Add a fuzzer for the domain_reliability header parser.

Bug: none
Change-Id: I9c4a35aa6797230840f3436cbf66f35904dbf5cd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1576010
Commit-Queue: Matt Mueller <mattm@chromium.org>
Reviewed-by: Matt Mueller <mattm@chromium.org>
Auto-Submit: David Benjamin <davidben@chromium.org>
Cr-Commit-Position: refs/heads/master@{#652707}

components/domain_reliability/BUILD.gn

@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 import("//build/config/jumbo.gni")
+import("//testing/libfuzzer/fuzzer_test.gni")
 
 action("bake_in_configs") {
   visibility = [ ":*" ]
@@ -115,3 +116,15 @@ jumbo_source_set("unit_tests") {
     "//testing/gtest",
   ]
 }
+
+fuzzer_test("domain_reliability_header_fuzzer") {
+  sources = [
+    "header_fuzzer.cc",
+  ]
+  deps = [
+    ":domain_reliability",
+    "//base",
+    "//base:i18n",
+  ]
+  dict = "header.dict"
+}

components/domain_reliability/header.dict

+# Copyright 2019 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Directive names
+"report-uri"
+"max-age"
+"includeSubDomains"
+
+# Directive separators
+";"
+"="
+" "
+
+# Some sample directive values
+"https://a/"
+"5"
+
+# See Unquote and set_quote_chars in header.cc
+"\""
+"'"
+"<"
+">"

components/domain_reliability/header_fuzzer.cc

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+
+#include "base/at_exit.h"
+#include "base/i18n/icu_util.h"
+#include "base/logging.h"
+#include "base/strings/string_piece.h"
+#include "components/domain_reliability/header.h"
+
+using domain_reliability::DomainReliabilityHeader;
+
+// The URL parser depends on ICU, which must be initialized.
+struct IcuEnvironment {
+  IcuEnvironment() { CHECK(base::i18n::InitializeICU()); }
+  // ICU requires an AtExitManager.
+  base::AtExitManager at_exit_manager;
+};
+
+IcuEnvironment* env = new IcuEnvironment();
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  base::StringPiece input(reinterpret_cast<const char*>(data), size);
+  std::unique_ptr<DomainReliabilityHeader> header =
+      DomainReliabilityHeader::Parse(input);
+  if (!header->IsParseError()) {
+    header->ToString();
+  }
+  return 0;
+}