/*

 * xml.c: a libFuzzer target to test several XML parser interfaces.

 *

 * See Copyright for the status of this software.

 */

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <libxml/catalog.h>

#include <libxml/parser.h>

#include <libxml/tree.h>

#include <libxml/xmlerror.h>

#include <libxml/xmlsave.h>

#include "fuzz.h"

int

LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED,

                     char ***argv ATTRIBUTE_UNUSED) {

    xmlFuzzMemSetup();

    xmlInitParser();

#ifdef LIBXML_CATALOG_ENABLED

    xmlInitializeCatalog();

    xmlCatalogSetDefaults(XML_CATA_ALLOW_NONE);

#endif

    return 0;

}

int

LLVMFuzzerTestOneInput(const char *data, size_t size) {

    xmlParserCtxtPtr ctxt;

    xmlDocPtr doc;

    const char *docBuffer, *docUrl;

    size_t failurePos, docSize, maxChunkSize;

    int opts;

    int errorCode;

#ifdef LIBXML_OUTPUT_ENABLED

    xmlBufferPtr outbuf = NULL;

    const char *saveEncoding;

    int saveOpts;

#endif

    xmlFuzzDataInit(data, size);

    opts = (int) xmlFuzzReadInt(4);

    /*

     * Disable options that are known to cause timeouts

     */

    opts &= ~XML_PARSE_DTDVALID &

            ~XML_PARSE_SAX1;

    failurePos = xmlFuzzReadInt(4) % (size + 100);

    maxChunkSize = xmlFuzzReadInt(4) % (size + size / 8 + 1);

    if (maxChunkSize == 0)

        maxChunkSize = 1;

#ifdef LIBXML_OUTPUT_ENABLED

    /* TODO: Take from fuzz data */

    saveOpts = 0;

    saveEncoding = NULL;

#endif

    xmlFuzzReadEntities();

    docBuffer = xmlFuzzMainEntity(&docSize);

    docUrl = xmlFuzzMainUrl();

    if (docBuffer == NULL)

        goto exit;

    /* Pull parser */

    xmlFuzzInjectFailure(failurePos);

    ctxt = xmlNewParserCtxt();

    if (ctxt == NULL) {

        errorCode = XML_ERR_NO_MEMORY;

    } else {

        xmlCtxtSetErrorHandler(ctxt, xmlFuzzSErrorFunc, NULL);

        xmlCtxtSetResourceLoader(ctxt, xmlFuzzResourceLoader, NULL);

        doc = xmlCtxtReadMemory(ctxt, docBuffer, docSize, docUrl, NULL, opts);

        errorCode = ctxt->errNo;

        xmlFuzzCheckFailureReport("xmlCtxtReadMemory",

                doc == NULL && errorCode == XML_ERR_NO_MEMORY,

                doc == NULL && errorCode == XML_IO_EIO);

        if (doc != NULL) {

#ifdef LIBXML_OUTPUT_ENABLED

            xmlSaveCtxtPtr save;

            outbuf = xmlBufferCreate();

            /* Also test the serializer. */

            save = xmlSaveToBuffer(outbuf, saveEncoding, saveOpts);

            if (save == NULL) {

                xmlBufferFree(outbuf);

                outbuf = NULL;

            } else {

                int saveErr;

                xmlSaveDoc(save, doc);

                saveErr = xmlSaveFinish(save);

                xmlFuzzCheckFailureReport("xmlSaveToBuffer",

                                          saveErr == XML_ERR_NO_MEMORY,

                                          saveErr == XML_IO_EIO);

                if (saveErr != XML_ERR_OK) {

                    xmlBufferFree(outbuf);

                    outbuf = NULL;

                }

            }

#endif

            xmlFreeDoc(doc);

        }

        xmlFreeParserCtxt(ctxt);

    }

    /* Push parser */

#ifdef LIBXML_PUSH_ENABLED

    xmlFuzzInjectFailure(failurePos);

    /*

     * FIXME: xmlCreatePushParserCtxt can still report OOM errors

     * to stderr.

     */

    xmlSetGenericErrorFunc(NULL, xmlFuzzErrorFunc);

    ctxt = xmlCreatePushParserCtxt(NULL, NULL, NULL, 0, docUrl);

    xmlSetGenericErrorFunc(NULL, NULL);

    if (ctxt != NULL) {

        size_t consumed;

        int errorCodePush, numChunks, maxChunks;

        xmlCtxtSetErrorHandler(ctxt, xmlFuzzSErrorFunc, NULL);

        xmlCtxtSetResourceLoader(ctxt, xmlFuzzResourceLoader, NULL);

        xmlCtxtUseOptions(ctxt, opts);

        consumed = 0;

        numChunks = 0;

        maxChunks = 50 + docSize / 100;

        while (numChunks == 0 ||

               (consumed < docSize && numChunks < maxChunks)) {

            size_t chunkSize;

            int terminate;

            numChunks += 1;

            chunkSize = docSize - consumed;

            if (numChunks < maxChunks && chunkSize > maxChunkSize) {

                chunkSize = maxChunkSize;

                terminate = 0;

            } else {

                terminate = 1;

            }

            xmlParseChunk(ctxt, docBuffer + consumed, chunkSize, terminate);

            consumed += chunkSize;

        }

        errorCodePush = ctxt->errNo;

        xmlFuzzCheckFailureReport("xmlParseChunk",

                                  errorCodePush == XML_ERR_NO_MEMORY,

                                  errorCodePush == XML_IO_EIO);

        doc = ctxt->myDoc;

        /*

         * Push and pull parser differ in when exactly they

         * stop parsing, and the error code is the *last* error

         * reported, so we can't check whether the codes match.

         */

        if (errorCode != XML_ERR_NO_MEMORY &&

            errorCode != XML_IO_EIO &&

            errorCodePush != XML_ERR_NO_MEMORY &&

            errorCodePush != XML_IO_EIO &&

            (errorCode == XML_ERR_OK) != (errorCodePush == XML_ERR_OK)) {

            fprintf(stderr, "pull/push parser error mismatch: %d != %d\n",

                    errorCode, errorCodePush);

#if 0

            FILE *f = fopen("c.xml", "wb");

            fwrite(docBuffer, docSize, 1, f);

            fclose(f);

#endif

            abort();

        }

#ifdef LIBXML_OUTPUT_ENABLED

        /*

         * Verify that pull and push parser produce the same result.

         *

         * The NOBLANKS option doesn't work reliably in push mode.

         */

        if ((opts & XML_PARSE_NOBLANKS) == 0 &&

            errorCode == XML_ERR_OK &&

            errorCodePush == XML_ERR_OK &&

            outbuf != NULL) {

            xmlBufferPtr outbufPush;

            xmlSaveCtxtPtr save;

            outbufPush = xmlBufferCreate();

            save = xmlSaveToBuffer(outbufPush, saveEncoding, saveOpts);

            if (save != NULL) {

                int saveErr;

                xmlSaveDoc(save, doc);

                saveErr = xmlSaveFinish(save);

                if (saveErr == XML_ERR_OK) {

                    int outbufSize = xmlBufferLength(outbuf);

                    if (outbufSize != xmlBufferLength(outbufPush) ||

                        memcmp(xmlBufferContent(outbuf),

                               xmlBufferContent(outbufPush),

                               outbufSize) != 0) {

                        fprintf(stderr, "pull/push parser roundtrip "

                                "mismatch\n");

#if 0

                        FILE *f = fopen("c.xml", "wb");

                        fwrite(docBuffer, docSize, 1, f);

                        fclose(f);

                        fprintf(stderr, "opts: %X\n", opts);

                        fprintf(stderr, "---\n%s\n---\n%s\n---\n",

                                xmlBufferContent(outbuf),

                                xmlBufferContent(outbufPush));

#endif

                        abort();

                    }

                }

            }

            xmlBufferFree(outbufPush);

        }

#endif

        xmlFreeDoc(doc);

        xmlFreeParserCtxt(ctxt);

    }

#endif

exit:

#ifdef LIBXML_OUTPUT_ENABLED

    xmlBufferFree(outbuf);

#endif

    xmlFuzzInjectFailure(0);

    xmlFuzzDataCleanup();

    xmlResetLastError();

    return(0);

}

size_t

LLVMFuzzerCustomMutator(char *data, size_t size, size_t maxSize,

                        unsigned seed) {

    static const xmlFuzzChunkDesc chunks[] = {

        { 4, XML_FUZZ_PROB_ONE / 10 }, /* opts */

        { 4, XML_FUZZ_PROB_ONE / 10 }, /* failurePos */

        { 4, XML_FUZZ_PROB_ONE / 10 }, /* maxChunkSize */

        { 0, 0 }

    };

    return xmlFuzzMutateChunks(chunks, data, size, maxSize, seed,

                               LLVMFuzzerMutate);

}