Add fuzzer for PasswordGeneratorFips181.

This patch adds fuzzer for password_generator_fips181_unittest.cc.

R=vabr@chromium.org
Bug: 847200

Change-Id: I83823e2315c459963ff020604272613482f15e78
Reviewed-on: https://chromium-review.googlesource.com/1109596
Commit-Queue: Vaclav Brozek <vabr@chromium.org>
Reviewed-by: Vaclav Brozek <vabr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569986}

components/autofill/core/browser/BUILD.gn

@@ -113,8 +113,6 @@ static_library("browser") {
     "name_field.h",
     "password_generator.cc",
     "password_generator.h",
-    "password_generator_fips181.cc",
-    "password_generator_fips181.h",
     "password_requirements_spec_fetcher.h",
     "password_requirements_spec_fetcher_impl.cc",
     "password_requirements_spec_fetcher_impl.h",
@@ -235,6 +233,7 @@ static_library("browser") {
     "//third_party/libaddressinput",
   ]
   deps = [
+    ":password_generator_fips181",
     "//base",
     "//base:i18n",
     "//components/data_use_measurement/core",
@@ -257,7 +256,6 @@ static_library("browser") {
     "//services/network/public/cpp",
     "//services/network/public/mojom",
     "//sql",
-    "//third_party/fips181",
     "//third_party/icu",
     "//third_party/libphonenumber",
     "//third_party/re2",
@@ -346,6 +344,17 @@ static_library("test_support") {
   ]
 }
 
+static_library("password_generator_fips181") {
+  sources = [
+    "password_generator_fips181.cc",
+    "password_generator_fips181.h",
+  ]
+  deps = [
+    "//base",
+    "//third_party/fips181",
+  ]
+}
+
 bundle_data("unit_tests_bundle_data") {
   sources = [
     "//components/test/data/autofill/merge/input/ambiguous.in",
@@ -447,6 +456,7 @@ source_set("unit_tests") {
 
   deps = [
     ":browser",
+    ":password_generator_fips181",
     ":test_support",
     ":unit_tests_bundle_data",
     "//base",
@@ -501,3 +511,12 @@ fuzzer_test("form_structure_fuzzer") {
   seed_corpus = "form_structure_fuzzer_corpus"
   dict = "form_structure_fuzzer.dict"
 }
+
+fuzzer_test("password_generator_fips181_fuzzer") {
+  sources = [
+    "password_generator_fips181_fuzzer.cc",
+  ]
+  deps = [
+    ":password_generator_fips181",
+  ]
+}

components/autofill/core/browser/password_generator_fips181_fuzzer.cc

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "components/autofill/core/browser/password_generator_fips181.h"
+
+namespace autofill {
+
+namespace {
+
+const char* g_password_text = nullptr;
+
+// The "PasswordGeneratorFips181" is a wrapper around Fips181's gen_pron_pass().
+// The former processes the random string from the latter and ensures that it
+// meets some constraints. GenerateForTest here substitutes for gen_pron_pass(),
+// so that the fuzzer tests the wrapper's logic rather than the third-party's
+// generator implementation.
+int GenerateForTest(char* word,
+                    char* hypenated_word,
+                    unsigned short minlen,
+                    unsigned short maxlen,
+                    unsigned int pass_mode) {
+  strncpy(word, g_password_text, maxlen);
+  g_password_text = nullptr;
+  // Resize password to |maxlen|.
+  word[maxlen] = '\0';
+  return static_cast<int>(strlen(word));
+}
+
+}  // namespace
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  autofill::PasswordGeneratorFips181::SetGeneratorForTest(GenerateForTest);
+  std::string generator_string(reinterpret_cast<const char*>(data), size);
+  g_password_text = generator_string.c_str();
+  autofill::PasswordGeneratorFips181 pg(size);
+  std::string password = pg.Generate();
+  autofill::PasswordGeneratorFips181::SetGeneratorForTest(nullptr);
+  return 0;
+}
+
+}  // namespace autofill