A simple fuzzer for HttpServer, with limited coverage of WebSocket.

net/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/buildflag_header.gni")
 import("//build/config/chromecast_build.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/crypto.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
@@ skipping 1590 matching lines @@
   testonly = true
 
   sources = [
     "base/fuzzer_test_support.cc",
     "dns/fuzzed_host_resolver.cc",
     "dns/fuzzed_host_resolver.h",
     "filter/fuzzed_source_stream.cc",
     "filter/fuzzed_source_stream.h",
     "socket/fuzzed_datagram_client_socket.cc",
     "socket/fuzzed_datagram_client_socket.h",
+    "socket/fuzzed_server_socket.cc",
+    "socket/fuzzed_server_socket.h",
     "socket/fuzzed_socket.cc",
     "socket/fuzzed_socket.h",
     "socket/fuzzed_socket_factory.cc",
     "socket/fuzzed_socket_factory.h",
   ]
   public_deps = [
     "//base/test:test_support",
   ]
   deps = [
     "//base",
@@ skipping 452 matching lines @@
     "http/transport_security_state_static_fuzzer.cc",
   ]
   deps = [
     ":net_fuzzer_test_support",
     "//net",
   ]
   dict =
       "data/fuzzer_dictionaries/net_http_transport_security_state_fuzzer.dict"
 }
 
+fuzzer_test("net_http_server_fuzzer") {
+  sources = [
+    "server/http_server_fuzzer.cc",
+  ]
+  deps = [
+    ":http_server",
+    ":net_fuzzer_test_support",
+    ":test_support",
+    "//base",
+    "//net",
+  ]
+  dict = "data/fuzzer_dictionaries/net_http_server_fuzzer.dict"
+  libfuzzer_options = [ "max_len=256" ]

[mmenke, 2017/01/24 16:29:16]

Not needed - the default max length is significantly longer (And varies over
iteration), and I don't think there's a need to shorten it?

[Maks Orlovich, 2017/01/24 18:34:18]

The default if I run it from command-line is 64; is it different for
ClusterFuzz?

(Coincidentally, is there an easy way of running the fuzzer with the flags
provided here?)

[mmenke, 2017/01/24 19:03:42]

Yes.  I think ClusterFuzz randomly varies it on a per-run basis from 1k to 4k. 
It's in docs somewhere, not positive of the exact values, but certainly over 1k.
Not that I'm aware of.

[Maks Orlovich, 2017/01/25 14:54:37]

Removed then.

+  seed_corpus = "data/fuzzer_data/http_server_requests/"
+}
+
 if (host_toolchain == current_toolchain) {
   executable("domain_security_preload_generator") {
     sources = gypi_values.net_domain_security_state_generator_sources
     deps = [
       "//base",
       "//crypto",
       "//third_party/boringssl",
     ]
   }
 }