string = strs;
   _length->resize(count);
   for (GLsizei ii = 0; ii < count; ++ii) {
     (*_length)[ii] = length[ii];
   }
   return true;
 }
 
-CommonDecoder::CommonDecoder() : engine_(NULL) {}
+CommonDecoder::CommonDecoder()
+    : engine_(NULL), max_bucket_size_(kDefaultMaxBucketSize) {}
 
 CommonDecoder::~CommonDecoder() {}
 
 void* CommonDecoder::GetAddressAndCheckSize(unsigned int shm_id,
                                             unsigned int data_offset,
                                             unsigned int data_size) {
   CHECK(engine_);
   scoped_refptr<gpu::Buffer> buffer = engine_->GetSharedMemoryBuffer(shm_id);
   if (!buffer.get())
     return NULL;
@@ skipping 93 matching lines @@
   engine_->set_token(args.token);
   return error::kNoError;
 }
 
 error::Error CommonDecoder::HandleSetBucketSize(uint32_t immediate_data_size,
                                                 const void* cmd_data) {
   const cmd::SetBucketSize& args =
       *static_cast<const cmd::SetBucketSize*>(cmd_data);
   uint32_t bucket_id = args.bucket_id;
   uint32_t size = args.size;
+  if (size > max_bucket_size_)
+    return error::kOutOfBounds;
 
   Bucket* bucket = CreateBucket(bucket_id);
   bucket->SetSize(size);
   return error::kNoError;
 }
 
 error::Error CommonDecoder::HandleSetBucketData(uint32_t immediate_data_size,
                                                 const void* cmd_data) {
   const cmd::SetBucketData& args =
       *static_cast<const cmd::SetBucketData*>(cmd_data);
@@ skipping 94 matching lines @@
   }
   const void* src = bucket->GetData(offset, size);
   if (!src) {
       return error::kInvalidArguments;
   }
   memcpy(data, src, size);
   return error::kNoError;
 }
 
 }  // namespace gpu