json parser/writer correctness fuzzer

base/json/correctness_fuzzer.cc

Index: base/json/correctness_fuzzer.cc
diff --git a/base/json/correctness_fuzzer.cc b/base/json/correctness_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..5bdb9fc82e8cb8725d0af93afb8c832da90cd02d
--- /dev/null
+++ b/base/json/correctness_fuzzer.cc
@@ -0,0 +1,55 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// A fuzzer that checks correctness of json parser/writer.
+// The fuzzer input is passed through parsing twice,
+// so that presumably valid json is parsed/written again.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "base/json/json_reader.h"
+#include "base/json/json_writer.h"
+#include "base/json/string_escape.h"
+#include "base/logging.h"
+#include "base/values.h"
+
+// Entry point for libFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size < 2)
+    return 0;
+
+  int error_code, error_line, error_column;
+  std::string error_message;
+
+  const std::string input_string(reinterpret_cast<const char*>(data), size - 1);
+  const int options = data[size - 1];

[danakj, 2016/10/29 01:12:42]

Still wondering tho, where is this input format for |data| documented? If
nowhere at least it should be documented in a comment on top of this method.

[aizatsky, 2016/10/31 19:56:18]

done

+  auto parsed_value = base::JSONReader::ReadAndReturnError(
+      input_string, options, &error_code, &error_message, &error_line,
+      &error_column);
+  if (!parsed_value)
+    return 0;
+
+  std::string parsed_output;
+  bool b = base::JSONWriter::Write(*parsed_value, &parsed_output);
+  LOG_ASSERT(b);
+
+  auto double_parsed_value = base::JSONReader::ReadAndReturnError(
+      parsed_output, options, &error_code, &error_message, &error_line,
+      &error_column);
+  LOG_ASSERT(double_parsed_value);
+  std::string double_parsed_output;
+  bool b2 =
+      base::JSONWriter::Write(*double_parsed_value, &double_parsed_output);
+  LOG_ASSERT(b2);
+
+  LOG_ASSERT(parsed_output == double_parsed_output)
+      << "Parser/Writer mismatch."
+      << "\nInput=" << base::GetQuotedJSONString(parsed_output)
+      << "\nOutput=" << base::GetQuotedJSONString(double_parsed_output);
+
+  return 0;
+}