Fuzzer for all 4 HttpAuthHandlers

Essentially a copy of the HttpAuthHandlerDigestFuzzer with a bit of
extra logic to exercise the retrieval of specific scheme factories and
then remove the bit of input massaging to make it specific to digest.

Fixed: 599584
Change-Id: Iceb4d9985b02e0d6de7edd7de3059a90a7050ba7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2349980
Commit-Queue: Eric Orth <ericorth@chromium.org>
Auto-Submit: Eric Orth <ericorth@chromium.org>
Reviewed-by: Eric Roman <eroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#797828}

net/BUILD.gn

@@ -5365,6 +5365,16 @@ fuzzer_test("net_http_auth_handler_digest_fuzzer") {
   ]
 }
 
+fuzzer_test("net_http_auth_handler_fuzzer") {
+  sources = [ "http/http_auth_handler_fuzzer.cc" ]
+  deps = [
+    ":net_fuzzer_test_support",
+    ":test_support",
+    "//base",
+    "//net",
+  ]
+}
+
 fuzzer_test("net_http_content_disposition_fuzzer") {
   sources = [ "http/http_content_disposition_fuzzer.cc" ]
   dict = "data/fuzzer_dictionaries/net_http_content_disposition_fuzzer.dict"

net/http/http_auth_handler_fuzzer.cc

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <fuzzer/FuzzedDataProvider.h>
+
+#include <memory>
+#include <string>
+
+#include "net/base/network_isolation_key.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/http/http_auth_challenge_tokenizer.h"
+#include "net/http/http_auth_handler.h"
+#include "net/http/http_auth_handler_factory.h"
+#include "net/http/http_auth_scheme.h"
+#include "net/log/net_log_with_source.h"
+#include "net/ssl/ssl_info.h"
+#include "url/gurl.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  FuzzedDataProvider data_provider{data, size};
+
+  std::string scheme;
+  if (data_provider.ConsumeBool()) {
+    scheme = std::string(data_provider.PickValueInArray(
+        {net::kBasicAuthScheme, net::kDigestAuthScheme, net::kNtlmAuthScheme,
+         net::kNegotiateAuthScheme}));
+  } else {
+    scheme = data_provider.ConsumeRandomLengthString(10);
+  }
+  std::unique_ptr<net::HttpAuthHandlerRegistryFactory> factory =
+      net::HttpAuthHandlerFactory::CreateDefault();
+  net::HttpAuthHandlerFactory* scheme_factory =
+      factory->GetSchemeFactory(scheme);
+
+  if (!scheme_factory)
+    return 0;
+
+  std::string challenge = data_provider.ConsumeRandomLengthString(500);
+
+  // Dummies
+  net::SSLInfo null_ssl_info;
+  GURL origin("https://foo.test/");
+  auto host_resolver = std::make_unique<net::MockHostResolver>();
+  std::unique_ptr<net::HttpAuthHandler> handler;
+
+  scheme_factory->CreateAuthHandlerFromString(
+      challenge, net::HttpAuth::AUTH_SERVER, null_ssl_info,
+      net::NetworkIsolationKey(), origin, net::NetLogWithSource(),
+      host_resolver.get(), &handler);
+
+  if (handler) {
+    auto followup = data_provider.ConsumeRemainingBytesAsString();
+    net::HttpAuthChallengeTokenizer tokenizer{followup.begin(), followup.end()};
+    handler->HandleAnotherChallenge(&tokenizer);
+  }
+  return 0;
+}