midi: Add simple fuzzer for message_util.cc

BUG=chromium:785338
TEST=fuzzer works.

Change-Id: I2c51a5a5280079f08a012b409f616ac4112f4d6e
Reviewed-on: https://chromium-review.googlesource.com/804832Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Commit-Queue: Prashant Malani <pmalani@google.com>
Cr-Commit-Position: refs/heads/master@{#521637}

media/midi/BUILD.gn

@@ -7,6 +7,7 @@ import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//media/media_options.gni")
 import("//mojo/public/tools/bindings/mojom.gni")
+import("//testing/libfuzzer/fuzzer_test.gni")
 import("//testing/test.gni")
 
 if (is_android) {
@@ -215,3 +216,23 @@ test("midi_unittests") {
   # This target should not require the Chrome executable to run.
   assert_no_deps = [ "//chrome" ]
 }
+
+fuzzer_test("midi_webmidi_data_validator_fuzzer") {
+  sources = [
+    "midi_webmidi_data_validator_fuzzer.cc",
+  ]
+  seed_corpus = "fuzz/corpus"
+  deps = [
+    ":midi",
+  ]
+}
+
+fuzzer_test("midi_message_queue_fuzzer") {
+  sources = [
+    "midi_message_queue_fuzzer.cc",
+  ]
+  seed_corpus = "fuzz/corpus"
+  deps = [
+    ":midi",
+  ]
+}

media/midi/fuzz/corpus/broken_data_1

+’
\ No newline at end of file

media/midi/fuzz/corpus/broken_data_2

+÷
\ No newline at end of file

media/midi/fuzz/corpus/channel_pressure

+

\ No newline at end of file

media/midi/fuzz/corpus/channel_pressure_with_running_status

+



\ No newline at end of file

media/midi/fuzz/corpus/gm_on

+П~	
В
\ No newline at end of file

media/midi/fuzz/corpus/gm_on_with_real_time_clock

+~	

\ No newline at end of file

media/midi/fuzz/corpus/note_on

+<
\ No newline at end of file

media/midi/fuzz/corpus/note_on_with_real_time_clock

+<<
\ No newline at end of file

media/midi/fuzz/corpus/note_on_with_running_status

+<<<
\ No newline at end of file

media/midi/fuzz/corpus/partial_gm_on_1

+
\ No newline at end of file

media/midi/fuzz/corpus/partial_gm_on_2

+~	

\ No newline at end of file

media/midi/fuzz/corpus/partial_gm_on_3

+÷
\ No newline at end of file

media/midi/fuzz/corpus/partial_note_on_1

+
\ No newline at end of file

media/midi/fuzz/corpus/partial_note_on_2

+<
\ No newline at end of file

media/midi/fuzz/corpus/partial_note_on_3

+
\ No newline at end of file

media/midi/fuzz/corpus/reserved_message_1

+
\ No newline at end of file

media/midi/fuzz/corpus/reserved_message_1_with_data_bytes

+





\ No newline at end of file

media/midi/fuzz/corpus/reserved_message_2

+
\ No newline at end of file

media/midi/fuzz/corpus/system_common_message_tune_request

+
\ No newline at end of file

media/midi/fuzz/corpus/timing_clock

+
\ No newline at end of file

media/midi/midi_message_queue_fuzzer.cc

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "media/midi/midi_message_queue.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  auto queue_running = std::make_unique<midi::MidiMessageQueue>(true);
+  auto queue_normal = std::make_unique<midi::MidiMessageQueue>(false);
+
+  queue_running->Add(data, size);
+  queue_normal->Add(data, size);
+
+  std::vector<uint8_t> message;
+  while (true) {
+    queue_running->Get(&message);
+    if (message.empty())
+      break;
+  }
+
+  while (true) {
+    queue_normal->Get(&message);
+    if (message.empty())
+      break;
+  }
+
+  return 0;
+}

media/midi/midi_webmidi_data_validator_fuzzer.cc

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "media/midi/message_util.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  std::vector<uint8_t> buffer(data, data + size);
+
+  if (midi::IsValidWebMIDIData(buffer))
+    return 0;
+
+  return 0;
+}