libFuzzer for blink::MHTMLParser

third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp

Index: third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp
diff --git a/third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp b/third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..6a27d2ca0bc7d99dbb79efefdd803213054dd09a
--- /dev/null
+++ b/third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp
@@ -0,0 +1,44 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "platform/SharedBuffer.h"
+#include "platform/heap/Handle.h"
+#include "platform/mhtml/ArchiveResource.h"
+#include "platform/mhtml/MHTMLParser.h"
+#include "platform/testing/TestingPlatformSupport.h"
+#include "wtf/Assertions.h"
+#include "wtf/Compiler.h"
+#include <memory>
+#include <stddef.h>
+#include <stdint.h>
+
+namespace blink {
+
+// Fuzzer for blink::MHTMLParser.
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    MHTMLParser mhtmlParser(SharedBuffer::create(data, size));
+    HeapVector<Member<ArchiveResource>> mhtmlArchives = mhtmlParser.parseArchive();
+    mhtmlArchives.clear();

[esprehn, 2016/08/04 04:37:53]

why manually clear on stack vectors?

[Łukasz Anforowicz, 2016/08/04 17:37:30]

So that the garbage collection forced on the next line can reclaim memory that
has been allocated inside parseArchive method (i.e. the mhtmlArchives vector
should be the only "root" for that memory).

+    ThreadHeap::collectAllGarbage();

[esprehn, 2016/08/04 04:37:53]

Why do you need to do manual Oilpan GC's?

[Łukasz Anforowicz, 2016/08/04 17:37:30]

Because otherwise libFuzzer will report a memory leak (it checks for memory
leaks after each LLVMFuzzerTestOneInput invocation AFAICT - without this
explicit garbage collection it would keep reporting memory leaks).

+
+    return 0;
+}
+
+} // namespace blink
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    return blink::LLVMFuzzerTestOneInput(data, size);
+}
+
+extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
+{
+    // Intentional leak - no need to do cleanup as explained in
+    // "Initialization/Cleanup" section of testing/libfuzzer/efficient_fuzzer.md
+    static blink::ScopedUnittestsEnvironmentSetup testSetup(
+        *argc, *argv, blink::ScopedUnittestsEnvironmentSetup::TestType::LibFuzzer);
+
+    return 0;
+}