Add fuzzer for (A)PNG decoder

third_party/WebKit/Source/platform/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//testing/libfuzzer/fuzzer_test.gni")
 import("//testing/test.gni")
 import("//third_party/WebKit/public/public_features.gni")
 import("//third_party/WebKit/Source/build/scripts/scripts.gni")
@@ skipping 2000 matching lines @@
   sources = [
     "WebIconSizesFuzzer.cpp",
   ]
   deps = [
     ":blink_fuzzer_test_support",
     ":platform",
   ]
   dict = "//testing/libfuzzer/fuzzers/dicts/web_icon_sizes.dict"
 }
 
+fuzzer_test("png_fuzzer") {

[mmoroz, 2017/01/03 08:18:36]

Would you mind naming it a bit more explicitly? For example, `blink_png_fuzzer`,
or `png_image_decoder_fuzzer`? I'm asking, because we have many fuzz targets.
Giving short names to them will collide soon (For example, we have
`libpng_read_fuzzer` which also could be named `png_fuzzer`, but we are tending
to have specific names to avoid ambiguity).

[scroggo_chromium, 2017/01/03 18:24:14]

Done.

+  sources = [
+    "PngFuzzer.cpp",
+  ]
+  deps = [
+    ":blink_fuzzer_test_support",
+    ":platform",
+    "//third_party/libpng",
+  ]
+  seed_corpus = "//third_party/WebKit/LayoutTests/images/resources/pngfuzz"

[mmoroz, 2017/01/03 08:18:36]

That's awesome that you're adding a seed corpus. I suggest you also add a
dictionary. You can use existing png.dict used by some other fuzzers
(https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/BUILD.gn?q=png...).

[scroggo_chromium, 2017/01/03 18:24:14]

Done. Should I also add "//cc/test/data" to the seed_corpus? (Is there a way to
have multiple seed corpora?)

+}
+
 # Fuzzer for blink::JSONParser.
 fuzzer_test("blink_json_parser_fuzzer") {
   sources = [
     "json/JSONParserFuzzer.cpp",
   ]
   deps = [
     ":blink_fuzzer_test_support",
     ":platform",
   ]
   dict = "//testing/libfuzzer/fuzzers/dicts/json.dict"
@@ skipping 39 matching lines @@
     "//third_party/WebKit/Source:inside_blink",
   ]
 
   deps = [
     ":test_support",
     "//cc/surfaces:surface_id",
     "//testing/gmock",
     "//testing/gtest",
   ]
 }