[libfuzzer] proto-based renderer fuzzer draft

content/test/fuzzer/renderer_proto_tree_fuzzer.cc

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Fuzzer for content/renderer
+
+#include <stddef.h>
+#include <stdint.h>
+#include <memory>
+#include <sstream>
+
+#include "content/test/fuzzer/fuzzer_support.h"
+#include "content/test/fuzzer/html_tree.pb.h"
+#include "third_party/libprotobuf-mutator/src/src/binary_format.h"
+#include "third_party/libprotobuf-mutator/src/src/libfuzzer/libfuzzer_mutator.h"
+
+protobuf_mutator::protobuf::LogSilencer log_silincer;
+
+namespace content {
+
+class HtmlTreeWriter {
+ public:
+  HtmlTreeWriter() {}
+
+  template <typename T>
+  HtmlTreeWriter& operator<<(const T& t) {
+    out_ << t;
+    return *this;
+  }
+
+  std::string str() const { return out_.str(); }
+
+ private:
+  std::ostringstream out_;
+};
+
+static HtmlTreeWriter& operator<<(HtmlTreeWriter& w,
+                                  const Attribute::Value& value) {
+  switch (value.value_case()) {
+    case Attribute::Value::kBoolValue:
+      return w << (value.bool_value() ? "true" : "false");
+    case Attribute::Value::kUintValue:
+      return w << value.uint_value();
+    case Attribute::Value::kIntValue:
+      return w << value.int_value();
+    case Attribute::Value::kDoubleValue:
+      return w << value.double_value();
+    case Attribute::Value::kPxValue:
+      return w << value.px_value() << "px";
+    case Attribute::Value::kPctValue:
+      return w << value.pct_value() << "%";
+    case Attribute::Value::VALUE_NOT_SET:
+      return w;
+  }
+}
+
+static HtmlTreeWriter& operator<<(HtmlTreeWriter& w,
+                                  const Attribute::Name& name) {
+  return w << Attribute_Name_Name(name);
+}
+
+static HtmlTreeWriter& operator<<(HtmlTreeWriter& w, const Attribute& attr) {
+  return w << attr.name() << "=\"" << attr.value() << "\"";
+}
+
+static HtmlTreeWriter& operator<<(HtmlTreeWriter& w, const Tag::Name& tagName) {
+  return w << Tag_Name_Name(tagName);
+}
+
+static void operator<<(HtmlTreeWriter& w, const Tag& tag) {
+  w << "<" << tag.name();
+  for (const auto& attr : tag.attrs()) {
+    w << " " << attr;
+  }
+
+  w << ">";
+  for (const auto& subtag : tag.subtags()) {
+    w << subtag;
+  }
+  w << "</" << tag.name() << ">";
+}
+
+static void operator<<(HtmlTreeWriter& w, const Document& document) {
+  w << document.root();
+}
+
+static std::string str(const uint8_t* data, size_t size) {
+  Document document;
+  protobuf_mutator::ParseBinaryMessage(data, size, &document);
+
+  HtmlTreeWriter writer;
+  writer << document;
+  return writer.str();
+  //  return document.ShortDebugString();
+}
+
+extern "C" void LLVMPrintInput(const uint8_t* data, size_t size) {
+  //  fprintf(stderr, "NEW %s\n", str(data, size).c_str());
+}
+
+extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* data,
+                                          size_t size,
+                                          size_t max_size,
+                                          unsigned int seed) {
+  fprintf(stderr, "BEFORE    %s\n", str(data, size).c_str());
+  size_t new_size = protobuf_mutator::libfuzzer::MutateBinaryMessage<Document>(
+      data, size, max_size, seed);
+  fprintf(stderr, "AFTER     %s\n", str(data, new_size).c_str());
+  return new_size;
+}
+
+extern "C" size_t LLVMFuzzerCustomCrossOver(const uint8_t* data1,
+                                            size_t size1,
+                                            const uint8_t* data2,
+                                            size_t size2,
+                                            uint8_t* out,
+                                            size_t max_out_size,
+                                            unsigned int seed) {
+  fprintf(stderr, "BEFOR1    %s\n", str(data1, size1).c_str());
+  fprintf(stderr, "BEFOR2    %s\n", str(data2, size2).c_str());
+  size_t new_size =
+      protobuf_mutator::libfuzzer::CrossOverBinaryMessages<Document>(
+          data1, size1, data2, size2, out, max_out_size, seed);
+  fprintf(stderr, "AFTER     %s\n", str(data1, new_size).c_str());
+  return new_size;
+}
+
+static Env* env = nullptr;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // Environment has to be initialized in the same thread.
+  if (env == nullptr)
+    env = new Env();
+
+  //  str(data, size);
+
+  env->adapter->LoadHTML(str(data, size), "http://www.example.org");
+
+  //  fprintf(stderr, "%s\n", writer.str().c_str());
+
+  return 0;
+}
+
+}  // namespace content