Add a URLRequest FTP fuzzer.

base/test/fuzzed_data_provider.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/test/fuzzed_data_provider.h"
 
 #include <algorithm>
 #include <limits>
 
 #include "base/logging.h"
@@ skipping 36 matching lines @@
     offset += 8;
   }
 
   // Avoid division by 0, in the case |range + 1| results in overflow.
   if (range == std::numeric_limits<uint32_t>::max())
     return result;
 
   return min + result % (range + 1);
 }
 
+std::string FuzzedDataProvider::ConsumeRandomLengthString(size_t max_length) {
+  // Reads bytes from start of |remaining_data_|. Maps "\\" to "\", and maps "\"
+  // followed by anything else to the end of the string. As a result of this
+  // logic, a fuzzer can insert characters into the string, and the string will
+  // be lengthened to include those new characters, resulting in a more stable
+  // fuzzer than picking the length of a string independently from picking its
+  // contents.
+  std::string out;
+  for (size_t i = 0; i < max_length && !remaining_data_.empty(); ++i) {
+    char next = remaining_data_[0];
+    remaining_data_.remove_prefix(1);
+    if (next == '\\' && !remaining_data_.empty()) {
+      next = remaining_data_[0];
+      remaining_data_.remove_prefix(1);
+      if (next != '\\')
+        return out;
+    }
+    out += next;
+  }
+  return out;
+}
+
 int FuzzedDataProvider::ConsumeInt32InRange(int min, int max) {
   CHECK_LE(min, max);
 
   uint32_t range = max - min;
   return min + ConsumeUint32InRange(0, range);
 }
 
 bool FuzzedDataProvider::ConsumeBool() {
   return (ConsumeUint8() & 0x01) == 0x01;
 }
 
 uint8_t FuzzedDataProvider::ConsumeUint8() {
   return ConsumeUint32InRange(0, 0xFF);
 }
 
 uint16_t FuzzedDataProvider::ConsumeUint16() {
   return ConsumeUint32InRange(0, 0xFFFF);
 }
 
 }  // namespace base