Add simple HPKP and HSTS header parser fuzzers.

net/http/http_security_headers_hpkp_fuzzer.cc

Index: net/http/http_security_headers_hpkp_fuzzer.cc
diff --git a/net/http/http_security_headers_hpkp_fuzzer.cc b/net/http/http_security_headers_hpkp_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..cc1b33609c97b5d5e00a44846d9d5571cd94cddd
--- /dev/null
+++ b/net/http/http_security_headers_hpkp_fuzzer.cc
@@ -0,0 +1,31 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string>
+
+#include "base/time/time.h"
+#include "net/base/hash_value.h"
+#include "net/http/http_security_headers.h"
+#include "net/ssl/ssl_info.h"
+#include "url/gurl.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  std::string input(data, data + size);
+  base::TimeDelta max_age;
+  bool include_subdomains;
+  net::HashValueVector spki_hashes;
+  GURL report_uri;
+
+  net::HashValue hash;
+  hash.FromString("sha256/1111111111111111111111111111111111111111111=");

[aizatsky, 2016/10/25 19:11:20]

does this need to be a valid hash of anything? Will the code below try to verify
it?

[martijnc, 2016/10/25 19:40:52]

The hash is only compared to other hashes. Passing in an invalid hash would also
work I think. We could pass part of |data| to hash::FromString and also fuzz
that and ignore the return value. Not sure how useful or representative that
would be for HPKP.

net::ParseHPKPHeader checks that at least one of the pins matches the ones in
SSLInfo::public_key_hashes (which represents the hashes of the certificates in
the certificate chain currently in use) and that at least one of the pins does
not match. This ensures you don't lock out the user by pinning keys that you
aren't currently using and that you pin at least one backup (a key that isn't in
use).

My thinking was that passing in at least on hash (could) give the fuzzer better
coverage because IsPinListValid() returns early otherwise [1]. 

[1]
https://cs.chromium.org/chromium/src/net/http/http_security_headers.cc?sq=pac...

+
+  net::SSLInfo ssl_info;
+  ssl_info.public_key_hashes.push_back(hash);
+
+  net::ParseHPKPHeader(input, ssl_info.public_key_hashes, &max_age,
+                       &include_subdomains, &spki_hashes, &report_uri);
+  return 0;
+}