Coverage Report

Created: 2025-07-01 06:26

/src/libxml2/fuzz/xinclude.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * xinclude.c: a libFuzzer target to test the XInclude engine.
3
 *
4
 * See Copyright for the status of this software.
5
 */
6
7
#include <libxml/catalog.h>
8
#include <libxml/parser.h>
9
#include <libxml/tree.h>
10
#include <libxml/xmlerror.h>
11
#include <libxml/xinclude.h>
12
#include "fuzz.h"
13
14
int
15
LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED,
16
1
                     char ***argv ATTRIBUTE_UNUSED) {
17
1
    xmlFuzzMemSetup();
18
1
    xmlInitParser();
19
1
#ifdef LIBXML_CATALOG_ENABLED
20
1
    xmlInitializeCatalog();
21
1
    xmlCatalogSetDefaults(XML_CATA_ALLOW_NONE);
22
1
#endif
23
1
    xmlSetGenericErrorFunc(NULL, xmlFuzzErrorFunc);
24
25
1
    return 0;
26
1
}
27
28
int
29
0
LLVMFuzzerTestOneInput(const char *data, size_t size) {
30
0
    xmlParserCtxtPtr ctxt;
31
0
    xmlDocPtr doc;
32
0
    const char *docBuffer, *docUrl;
33
0
    size_t failurePos, docSize;
34
0
    int opts;
35
36
0
    xmlFuzzDataInit(data, size);
37
0
    opts = (int) xmlFuzzReadInt(4);
38
0
    opts &= ~XML_PARSE_DTDVALID &
39
0
            ~XML_PARSE_SAX1;
40
0
    failurePos = xmlFuzzReadInt(4) % (size + 100);
41
42
0
    xmlFuzzReadEntities();
43
0
    docBuffer = xmlFuzzMainEntity(&docSize);
44
0
    docUrl = xmlFuzzMainUrl();
45
0
    if (docBuffer == NULL)
46
0
        goto exit;
47
48
    /* Pull parser */
49
50
0
    xmlFuzzInjectFailure(failurePos);
51
0
    ctxt = xmlNewParserCtxt();
52
0
    if (ctxt != NULL) {
53
0
        xmlXIncludeCtxtPtr xinc;
54
0
        xmlDocPtr copy;
55
56
0
        xmlCtxtSetResourceLoader(ctxt, xmlFuzzResourceLoader, NULL);
57
58
0
        doc = xmlCtxtReadMemory(ctxt, docBuffer, docSize, docUrl, NULL, opts);
59
0
        xmlFuzzCheckFailureReport("xmlCtxtReadMemory",
60
0
                doc == NULL && ctxt->errNo == XML_ERR_NO_MEMORY,
61
0
                doc == NULL && ctxt->errNo == XML_IO_EIO);
62
63
0
        xinc = xmlXIncludeNewContext(doc);
64
0
        xmlXIncludeSetResourceLoader(xinc, xmlFuzzResourceLoader, NULL);
65
0
        xmlXIncludeSetFlags(xinc, opts);
66
0
        xmlXIncludeProcessNode(xinc, (xmlNodePtr) doc);
67
0
        if (doc != NULL) {
68
0
            xmlFuzzCheckFailureReport("xmlXIncludeProcessNode",
69
0
                    xinc == NULL ||
70
0
                    xmlXIncludeGetLastError(xinc) == XML_ERR_NO_MEMORY,
71
0
                    xinc != NULL &&
72
0
                    xmlXIncludeGetLastError(xinc) == XML_IO_EIO);
73
0
        }
74
0
        xmlXIncludeFreeContext(xinc);
75
76
0
        xmlFuzzResetFailure();
77
0
        copy = xmlCopyDoc(doc, 1);
78
0
        if (doc != NULL)
79
0
            xmlFuzzCheckFailureReport("xmlCopyNode", copy == NULL, 0);
80
0
        xmlFreeDoc(copy);
81
82
0
        xmlFreeDoc(doc);
83
0
        xmlFreeParserCtxt(ctxt);
84
0
    }
85
86
0
exit:
87
0
    xmlFuzzInjectFailure(0);
88
0
    xmlFuzzDataCleanup();
89
0
    xmlResetLastError();
90
0
    return(0);
91
0
}
92
93
size_t
94
LLVMFuzzerCustomMutator(char *data, size_t size, size_t maxSize,
95
0
                        unsigned seed) {
96
0
    static const xmlFuzzChunkDesc chunks[] = {
97
0
        { 4, XML_FUZZ_PROB_ONE / 10 }, /* opts */
98
0
        { 4, XML_FUZZ_PROB_ONE / 10 }, /* failurePos */
99
0
        { 0, 0 }
100
0
    };
101
102
0
    return xmlFuzzMutateChunks(chunks, data, size, maxSize, seed,
103
0
                               LLVMFuzzerMutate);
104
0
}
105