Add query_parser_fuzzer for component query_parser::QueryParser

Bug: 1012848
Change-Id: If0b9c22bcf3d8341d826dfbc718fe47ebb6328ef
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1850432
Commit-Queue: Dan McArdle <dmcardle@chromium.org>
Reviewed-by: Scott Violet <sky@chromium.org>
Cr-Commit-Position: refs/heads/master@{#704609}

components/query_parser/BUILD.gn

@@ -2,6 +2,8 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//testing/libfuzzer/fuzzer_test.gni")
+
 source_set("query_parser") {
   sources = [
     "query_parser.cc",
@@ -29,3 +31,13 @@ source_set("unit_tests") {
     "//testing/gtest",
   ]
 }
+
+fuzzer_test("query_parser_fuzzer") {
+  sources = [
+    "query_parser_fuzzer.cc",
+  ]
+  deps = [
+    ":query_parser",
+    "//base:base",
+  ]
+}

components/query_parser/query_parser.h

@@ -33,6 +33,7 @@ enum class MatchingAlgorithm {
   DEFAULT,
   // All words are considered for a prefix search.
   ALWAYS_PREFIX_SEARCH,
+  kMaxValue = ALWAYS_PREFIX_SEARCH,
 };
 
 using QueryWordVector = std::vector<query_parser::QueryWord>;

components/query_parser/query_parser_fuzzer.cc

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#include "base/strings/utf_string_conversions.h"
+#include "components/query_parser/query_parser.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  FuzzedDataProvider data_provider(data, size);
+
+  const query_parser::MatchingAlgorithm matching_alg =
+      data_provider.ConsumeEnum<query_parser::MatchingAlgorithm>();
+  const base::string16 query16(base::UTF8ToUTF16(
+      data_provider.ConsumeBytesAsString(data_provider.remaining_bytes())));
+
+  query_parser::QueryParser parser;
+  std::vector<base::string16> words;
+  parser.ParseQueryWords(query16, matching_alg, &words);
+
+  return 0;
+}