libFuzzer for blink::MHTMLParser

third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp

Index: third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp
diff --git a/third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp b/third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..8ec95e0b4936ae188bdabd431b20d18fe8cd0a63
--- /dev/null
+++ b/third_party/WebKit/Source/platform/mhtml/MHTMLFuzzer.cpp
@@ -0,0 +1,52 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "platform/SharedBuffer.h"
+#include "platform/heap/Handle.h"
+#include "platform/mhtml/ArchiveResource.h"
+#include "platform/mhtml/MHTMLParser.h"
+#include "platform/testing/TestingPlatformSupport.h"
+#include "wtf/Assertions.h"
+#include "wtf/Compiler.h"
+
+#include <base/command_line.h>

[tkent, 2016/08/02 23:00:45]

Do not use |#include <>| for chromium headers.

[Łukasz Anforowicz, 2016/08/03 16:02:46]

Done.

This change is also making the includes be checked against DEPS rules.  So - in
the follow-up patchset I am folding base/command_line.h and base/i18n/icu_util.h
initialization into blink::ScopedUnittestsEnvironmentSetup (which by virtue of
being under platform/*testing* can include some extra base headers).

+#include <base/i18n/icu_util.h>
+
+#include <memory>
+
+#include <stddef.h>
+#include <stdint.h>
+
+
+namespace blink {
+
+// Fuzzer for blink::MHTMLParser.
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    MHTMLParser mhtmlParser(SharedBuffer::create(data, size));
+    HeapVector<Member<ArchiveResource>> mhtmlArchives = mhtmlParser.parseArchive();
+    mhtmlArchives.clear();
+    ThreadHeap::collectAllGarbage();
+
+    return 0;
+}
+
+} // namespace blink
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    return blink::LLVMFuzzerTestOneInput(data, size);
+}
+
+extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
+{
+    base::CommandLine::Init(*argc, *argv);
+    base::i18n::InitializeICU();
+
+    // Intentional leak - no need to do cleanup as explained in
+    // "Initialization/Cleanup" section of testing/libfuzzer/efficient_fuzzer.md
+    static blink::ScopedUnittestsEnvironmentSetup testSetup;
+
+    return 0;
+}