Add a fuzzer for the Origin Trial token parser

content/common/origin_trials/trial_token.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_COMMON_ORIGIN_TRIALS_TRIAL_TOKEN_H_
 #define CONTENT_COMMON_ORIGIN_TRIALS_TRIAL_TOKEN_H_
 
 #include <memory>
 #include <string>
 
 #include "base/strings/string_piece.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "url/origin.h"
 
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size);
+
 namespace blink {
 enum class WebOriginTrialTokenStatus;
 }
 
 namespace content {
 
 // The Experimental Framework (EF) provides limited access to experimental
 // features, on a per-origin basis (origin trials). This class defines the trial
 // token data structure, used to securely provide access to an experimental
 // feature.
@@ skipping 27 matching lines @@
   // and has not yet expired. Otherwise, the return value indicates why the
   // token is not valid.
   blink::WebOriginTrialTokenStatus IsValid(const url::Origin& origin,
                                            const base::Time& now) const;
 
   url::Origin origin() { return origin_; }
   std::string feature_name() { return feature_name_; }
   base::Time expiry_time() { return expiry_time_; }
 
  protected:
+  // Tests can access the Parse method directly to validate it, and so are
+  // declared as friends here. All other access to Parse should be made through
+  // TrialToken::From, which will always also ensure that there is a valid
+  // signature attached to the token.
   friend class TrialTokenTest;
+  friend int ::LLVMFuzzerTestOneInput(const uint8_t*, size_t);
 
   // If the string represents a properly signed and well-formed token, the token
   // payload is returned in the |out_token_payload| parameter and success is
   // returned. Otherwise,the return code indicates what was wrong with the
   // string, and |out_token_payload| is unchanged.
   static blink::WebOriginTrialTokenStatus Extract(
       const std::string& token_text,
       base::StringPiece public_key,
       std::string* out_token_payload);
 
@@ skipping 20 matching lines @@
   // The name of the experimental feature which this token enables.
   std::string feature_name_;
 
   // The time until which this token should be considered valid.
   base::Time expiry_time_;
 };
 
 }  // namespace content
 
 #endif  // CONTENT_COMMON_ORIGIN_TRIALS_TRIAL_TOKEN_H_