Add fuzzer targets for usrsctp.

Bug: chromium:1025302
Change-Id: Iadbcb87f0f3f3a1845e925aed8f52685d78e740e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2108066Reviewed-by: Harald Alvestrand <hta@chromium.org>
Reviewed-by: Florent Castelli <orphis@chromium.org>
Commit-Queue: Taylor <deadbeef@chromium.org>
Cr-Commit-Position: refs/heads/master@{#816872}

third_party/usrsctp/BUILD.gn

@@ -3,8 +3,9 @@
 # found in the LICENSE file.
 
 import("//build/toolchain/toolchain.gni")
+import("//testing/libfuzzer/fuzzer_test.gni")
 
-config("usrsctp_config") {
+config("usrsctp_public_config") {
   include_dirs = [
     "usrsctplib/usrsctplib",
     "usrsctplib/usrsctplib/netinet",
@@ -17,6 +18,16 @@ config("usrsctp_config") {
   }
 }
 
+# Used by both usrsctp static library and fuzzers.
+config("usrsctp_internal_config") {
+  defines = []
+  if (is_linux || is_chromeos || is_android) {
+    defines += [ "_GNU_SOURCE" ]
+  } else if (is_apple) {
+    defines += [ "__APPLE_USE_RFC_2292" ]
+  }
+}
+
 config("usrsctp_warnings") {
   if (is_clang) {
     cflags = [
@@ -118,9 +129,10 @@ static_library("usrsctp") {
     # correctly.
     "//build/config/compiler:no_incompatible_pointer_warnings",
     ":usrsctp_warnings",
+    ":usrsctp_internal_config",
   ]
 
-  public_configs = [ ":usrsctp_config" ]
+  public_configs = [ ":usrsctp_public_config" ]
 
   cflags = [
     "-UINET",
@@ -128,14 +140,10 @@ static_library("usrsctp") {
   ]
 
   if (is_linux || is_chromeos || is_android) {
-    defines += [
-      "__Userspace_os_Linux",
-      "_GNU_SOURCE",
-    ]
+    defines += [ "__Userspace_os_Linux" ]
   } else if (is_apple) {
     defines += [
       "HAVE_SA_LEN",
-      "__APPLE_USE_RFC_2292",
       "__Userspace_os_Darwin",
     ]
   }
@@ -149,5 +157,51 @@ static_library("usrsctp") {
   if (is_fuchsia) {
     defines += [ "__Userspace_os_Fuchsia" ]
   }
+
+  if (use_fuzzing_engine) {
+    defines += [ "INVARIANTS" ]
+  }
   deps = [ "//third_party/boringssl" ]
 }
+
+fuzzer_test("usrsctp_fuzzer_listen") {
+  sources = [
+    "usrsctplib/fuzzer/fuzzer_listen.c",
+    "usrsctplib/programs/programs_helper.c",
+  ]
+  additional_configs = [ ":usrsctp_internal_config" ]
+  deps = [ ":usrsctp" ]
+  seed_corpus = "usrsctplib/fuzzer/CORPUS_LISTEN"
+  libfuzzer_options = [ "max_len=4086" ]
+}
+
+fuzzer_test("usrsctp_fuzzer_fragment") {
+  sources = [
+    "usrsctplib/fuzzer/fuzzer_fragment.c",
+    "usrsctplib/programs/programs_helper.c",
+  ]
+  additional_configs = [ ":usrsctp_internal_config" ]
+  deps = [ ":usrsctp" ]
+  seed_corpus = "usrsctplib/fuzzer/CORPUS_FRAGMENT"
+  libfuzzer_options = [ "max_len=4086" ]
+}
+
+fuzzer_test("usrsctp_fuzzer_connect_multi") {
+  sources = [
+    "usrsctplib/fuzzer/fuzzer_connect.c",
+    "usrsctplib/programs/programs_helper.c",
+  ]
+
+  additional_configs = [ ":usrsctp_internal_config" ]
+
+  # See usrsctplib/fuzzer/CMakeLists.txt.
+  # Stage 0 is "multi", which can start fuzzing at different points during the
+  # handshake based on the first fuzzed byte. There were plans to have dedicated
+  # fuzzers for various stages, but this idea was abandoned what was found that
+  # the "multi" fuzzer performed just as well.
+  defines = [ "FUZZING_STAGE=0" ]
+
+  deps = [ ":usrsctp" ]
+  seed_corpus = "usrsctplib/fuzzer/CORPUS_CONNECT"
+  libfuzzer_options = [ "max_len=32000" ]
+}