Add fuzzer for ParseURLHostnameToAddress to //net.

net/base/parse_url_hostname_to_address_fuzzer.cc

Index: net/base/parse_url_hostname_to_address_fuzzer.cc
diff --git a/net/base/parse_url_hostname_to_address_fuzzer.cc b/net/base/parse_url_hostname_to_address_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..a2ef0cb0dab08e636624a081e8896a45165fb438
--- /dev/null
+++ b/net/base/parse_url_hostname_to_address_fuzzer.cc
@@ -0,0 +1,51 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "base/json/json_writer.h"
+#include "base/values.h"
+#include "net/base/address_list.h"
+#include "net/base/ip_address.h"
+
+static uint16_t CRC16(const uint8_t *data, const size_t size) {
+    static const uint16_t crctab[16] = {
+        0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7,
+        0x8108, 0x9129, 0xa14a, 0xb16b, 0xc18c, 0xd1ad, 0xe1ce, 0xf1ef,
+    };
+
+    uint16_t result = 0xffff;
+    for (size_t i = 0; i < size; i++) {
+        result = (result << 4) ^ crctab[(data[i] >> 4) ^ (result >> 12)];
+        result = (result << 4) ^ crctab[(data[i] & 15) ^ (result >> 12)];
+    }
+
+    return result;
+}
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  const base::StringPiece hostname(reinterpret_cast<const char*>(data), size);
+  net::IPAddress address;
+
+  if (net::ParseURLHostnameToAddress(hostname, &address)) {
+    uint16_t port = CRC16(data, size);

[eroman, 2016/08/30 17:24:21]

Please document why using a hash for the port (rather than either a fixed port,
or consuming it directly from input).

I am assuming your thinking is there is value in varying the port, but not
enough to enumerate it as part of fuzz input?

[aizatsky, 2016/08/30 18:18:31]

If don't need CRC16 specifically, I suggest you use std::hash. 

(https://cs.chromium.org/chromium/src/third_party/icu/fuzzers/fuzzer_utils.h?r...)

[mmoroz, 2016/08/31 11:18:24]

Yes, exactly! Added a comment on that.

[mmoroz, 2016/08/31 11:18:24]

Thanks for the suggestion. Done!

+    net::AddressList addresses = net::AddressList::CreateFromIPAddress(address,
+                                                                       port);
+    base::ListValue endpoints;
+    for (auto endpoint : addresses) {

[eroman, 2016/08/30 17:24:21]

nit: const auto&

[mmoroz, 2016/08/31 11:18:24]

Done.

+      endpoints.AppendString(endpoint.ToStringWithoutPort());
+    }
+
+    std::string json;
+    if (base::JSONWriter::Write(endpoints, &json)) {

[eroman, 2016/08/30 17:24:21]

Why the dependency on constructing a base::Value and JSONWriter?

[aizatsky, 2016/08/30 18:18:31]

+1. Simply calling ToString on endpoint should be enough. No need to fuzz JSON
writer.

[mmoroz, 2016/08/31 11:18:24]

Done.

+      return 0;
+    }
+
+    return 0;
+  }
+
+  return 0;
+}