Add fuzzer for fax codec

testing/libfuzzer/pdf_codec_fax_fuzzer.cc

+// Copyright 2016 The PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <limits.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <memory>
+
+#include "core/fxcodec/codec/ccodec_faxmodule.h"
+#include "core/fxcodec/codec/ccodec_scanlinedecoder.h"
+
+static int GetInteger(const uint8_t* data) {
+  return data[0] | data[1] << 8 | data[2] << 16 | data[3] << 24;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  const int kParameterSize = 21;
+  if (size < kParameterSize)
+    return 0;
+
+  int width = GetInteger(data);
+  int height = GetInteger(data + 4);
+  int K = GetInteger(data + 8);
+  int Columns = std::max(1, std::min(USHRT_MAX, GetInteger(data + 12)));

[Tom Sepez, 2016/09/19 16:28:48]

Why are we bounding these? the decoder should guard against bad values, no?

[kcwu, 2016/09/19 16:38:48]

I'm not sure. I just follow the only existing caller.
https://cs.chromium.org/chromium/src/third_party/pdfium/core/fpdfapi/fpdf_par...

+  int Rows = std::max(0, std::min(USHRT_MAX, GetInteger(data + 16)));
+  FX_BOOL EndOfLine = (data[20] & 0x01) == 0;
+  FX_BOOL ByteAlign = (data[20] & 0x02) == 0;
+  FX_BOOL BlackIs1 = (data[20] & 0x04) == 0;
+  data += kParameterSize;
+  size -= kParameterSize;
+
+  std::unique_ptr<CCodec_FaxModule> fax_module(new CCodec_FaxModule);
+  std::unique_ptr<CCodec_ScanlineDecoder> decoder;
+  decoder.reset(fax_module->CreateDecoder(data, size, width, height, K,
+                                          EndOfLine, ByteAlign, BlackIs1,
+                                          Columns, Rows));
+
+  int line = 0;
+  while (decoder->GetScanline(line))
+    line++;
+
+  return 0;
+}