Add four more fuzzers.

One of them (mp4_box_reader_fuzzer) requires proprietary_codecs=true.

BUG=chromium:539572

Review URL: https://codereview.chromium.org/1408243006

Cr-Commit-Position: refs/heads/master@{#355475}

11 files changed, 183 insertions, 15 deletions

diff --git a/testing/libfuzzer/BUILD.gn b/testing/libfuzzer/BUILD.gn
index c8c5e02..5fc0ff1 100644
--- a/testing/libfuzzer/BUILD.gn
+++ b/testing/libfuzzer/BUILD.gn
@@ -7,6 +7,7 @@
 #
 # To enable libfuzzer, 'use_libfuzzer' GN option should be set to true.
 
+import("//build/config/features.gni")
 import("//testing/test.gni")
 
 static_library("libfuzzer_main") {
@@ -39,6 +40,17 @@ test("brotli_fuzzer") {
   ]
 }
 
+test("courgette_fuzzer") {
+  sources = [
+    "courgette_fuzzer.cc",
+  ]
+  deps = [
+    ":libfuzzer_main",
+    "//base",
+    "//courgette:courgette_lib",
+  ]
+}
+
 test("dns_record_fuzzer") {
   sources = [
     "dns_record_fuzzer.cc",
@@ -72,6 +84,28 @@ test("ftp_directory_listing_fuzzer") {
   ]
 }
 
+test("language_detection_fuzzer") {
+  sources = [
+    "language_detection_fuzzer.cc",
+  ]
+  deps = [
+    ":libfuzzer_main",
+    "//components/translate/core/language_detection:language_detection",
+  ]
+}
+
+if (proprietary_codecs) {
+  test("mp4_box_reader_fuzzer") {
+    sources = [
+      "mp4_box_reader_fuzzer.cc",
+    ]
+    deps = [
+      ":libfuzzer_main",
+      "//media",
+    ]
+  }
+}
+
 test("snappy_fuzzer") {
   sources = [
     "snappy_fuzzer.cc",
@@ -101,3 +135,13 @@ test("url_parse_fuzzer") {
     "//url:url",
   ]
 }
+
+test("vp9_parser_fuzzer") {
+  sources = [
+    "vp9_parser_fuzzer.cc",
+  ]
+  deps = [
+    ":libfuzzer_main",
+    "//media",
+  ]
+}
diff --git a/testing/libfuzzer/brotli_fuzzer.cc b/testing/libfuzzer/brotli_fuzzer.cc
index 74ee07a..c02e982 100644
--- a/testing/libfuzzer/brotli_fuzzer.cc
+++ b/testing/libfuzzer/brotli_fuzzer.cc
@@ -8,9 +8,10 @@
 #include "third_party/brotli/dec/decode.h"
 
 // Entry point for LibFuzzer.
-extern "C" void LLVMFuzzerTestOneInput(const unsigned char* data,
-                                       unsigned long size) {
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
   std::vector<uint8_t> uncompressed_buf(128 << 10);
   size_t uncompressed_size = uncompressed_buf.size();
   BrotliDecompressBuffer(size, data, &uncompressed_size, &uncompressed_buf[0]);
+  return 0;
 }
diff --git a/testing/libfuzzer/courgette_fuzzer.cc b/testing/libfuzzer/courgette_fuzzer.cc
new file mode 100644
index 0000000..d55454c
--- /dev/null
+++ b/testing/libfuzzer/courgette_fuzzer.cc
@@ -0,0 +1,22 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/memory/scoped_ptr.h"
+#include "courgette/assembly_program.h"
+#include "courgette/courgette.h"
+#include "courgette/encoded_program.h"
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
+  courgette::AssemblyProgram* prog;
+  courgette::Status status =
+      courgette::ParseDetectedExecutable(data, size, &prog);
+  if (status != courgette::C_OK) {
+    return 0;
+  }
+  scoped_ptr<courgette::EncodedProgram> enc_prog(prog->Encode());
+  courgette::DeleteAssemblyProgram(prog);
+  return 0;
+}
diff --git a/testing/libfuzzer/dns_record_fuzzer.cc b/testing/libfuzzer/dns_record_fuzzer.cc
index e199c43..207b17c 100644
--- a/testing/libfuzzer/dns_record_fuzzer.cc
+++ b/testing/libfuzzer/dns_record_fuzzer.cc
@@ -7,14 +7,15 @@
 #include "net/dns/dns_response.h"
 
 // Entry point for LibFuzzer.
-extern "C" void LLVMFuzzerTestOneInput(const unsigned char* data,
-                                       unsigned long size) {
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
   std::string out;
   net::DnsRecordParser parser(data, size, 0);
   if (!parser.IsValid()) {
-    return;
+    return 0;
   }
   net::DnsResourceRecord record;
   while (parser.ReadRecord(&record)) {
   }
+  return 0;
 }
diff --git a/testing/libfuzzer/ftp_ctrl_response_fuzzer.cc b/testing/libfuzzer/ftp_ctrl_response_fuzzer.cc
index 817b20f..686921b 100644
--- a/testing/libfuzzer/ftp_ctrl_response_fuzzer.cc
+++ b/testing/libfuzzer/ftp_ctrl_response_fuzzer.cc
@@ -6,14 +6,15 @@
 #include "net/log/net_log.h"
 
 // Entry point for LibFuzzer.
-extern "C" void LLVMFuzzerTestOneInput(const unsigned char* data,
-                                       unsigned long size) {
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
   const net::BoundNetLog log;
   net::FtpCtrlResponseBuffer buffer(log);
   if (!buffer.ConsumeData(reinterpret_cast<const char*>(data), size)) {
-    return;
+    return 0;
   }
   while (buffer.ResponseAvailable()) {
     (void)buffer.PopResponse();
   }
+  return 0;
 }
diff --git a/testing/libfuzzer/ftp_directory_listing_fuzzer.cc b/testing/libfuzzer/ftp_directory_listing_fuzzer.cc
index 2698086..2b767e9 100644
--- a/testing/libfuzzer/ftp_directory_listing_fuzzer.cc
+++ b/testing/libfuzzer/ftp_directory_listing_fuzzer.cc
@@ -9,9 +9,10 @@
 #include "net/ftp/ftp_directory_listing_parser.h"
 
 // Entry point for LibFuzzer.
-extern "C" void LLVMFuzzerTestOneInput(const unsigned char* data,
-                                       unsigned long size) {
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
   std::string buffer(reinterpret_cast<const char*>(data), size);
   std::vector<net::FtpDirectoryListingEntry> entries;
   net::ParseFtpDirectoryListing(buffer, base::Time::Now(), &entries);
+  return 0;
 }
diff --git a/testing/libfuzzer/language_detection_fuzzer.cc b/testing/libfuzzer/language_detection_fuzzer.cc
new file mode 100644
index 0000000..a257ca4
--- /dev/null
+++ b/testing/libfuzzer/language_detection_fuzzer.cc
@@ -0,0 +1,36 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stdint.h>
+#include <string>
+
+#include "base/strings/string16.h"
+#include "base/strings/utf_string_conversions.h"
+#include "components/translate/core/language_detection/language_detection_util.h"
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
+  if (size == 0) {
+    return 0;
+  }
+  uint8_t ch = data[0];
+  int lang_len = ch & 0xF;
+  int html_lang_len = (ch >> 4) & 0xF;
+  int text_len = size - lang_len - html_lang_len;
+  if ((text_len < 0) || (text_len % 2 != 0)) {
+    return 0;
+  }
+  std::string lang(reinterpret_cast<const char*>(data), lang_len);
+  std::string html_lang(reinterpret_cast<const char*>(data + lang_len),
+                        html_lang_len);
+  base::string16 text(
+      reinterpret_cast<const base::char16*>(data + lang_len + html_lang_len),
+      text_len / 2);
+  std::string cld_lang;
+  bool is_cld_reliable;
+  translate::DeterminePageLanguage(lang, html_lang, text, &cld_lang,
+                                   &is_cld_reliable);
+  return 0;
+}
diff --git a/testing/libfuzzer/mp4_box_reader_fuzzer.cc b/testing/libfuzzer/mp4_box_reader_fuzzer.cc
new file mode 100644
index 0000000..d81c652
--- /dev/null
+++ b/testing/libfuzzer/mp4_box_reader_fuzzer.cc
@@ -0,0 +1,41 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "media/formats/mp4/box_reader.h"
+#include "base/logging.h"
+#include "base/memory/scoped_ptr.h"
+
+class NullMediaLog : public media::MediaLog {
+ public:
+  NullMediaLog() {}
+
+  void DoAddEventLogString(const std::string& event) {}
+
+  void AddEvent(scoped_ptr<media::MediaLogEvent> event) override {}
+
+ protected:
+  virtual ~NullMediaLog() {}
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(NullMediaLog);
+};
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
+  bool err;
+  scoped_refptr<NullMediaLog> media_log(new NullMediaLog());
+  scoped_ptr<media::mp4::BoxReader> reader(
+      media::mp4::BoxReader::ReadTopLevelBox(data, size, media_log, &err));
+  if (err) {
+    return 0;
+  }
+  if (reader == NULL) {
+    return 0;
+  }
+  if (!reader->ScanChildren()) {
+    return 0;
+  }
+  return 0;
+}
diff --git a/testing/libfuzzer/snappy_fuzzer.cc b/testing/libfuzzer/snappy_fuzzer.cc
index 9c7354f..744b5c3 100644
--- a/testing/libfuzzer/snappy_fuzzer.cc
+++ b/testing/libfuzzer/snappy_fuzzer.cc
@@ -8,17 +8,18 @@
 #include "third_party/snappy/src/snappy.h"
 
 // Entry point for LibFuzzer.
-extern "C" void LLVMFuzzerTestOneInput(const unsigned char* data,
-                                       unsigned long size) {
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
   snappy::ByteArraySource src(reinterpret_cast<const char*>(data), size);
   uint32_t len;
   // Note: src is invalid after GetUncompressedLength call.
   if (!snappy::GetUncompressedLength(&src, &len) || (len > 1E6)) {
     // We have to bail out, to avoid self-crafted decompression bombs.
-    return;
+    return 0;
   }
 
   std::string uncompressed_str;
   snappy::Uncompress(reinterpret_cast<const char*>(data), size,
                      &uncompressed_str);
+  return 0;
 }
diff --git a/testing/libfuzzer/string_to_int_fuzzer.cc b/testing/libfuzzer/string_to_int_fuzzer.cc
index 2c7ce18..5eb80bf 100644
--- a/testing/libfuzzer/string_to_int_fuzzer.cc
+++ b/testing/libfuzzer/string_to_int_fuzzer.cc
@@ -10,8 +10,8 @@
 #include "base/strings/string_number_conversions.h"
 
 // Entry point for LibFuzzer.
-extern "C" void LLVMFuzzerTestOneInput(const unsigned char* data,
-                                       unsigned long size) {
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
   std::string input(reinterpret_cast<const char*>(data), size);
   int out_int;
   base::StringToInt(input, &out_int);
@@ -34,4 +34,5 @@ extern "C" void LLVMFuzzerTestOneInput(const unsigned char* data,
   base::HexStringToBytes(input, &out_bytes);
 
   base::HexEncode(data, size);
+  return 0;
 }
diff --git a/testing/libfuzzer/vp9_parser_fuzzer.cc b/testing/libfuzzer/vp9_parser_fuzzer.cc
new file mode 100644
index 0000000..c879453
--- /dev/null
+++ b/testing/libfuzzer/vp9_parser_fuzzer.cc
@@ -0,0 +1,19 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "media/filters/vp9_parser.h"
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data,
+                                      unsigned long size) {
+  media::Vp9Parser parser;
+  parser.SetStream(data, size);
+  while (true) {
+    media::Vp9FrameHeader fhdr;
+    if (media::Vp9Parser::kOk != parser.ParseNextFrame(&fhdr)) {
+      break;
+    }
+  }
+  return 0;
+}