Add simple QUIC transport parameters fuzzer

According to the current fuzzer coverage report, there is currently no
coverage of transport_parameters.cc.  There is also an existing TODO for
fuzzing this function.

Bug: 900484
Change-Id: If62481651506a3143148f5302b709509e1bea7ea
Reviewed-on: https://chromium-review.googlesource.com/c/1337523Reviewed-by: Martin Barbella <mbarbella@chromium.org>
Reviewed-by: Ryan Hamilton <rch@chromium.org>
Commit-Queue: Brandon Tolsch <btolsch@chromium.org>
Cr-Commit-Position: refs/heads/master@{#608588}

net/BUILD.gn

@@ -6079,6 +6079,17 @@ fuzzer_test("net_quic_crypto_framer_parse_message_fuzzer") {
   ]
 }
 
+fuzzer_test("net_quic_transport_parameters_fuzzer") {
+  sources = [
+    "quic/quic_transport_parameters_fuzzer.cc",
+  ]
+  deps = [
+    ":net_fuzzer_test_support",
+    "//base",
+    "//net",
+  ]
+}
+
 fuzzer_test("net_socks_client_socket_fuzzer") {
   sources = [
     "socket/socks_client_socket_fuzzer.cc",

net/quic/quic_transport_parameters_fuzzer.cc

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "base/test/fuzzed_data_provider.h"
+#include "net/third_party/quic/core/crypto/transport_parameters.h"
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  base::FuzzedDataProvider data_provider(data, size);
+  auto perspective = data_provider.ConsumeBool() ? quic::Perspective::IS_CLIENT
+                                                 : quic::Perspective::IS_SERVER;
+  quic::TransportParameters transport_parameters;
+  std::string remaining_bytes = data_provider.ConsumeRemainingBytes();
+  quic::ParseTransportParameters(
+      reinterpret_cast<const uint8_t*>(remaining_bytes.data()),
+      remaining_bytes.size(), perspective, &transport_parameters);
+  return 0;
+}

net/third_party/quic/core/crypto/transport_parameters.h

@@ -82,7 +82,6 @@ QUIC_EXPORT_PRIVATE bool SerializeTransportParameters(
 // |perspective| indicates whether the input came from a client or a server.
 // This method returns true if the input was successfully parsed, and false if
 // it could not be parsed.
-// TODO(nharper): Write fuzz tests for this method.
 QUIC_EXPORT_PRIVATE bool ParseTransportParameters(const uint8_t* in,
                                                   size_t in_len,
                                                   Perspective perspective,