A simple fuzzer for HttpServer, with limited coverage of WebSocket.

net/BUILD.gn

Index: net/BUILD.gn
diff --git a/net/BUILD.gn b/net/BUILD.gn
index 796fb2b82382bb9c459b4b2388bf04d1ca317245..564463b0bd2ee1acb216bd22ae376e3cb561921f 100644
--- a/net/BUILD.gn
+++ b/net/BUILD.gn
@@ -1608,6 +1608,8 @@ source_set("net_fuzzer_test_support") {
     "filter/fuzzed_source_stream.h",
     "socket/fuzzed_datagram_client_socket.cc",
     "socket/fuzzed_datagram_client_socket.h",
+    "socket/fuzzed_server_socket.cc",
+    "socket/fuzzed_server_socket.h",
     "socket/fuzzed_socket.cc",
     "socket/fuzzed_socket.h",
     "socket/fuzzed_socket_factory.cc",
@@ -2080,6 +2082,22 @@ fuzzer_test("net_http_transport_security_state_static_fuzzer") {
       "data/fuzzer_dictionaries/net_http_transport_security_state_fuzzer.dict"
 }
 
+fuzzer_test("net_http_server_fuzzer") {
+  sources = [
+    "server/http_server_fuzzer.cc",
+  ]
+  deps = [
+    ":http_server",
+    ":net_fuzzer_test_support",
+    ":test_support",
+    "//base",
+    "//net",
+  ]
+  dict = "data/fuzzer_dictionaries/net_http_server_fuzzer.dict"
+  libfuzzer_options = [ "max_len=256" ]

[mmenke, 2017/01/24 16:29:16]

Not needed - the default max length is significantly longer (And varies over
iteration), and I don't think there's a need to shorten it?

[Maks Orlovich, 2017/01/24 18:34:18]

The default if I run it from command-line is 64; is it different for
ClusterFuzz?

(Coincidentally, is there an easy way of running the fuzzer with the flags
provided here?)

[mmenke, 2017/01/24 19:03:42]

Yes.  I think ClusterFuzz randomly varies it on a per-run basis from 1k to 4k. 
It's in docs somewhere, not positive of the exact values, but certainly over 1k.
Not that I'm aware of.

[Maks Orlovich, 2017/01/25 14:54:37]

Removed then.

+  seed_corpus = "data/fuzzer_data/http_server_requests/"
+}
+
 if (host_toolchain == current_toolchain) {
   executable("domain_security_preload_generator") {
     sources = gypi_values.net_domain_security_state_generator_sources