libFuzzer for blink::MHTMLParser

third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp

Index: third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp
diff --git a/third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp b/third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..07c08bd06ffde56878873453e65026ef5a1b3404
--- /dev/null
+++ b/third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp
@@ -0,0 +1,43 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "platform/SharedBuffer.h"
+#include "platform/heap/Handle.h"
+#include "platform/mhtml/ArchiveResource.h"
+#include "platform/mhtml/MHTMLParser.h"
+#include "platform/testing/TestingPlatformSupport.h"
+#include "wtf/Assertions.h"
+#include "wtf/Compiler.h"
+#include <memory>
+#include <stddef.h>

[mmoroz, 2016/08/09 02:24:01]

nit: It would be better to include standard headers first
(https://google.github.io/styleguide/cppguide.html#Names_and_Order_of_Includes).

[Łukasz Anforowicz, 2016/08/09 21:28:33]

Unfortunately, Chromium and Blink style guides disagree here.  AFAIK there is a
plan to reformat Blink according to Chromium style, but this effort is blocked
on some tooling work.  Until the style guides are unified, I have to follow
Blink style which says:

https://www.chromium.org/blink/coding-style#TOC-include-Statements:

Includes of system headers must come after includes of other headers. This
happens to also be checked and ensured by alphabetical order, as < comes after
".

[mmoroz, 2016/08/10 09:12:56]

Makes sense, sorry for incorrect suggestion from me!

+#include <stdint.h>
+
+namespace blink {
+
+// Fuzzer for blink::MHTMLParser.
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    MHTMLParser mhtmlParser(SharedBuffer::create(data, size));
+    HeapVector<Member<ArchiveResource>> mhtmlArchives = mhtmlParser.parseArchive();
+    mhtmlArchives.clear();
+    ThreadHeap::collectAllGarbage();
+
+    return 0;
+}
+
+} // namespace blink
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    return blink::LLVMFuzzerTestOneInput(data, size);
+}
+
+extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
+{
+    // Intentional leak - no need to do cleanup as explained in
+    // "Initialization/Cleanup" section of testing/libfuzzer/efficient_fuzzer.md
+    static blink::ScopedUnittestsEnvironmentSetup testSetup(*argc, *argv);

[esprehn, 2016/08/10 04:05:29]

DEFINE_STATIC_LOCAL(...)

[Łukasz Anforowicz, 2016/08/10 19:31:17]

Done.  (it also requires ALLOW_UNUSED_LOCAL(...))

+
+    return 0;
+}