/src/libxml2/fuzz/xinclude.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * xinclude.c: a libFuzzer target to test the XInclude engine. |
3 | | * |
4 | | * See Copyright for the status of this software. |
5 | | */ |
6 | | |
7 | | #include <libxml/catalog.h> |
8 | | #include <libxml/parser.h> |
9 | | #include <libxml/tree.h> |
10 | | #include <libxml/xmlerror.h> |
11 | | #include <libxml/xinclude.h> |
12 | | #include "fuzz.h" |
13 | | |
14 | | int |
15 | | LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED, |
16 | 1 | char ***argv ATTRIBUTE_UNUSED) { |
17 | 1 | xmlFuzzMemSetup(); |
18 | 1 | xmlInitParser(); |
19 | 1 | #ifdef LIBXML_CATALOG_ENABLED |
20 | 1 | xmlInitializeCatalog(); |
21 | 1 | xmlCatalogSetDefaults(XML_CATA_ALLOW_NONE); |
22 | 1 | #endif |
23 | 1 | xmlSetGenericErrorFunc(NULL, xmlFuzzErrorFunc); |
24 | | |
25 | 1 | return 0; |
26 | 1 | } |
27 | | |
28 | | int |
29 | 0 | LLVMFuzzerTestOneInput(const char *data, size_t size) { |
30 | 0 | xmlParserCtxtPtr ctxt; |
31 | 0 | xmlDocPtr doc; |
32 | 0 | const char *docBuffer, *docUrl; |
33 | 0 | size_t failurePos, docSize; |
34 | 0 | int opts; |
35 | |
|
36 | 0 | xmlFuzzDataInit(data, size); |
37 | 0 | opts = (int) xmlFuzzReadInt(4); |
38 | 0 | opts &= ~XML_PARSE_DTDVALID & |
39 | 0 | ~XML_PARSE_SAX1; |
40 | 0 | failurePos = xmlFuzzReadInt(4) % (size + 100); |
41 | |
|
42 | 0 | xmlFuzzReadEntities(); |
43 | 0 | docBuffer = xmlFuzzMainEntity(&docSize); |
44 | 0 | docUrl = xmlFuzzMainUrl(); |
45 | 0 | if (docBuffer == NULL) |
46 | 0 | goto exit; |
47 | | |
48 | | /* Pull parser */ |
49 | | |
50 | 0 | xmlFuzzInjectFailure(failurePos); |
51 | 0 | ctxt = xmlNewParserCtxt(); |
52 | 0 | if (ctxt != NULL) { |
53 | 0 | xmlXIncludeCtxtPtr xinc; |
54 | 0 | xmlDocPtr copy; |
55 | |
|
56 | 0 | xmlCtxtSetResourceLoader(ctxt, xmlFuzzResourceLoader, NULL); |
57 | |
|
58 | 0 | doc = xmlCtxtReadMemory(ctxt, docBuffer, docSize, docUrl, NULL, opts); |
59 | 0 | xmlFuzzCheckFailureReport("xmlCtxtReadMemory", |
60 | 0 | doc == NULL && ctxt->errNo == XML_ERR_NO_MEMORY, |
61 | 0 | doc == NULL && ctxt->errNo == XML_IO_EIO); |
62 | |
|
63 | 0 | xinc = xmlXIncludeNewContext(doc); |
64 | 0 | xmlXIncludeSetResourceLoader(xinc, xmlFuzzResourceLoader, NULL); |
65 | 0 | xmlXIncludeSetFlags(xinc, opts); |
66 | 0 | xmlXIncludeProcessNode(xinc, (xmlNodePtr) doc); |
67 | 0 | if (doc != NULL) { |
68 | 0 | xmlFuzzCheckFailureReport("xmlXIncludeProcessNode", |
69 | 0 | xinc == NULL || |
70 | 0 | xmlXIncludeGetLastError(xinc) == XML_ERR_NO_MEMORY, |
71 | 0 | xinc != NULL && |
72 | 0 | xmlXIncludeGetLastError(xinc) == XML_IO_EIO); |
73 | 0 | } |
74 | 0 | xmlXIncludeFreeContext(xinc); |
75 | |
|
76 | 0 | xmlFuzzResetFailure(); |
77 | 0 | copy = xmlCopyDoc(doc, 1); |
78 | 0 | if (doc != NULL) |
79 | 0 | xmlFuzzCheckFailureReport("xmlCopyNode", copy == NULL, 0); |
80 | 0 | xmlFreeDoc(copy); |
81 | |
|
82 | 0 | xmlFreeDoc(doc); |
83 | 0 | xmlFreeParserCtxt(ctxt); |
84 | 0 | } |
85 | |
|
86 | 0 | exit: |
87 | 0 | xmlFuzzInjectFailure(0); |
88 | 0 | xmlFuzzDataCleanup(); |
89 | 0 | xmlResetLastError(); |
90 | 0 | return(0); |
91 | 0 | } |
92 | | |
93 | | size_t |
94 | | LLVMFuzzerCustomMutator(char *data, size_t size, size_t maxSize, |
95 | 0 | unsigned seed) { |
96 | 0 | static const xmlFuzzChunkDesc chunks[] = { |
97 | 0 | { 4, XML_FUZZ_PROB_ONE / 10 }, /* opts */ |
98 | 0 | { 4, XML_FUZZ_PROB_ONE / 10 }, /* failurePos */ |
99 | 0 | { 0, 0 } |
100 | 0 | }; |
101 | |
|
102 | 0 | return xmlFuzzMutateChunks(chunks, data, size, maxSize, seed, |
103 | 0 | LLVMFuzzerMutate); |
104 | 0 | } |
105 | | |