QUIC stream factory fuzzer is in the works. I also had a quic_stream_sequencer_buffer fuzzer which will hit that area of code more efficiently, but we should still cover it with the stream factory fuzzer.

Another interesting attack surface could be the bidirectional stream.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb

commit 3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb
Author: Ned Williamson <nedwilliamson@gmail.com>
Date: Tue Nov 07 22:58:13 2017

Add Quic Stream Factory Fuzzer

Adds a fuzzer for QUIC streams using a fuzzed server. In order to
fuzz efficiently, also adds a mock encrypter and decrypter that do
no encryption and do not add/check MACs.

BUG= 781399 

Cq-Include-Trybots: master.tryserver.chromium.android:android_cronet_tester;master.tryserver.chromium.mac:ios-simulator-cronet
Change-Id: Ia6d66671763e69c8cf6449c0a728cd4c0bf48e80
Reviewed-on: https://chromium-review.googlesource.com/753006
Commit-Queue: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Ryan Hamilton <rch@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#514638}
[modify] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/AUTHORS
[modify] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/BUILD.gn
[modify] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/quic/chromium/mock_crypto_client_stream_factory.cc
[modify] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/quic/chromium/mock_crypto_client_stream_factory.h
[add] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/quic/chromium/quic_stream_factory_fuzzer.cc
[modify] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/quic/test_tools/mock_crypto_client_stream.cc
[modify] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/quic/test_tools/mock_crypto_client_stream.h
[add] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/quic/test_tools/mock_decrypter.cc
[add] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/quic/test_tools/mock_decrypter.h
[add] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/quic/test_tools/mock_encrypter.cc
[add] https://crrev.com/3d55bbb391a5a2e7ba3dd5c083f46bfdb950adcb/net/quic/test_tools/mock_encrypter.h

Status: Assigned

Ryan, do you have an owner in mind? :)

[rch]:  Is this done, or is there more work to do?

Fair enough. We're finding enough bugs that I think this is working :)