Author fuzz tests and fix a comment-related issue (#2935)

Co-authored-by: James Newton-King <james@newtonking.com>

Src/Newtonsoft.Json.FuzzTests/FuzzTests.cs

@@ -0,0 +1,85 @@
+using System;
+using System.IO;
+
+namespace Newtonsoft.Json.FuzzTests
+{
+    public static class Fuzzers
+    {
+        static readonly JsonSerializer jsonSerializer = new();
+
+        public static void FuzzDeserialization(ReadOnlySpan<byte> buffer)
+        {
+            try
+            {
+                using var ms = new MemoryStream(buffer.ToArray());
+                using var sr = new StreamReader(ms);
+                using var reader = new JsonTextReader(sr);
+                jsonSerializer.Deserialize(reader);
+            }
+            catch (JsonException)
+            {
+                // this can be JsonReaderException, JsonWriterException, or JsonSerializationException;
+                // the latter two can be thrown by deserializing into a json object
+                return;
+                // ignore - known/expected exceptions are okay
+            }
+        }
+
+        public static void FuzzSerialization(ReadOnlySpan<byte> buffer)
+        {
+            object? deserialized;
+            try
+            {
+                deserialized = Deserialize(buffer);
+            }
+            catch
+            {
+                return;
+            }
+
+            // see if this throws
+            Serialize(deserialized);
+        }
+
+        public static void FuzzIdempotent(ReadOnlySpan<byte> buffer)
+        {
+            string serialized1;
+            try
+            {
+                serialized1 = Serialize(Deserialize(buffer));
+            }
+            catch
+            {
+                return;
+            }
+
+            var serialized2 = Serialize(Deserialize(serialized1));
+            if (serialized1 != serialized2)
+            {
+                throw new Exception($"not idempotent: {serialized1} {serialized2}");
+            }
+        }
+
+        private static string Serialize(object? o)
+        {
+            using var sw1 = new StringWriter();
+            jsonSerializer.Serialize(sw1, o);
+            return sw1.ToString();
+        }
+
+        private static object? Deserialize(string input)
+        {
+            using var sr = new StringReader(input);
+            using var tr = new JsonTextReader(sr);
+            return jsonSerializer.Deserialize(tr);
+        }
+
+        private static object? Deserialize(ReadOnlySpan<byte> bytes)
+        {
+            using var ms = new MemoryStream(bytes.ToArray());
+            using var sr = new StreamReader(ms);
+            using var reader = new JsonTextReader(sr);
+            return jsonSerializer.Deserialize(reader);
+        }
+    }
+}

Src/Newtonsoft.Json.FuzzTests/Newtonsoft.Json.FuzzTests.csproj

@@ -0,0 +1,21 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFrameworks>net6.0</TargetFrameworks>
+    <LangVersion>9.0</LangVersion>
+    <VersionPrefix>1.0</VersionPrefix>
+    <Authors>James Newton-King</Authors>
+    <Company>Newtonsoft</Company>
+    <Product>Json.NET</Product>
+    <NeutralLanguage>en-US</NeutralLanguage>
+    <Copyright>Copyright © James Newton-King 2008</Copyright>
+    <AssemblyName>Newtonsoft.Json.FuzzTests</AssemblyName>
+    <RootNamespace>Newtonsoft.Json.FuzzTests</RootNamespace>
+    <IsPackable>false</IsPackable>
+    <Nullable>enable</Nullable>
+    <!-- Disabled because SourceLink isn't referenced to calculate paths -->
+    <DeterministicSourcePaths>false</DeterministicSourcePaths>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\Newtonsoft.Json\Newtonsoft.Json.csproj" />
+  </ItemGroup>
+</Project>