/src/libxml2/fuzz/reader.c

Source
/*
 * reader.c: a libFuzzer target to test the XML Reader API.
 *
 * See Copyright for the status of this software.
 */

#include <libxml/catalog.h>
#include <libxml/parser.h>
#include <libxml/tree.h>
#include <libxml/xmlerror.h>
#include <libxml/xmlreader.h>
#include <libxml/xmlsave.h>
#include "fuzz.h"

#include <string.h>

#if 0
  #define DEBUG
#endif

typedef enum {
    OP_READ = 1,
    OP_READ_INNER_XML,
    OP_READ_OUTER_XML,
    OP_READ_STRING,
    OP_READ_ATTRIBUTE_VALUE,
    OP_ATTRIBUTE_COUNT,
    OP_DEPTH,
    OP_HAS_ATTRIBUTES,
    OP_HAS_VALUE,
    OP_IS_DEFAULT,
    OP_IS_EMPTY_ELEMENT,
    OP_NODE_TYPE,
    OP_QUOTE_CHAR,
    OP_READ_STATE,
    OP_IS_NAMESPACE_DECL,
    OP_CONST_BASE_URI,
    OP_CONST_LOCAL_NAME,
    OP_CONST_NAME,
    OP_CONST_NAMESPACE_URI,
    OP_CONST_PREFIX,
    OP_CONST_XML_LANG,
    OP_CONST_VALUE,
    OP_BASE_URI,
    OP_LOCAL_NAME,
    OP_NAME,
    OP_NAMESPACE_URI,
    OP_PREFIX,
    OP_XML_LANG,
    OP_VALUE,
    OP_CLOSE,
    OP_GET_ATTRIBUTE_NO,
    OP_GET_ATTRIBUTE,
    OP_GET_ATTRIBUTE_NS,
    OP_GET_REMAINDER,
    OP_LOOKUP_NAMESPACE,
    OP_MOVE_TO_ATTRIBUTE_NO,
    OP_MOVE_TO_ATTRIBUTE,
    OP_MOVE_TO_ATTRIBUTE_NS,
    OP_MOVE_TO_FIRST_ATTRIBUTE,
    OP_MOVE_TO_NEXT_ATTRIBUTE,
    OP_MOVE_TO_ELEMENT,
    OP_NORMALIZATION,
    OP_CONST_ENCODING,
    OP_GET_PARSER_PROP,
    OP_CURRENT_NODE,
    OP_GET_PARSER_LINE_NUMBER,
    OP_GET_PARSER_COLUMN_NUMBER,
    OP_PRESERVE,
    OP_CURRENT_DOC,
    OP_EXPAND,
    OP_NEXT,
    OP_NEXT_SIBLING,
    OP_IS_VALID,
    OP_CONST_XML_VERSION,
    OP_STANDALONE,
    OP_BYTE_CONSUMED,

    OP_MAX
} opType;

static void
startOp(const char *name) {
    (void) name;
#ifdef DEBUG
    fprintf(stderr, "%s\n", name);
#endif
}

int
LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED,
                     char ***argv ATTRIBUTE_UNUSED) {
    xmlFuzzMemSetup();
    xmlInitParser();
#ifdef LIBXML_CATALOG_ENABLED
    xmlInitializeCatalog();
    xmlCatalogSetDefaults(XML_CATA_ALLOW_NONE);
#endif

    return 0;
}

int
LLVMFuzzerTestOneInput(const char *data, size_t size) {
    xmlTextReaderPtr reader;
    xmlDocPtr doc = NULL;
    const xmlError *error;
    const char *docBuffer;
    const unsigned char *program;
    size_t failurePos, docSize, programSize, i;
    size_t totalStringSize = 0;
    int opts;
    int oomReport = 0;

    xmlFuzzDataInit(data, size);
    opts = (int) xmlFuzzReadInt(4);
    failurePos = xmlFuzzReadInt(4) % (size + 100);

    program = (const unsigned char *) xmlFuzzReadString(&programSize);
    if (programSize > 1000)
        programSize = 1000;

    xmlFuzzReadEntities();
    docBuffer = xmlFuzzMainEntity(&docSize);
    if (docBuffer == NULL)
        goto exit;

#ifdef DEBUG
    fprintf(stderr, "Input document (%d bytes):\n", (int) docSize);
    for (i = 0; (size_t) i < docSize; i++) {
        int c = (unsigned char) docBuffer[i];

        if ((c == '\n' || (c >= 0x20 && c <= 0x7E)))
            putc(c, stderr);
        else
            fprintf(stderr, "\\x%02X", c);
    }
    fprintf(stderr, "\nEOF\n");
#endif

    xmlFuzzInjectFailure(failurePos);
    reader = xmlReaderForMemory(docBuffer, docSize, NULL, NULL, opts);
    if (reader == NULL)
        goto exit;

    xmlTextReaderSetStructuredErrorHandler(reader, xmlFuzzSErrorFunc, NULL);
    xmlTextReaderSetResourceLoader(reader, xmlFuzzResourceLoader, NULL);

    i = 0;
    while (i < programSize) {
        int op = program[i++];

#define READ_BYTE() (i < programSize ? program[i++] : 0)
#define FREE_STRING(str) \
    do { \
        if (str != NULL) { \
            totalStringSize += strlen((char *) str); \
            xmlFree(str); \
        } \
    } while (0)

        switch (op & 0x3F) {
            case OP_READ:
            default:
                startOp("Read");
                xmlTextReaderRead(reader);
                break;

            case OP_READ_INNER_XML: {
                xmlChar *result;

                startOp("ReadInnerXml");
                result = xmlTextReaderReadInnerXml(reader);
                FREE_STRING(result);
                break;
            }

            case OP_READ_OUTER_XML: {
                xmlChar *result;

                startOp("ReadOuterXml");
                result = xmlTextReaderReadOuterXml(reader);
                FREE_STRING(result);
                break;
            }

            case OP_READ_STRING: {
                xmlChar *result;

                startOp("ReadString");
                result = xmlTextReaderReadString(reader);
                FREE_STRING(result);
                break;
            }

            case OP_READ_ATTRIBUTE_VALUE:
                startOp("ReadAttributeValue");
                xmlTextReaderReadAttributeValue(reader);
                break;

            case OP_ATTRIBUTE_COUNT:
                startOp("AttributeCount");
                xmlTextReaderAttributeCount(reader);
                break;

            case OP_DEPTH:
                startOp("Depth");
                xmlTextReaderDepth(reader);
                break;

            case OP_HAS_ATTRIBUTES:
                startOp("HasAttributes");
                xmlTextReaderHasAttributes(reader);
                break;

            case OP_HAS_VALUE:
                startOp("HasValue");
                xmlTextReaderHasValue(reader);
                break;

            case OP_IS_DEFAULT:
                startOp("IsDefault");
                xmlTextReaderIsDefault(reader);
                break;

            case OP_IS_EMPTY_ELEMENT:
                startOp("IsEmptyElement");
                xmlTextReaderIsEmptyElement(reader);
                break;

            case OP_NODE_TYPE:
                startOp("NodeType");
                xmlTextReaderNodeType(reader);
                break;

            case OP_QUOTE_CHAR:
                startOp("QuoteChar");
                xmlTextReaderQuoteChar(reader);
                break;

            case OP_READ_STATE:
                startOp("ReadState");
                xmlTextReaderReadState(reader);
                break;

            case OP_IS_NAMESPACE_DECL:
                startOp("IsNamespaceDecl");
                xmlTextReaderIsNamespaceDecl(reader);
                break;

            case OP_CONST_BASE_URI:
                startOp("ConstBaseUri");
                xmlTextReaderConstBaseUri(reader);
                break;

            case OP_CONST_LOCAL_NAME:
                startOp("ConstLocalName");
                xmlTextReaderConstLocalName(reader);
                break;

            case OP_CONST_NAME:
                startOp("ConstName");
                xmlTextReaderConstName(reader);
                break;

            case OP_CONST_NAMESPACE_URI:
                startOp("ConstNamespaceUri");
                xmlTextReaderConstNamespaceUri(reader);
                break;

            case OP_CONST_PREFIX:
                startOp("ConstPrefix");
                xmlTextReaderConstPrefix(reader);
                break;

            case OP_CONST_XML_LANG:
                startOp("ConstXmlLang");
                xmlTextReaderConstXmlLang(reader);
                oomReport = -1;
                break;

            case OP_CONST_VALUE:
                startOp("ConstValue");
                xmlTextReaderConstValue(reader);
                break;

            case OP_BASE_URI: {
                xmlChar *result;

                startOp("BaseUri");
                result = xmlTextReaderBaseUri(reader);
                FREE_STRING(result);
                break;
            }

            case OP_LOCAL_NAME: {
                xmlChar *result;

                startOp("LocalName");
                result = xmlTextReaderLocalName(reader);
                FREE_STRING(result);
                break;
            }

            case OP_NAME: {
                xmlChar *result;

                startOp("Name");
                result = xmlTextReaderName(reader);
                FREE_STRING(result);
                break;
            }

            case OP_NAMESPACE_URI: {
                xmlChar *result;

                startOp("NamespaceUri");
                result = xmlTextReaderNamespaceUri(reader);
                FREE_STRING(result);
                break;
            }

            case OP_PREFIX: {
                xmlChar *result;

                startOp("Prefix");
                result = xmlTextReaderPrefix(reader);
                FREE_STRING(result);
                break;
            }

            case OP_XML_LANG: {
                xmlChar *result;

                startOp("XmlLang");
                result = xmlTextReaderXmlLang(reader);
                oomReport = -1;
                FREE_STRING(result);
                break;
            }

            case OP_VALUE: {
                xmlChar *result;

                startOp("Value");
                result = xmlTextReaderValue(reader);
                FREE_STRING(result);
                break;
            }

            case OP_CLOSE:
                startOp("Close");
                if (doc == NULL)
                    doc = xmlTextReaderCurrentDoc(reader);
                xmlTextReaderClose(reader);
                break;

            case OP_GET_ATTRIBUTE_NO: {
                xmlChar *result;
                int no = READ_BYTE();

                startOp("GetAttributeNo");
                result = xmlTextReaderGetAttributeNo(reader, no);
                FREE_STRING(result);
                break;
            }

            case OP_GET_ATTRIBUTE: {
                const xmlChar *name = xmlTextReaderConstName(reader);
                xmlChar *result;

                startOp("GetAttribute");
                result = xmlTextReaderGetAttribute(reader, name);
                FREE_STRING(result);
                break;
            }

            case OP_GET_ATTRIBUTE_NS: {
                const xmlChar *localName, *namespaceUri;
                xmlChar *result;

                startOp("GetAttributeNs");
                localName = xmlTextReaderConstLocalName(reader);
                namespaceUri = xmlTextReaderConstNamespaceUri(reader);
                result = xmlTextReaderGetAttributeNs(reader, localName,
                                                     namespaceUri);
                FREE_STRING(result);
                break;
            }

            case OP_GET_REMAINDER:
                startOp("GetRemainder");
                if (doc == NULL)
                    doc = xmlTextReaderCurrentDoc(reader);
                xmlFreeParserInputBuffer(xmlTextReaderGetRemainder(reader));
                break;

            case OP_LOOKUP_NAMESPACE: {
                const xmlChar *prefix = xmlTextReaderConstPrefix(reader);
                xmlChar *result;

                startOp("LookupNamespace");
                result = xmlTextReaderLookupNamespace(reader, prefix);
                FREE_STRING(result);
                break;
            }

            case OP_MOVE_TO_ATTRIBUTE_NO: {
                int no = READ_BYTE();

                startOp("MoveToAttributeNo");
                xmlTextReaderMoveToAttributeNo(reader, no);
                break;
            }

            case OP_MOVE_TO_ATTRIBUTE: {
                const xmlChar *name = xmlTextReaderConstName(reader);

                startOp("MoveToAttribute");
                xmlTextReaderMoveToAttribute(reader, name);
                break;
            }

            case OP_MOVE_TO_ATTRIBUTE_NS: {
                const xmlChar *localName, *namespaceUri;

                startOp("MoveToAttributeNs");
                localName = xmlTextReaderConstLocalName(reader);
                namespaceUri = xmlTextReaderConstNamespaceUri(reader);
                xmlTextReaderMoveToAttributeNs(reader, localName,
                                               namespaceUri);
                break;
            }

            case OP_MOVE_TO_FIRST_ATTRIBUTE:
                startOp("MoveToFirstAttribute");
                xmlTextReaderMoveToFirstAttribute(reader);
                break;

            case OP_MOVE_TO_NEXT_ATTRIBUTE:
                startOp("MoveToNextAttribute");
                xmlTextReaderMoveToNextAttribute(reader);
                break;

            case OP_MOVE_TO_ELEMENT:
                startOp("MoveToElement");
                xmlTextReaderMoveToElement(reader);
                break;

            case OP_NORMALIZATION:
                startOp("Normalization");
                xmlTextReaderNormalization(reader);
                break;

            case OP_CONST_ENCODING:
                startOp("ConstEncoding");
                xmlTextReaderConstEncoding(reader);
                break;

            case OP_GET_PARSER_PROP: {
                int prop = READ_BYTE();

                startOp("GetParserProp");
                xmlTextReaderGetParserProp(reader, prop);
                break;
            }

            case OP_CURRENT_NODE:
                startOp("CurrentNode");
                xmlTextReaderCurrentNode(reader);
                break;

            case OP_GET_PARSER_LINE_NUMBER:
                startOp("GetParserLineNumber");
                xmlTextReaderGetParserLineNumber(reader);
                break;

            case OP_GET_PARSER_COLUMN_NUMBER:
                startOp("GetParserColumnNumber");
                xmlTextReaderGetParserColumnNumber(reader);
                break;

            case OP_PRESERVE:
                startOp("Preserve");
                xmlTextReaderPreserve(reader);
                break;

            case OP_CURRENT_DOC: {
                xmlDocPtr result;

                startOp("CurrentDoc");
                result = xmlTextReaderCurrentDoc(reader);
                if (doc == NULL)
                    doc = result;
                break;
            }

            case OP_EXPAND:
                startOp("Expand");
                xmlTextReaderExpand(reader);
                break;

            case OP_NEXT:
                startOp("Next");
                xmlTextReaderNext(reader);
                break;

            case OP_NEXT_SIBLING:
                startOp("NextSibling");
                xmlTextReaderNextSibling(reader);
                break;

            case OP_IS_VALID:
                startOp("IsValid");
                xmlTextReaderIsValid(reader);
                break;

            case OP_CONST_XML_VERSION:
                startOp("ConstXmlVersion");
                xmlTextReaderConstXmlVersion(reader);
                break;

            case OP_STANDALONE:
                startOp("Standalone");
                xmlTextReaderStandalone(reader);
                break;

            case OP_BYTE_CONSUMED:
                startOp("ByteConsumed");
                xmlTextReaderByteConsumed(reader);
                oomReport = -1;
                break;
        }

        if (totalStringSize > docSize * 2)
            break;
    }

    error = xmlTextReaderGetLastError(reader);
    if (error->code == XML_ERR_NO_MEMORY)
        oomReport = 1;
    xmlFuzzCheckFailureReport("reader", oomReport, error->code == XML_IO_EIO);

    xmlFreeTextReader(reader);

    if (doc != NULL)
        xmlFreeDoc(doc);

exit:
    xmlFuzzInjectFailure(0);
    xmlFuzzDataCleanup();
    xmlResetLastError();
    return(0);
}

size_t
LLVMFuzzerCustomMutator(char *data, size_t size, size_t maxSize,
                        unsigned seed) {
    static const xmlFuzzChunkDesc chunks[] = {
        { 4, XML_FUZZ_PROB_ONE / 10 }, /* opts */
        { 4, XML_FUZZ_PROB_ONE / 10 }, /* failurePos */
        { 0, 0 }
    };

    return xmlFuzzMutateChunks(chunks, data, size, maxSize, seed,
                               LLVMFuzzerMutate);
}


Coverage Report

Created: 2026-02-26 06:58

Line	Count	Source
1		/*
2		* reader.c: a libFuzzer target to test the XML Reader API.
3		*
4		* See Copyright for the status of this software.
5		*/
6
7		#include <libxml/catalog.h>
8		#include <libxml/parser.h>
9		#include <libxml/tree.h>
10		#include <libxml/xmlerror.h>
11		#include <libxml/xmlreader.h>
12		#include <libxml/xmlsave.h>
13		#include "fuzz.h"
14
15		#include <string.h>
16
17		#if 0
18		#define DEBUG
19		#endif
20
21		typedef enum {
22		OP_READ = 1,
23		OP_READ_INNER_XML,
24		OP_READ_OUTER_XML,
25		OP_READ_STRING,
26		OP_READ_ATTRIBUTE_VALUE,
27		OP_ATTRIBUTE_COUNT,
28		OP_DEPTH,
29		OP_HAS_ATTRIBUTES,
30		OP_HAS_VALUE,
31		OP_IS_DEFAULT,
32		OP_IS_EMPTY_ELEMENT,
33		OP_NODE_TYPE,
34		OP_QUOTE_CHAR,
35		OP_READ_STATE,
36		OP_IS_NAMESPACE_DECL,
37		OP_CONST_BASE_URI,
38		OP_CONST_LOCAL_NAME,
39		OP_CONST_NAME,
40		OP_CONST_NAMESPACE_URI,
41		OP_CONST_PREFIX,
42		OP_CONST_XML_LANG,
43		OP_CONST_VALUE,
44		OP_BASE_URI,
45		OP_LOCAL_NAME,
46		OP_NAME,
47		OP_NAMESPACE_URI,
48		OP_PREFIX,
49		OP_XML_LANG,
50		OP_VALUE,
51		OP_CLOSE,
52		OP_GET_ATTRIBUTE_NO,
53		OP_GET_ATTRIBUTE,
54		OP_GET_ATTRIBUTE_NS,
55		OP_GET_REMAINDER,
56		OP_LOOKUP_NAMESPACE,
57		OP_MOVE_TO_ATTRIBUTE_NO,
58		OP_MOVE_TO_ATTRIBUTE,
59		OP_MOVE_TO_ATTRIBUTE_NS,
60		OP_MOVE_TO_FIRST_ATTRIBUTE,
61		OP_MOVE_TO_NEXT_ATTRIBUTE,
62		OP_MOVE_TO_ELEMENT,
63		OP_NORMALIZATION,
64		OP_CONST_ENCODING,
65		OP_GET_PARSER_PROP,
66		OP_CURRENT_NODE,
67		OP_GET_PARSER_LINE_NUMBER,
68		OP_GET_PARSER_COLUMN_NUMBER,
69		OP_PRESERVE,
70		OP_CURRENT_DOC,
71		OP_EXPAND,
72		OP_NEXT,
73		OP_NEXT_SIBLING,
74		OP_IS_VALID,
75		OP_CONST_XML_VERSION,
76		OP_STANDALONE,
77		OP_BYTE_CONSUMED,
78
79		OP_MAX
80		} opType;
81
82		static void
83	733k	startOp(const char *name) {
84	733k	(void) name;
85		#ifdef DEBUG
86		fprintf(stderr, "%s\n", name);
87		#endif
88	733k	}
89
90		int
91		LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED,
92	20	char ***argv ATTRIBUTE_UNUSED) {
93	20	xmlFuzzMemSetup();
94	20	xmlInitParser();
95	20	#ifdef LIBXML_CATALOG_ENABLED
96	20	xmlInitializeCatalog();
97	20	xmlCatalogSetDefaults(XML_CATA_ALLOW_NONE);
98	20	#endif
99
100	20	return 0;
101	20	}
102
103		int
104	33.9k	LLVMFuzzerTestOneInput(const char *data, size_t size) {
105	33.9k	xmlTextReaderPtr reader;
106	33.9k	xmlDocPtr doc = NULL;
107	33.9k	const xmlError *error;
108	33.9k	const char *docBuffer;
109	33.9k	const unsigned char *program;
110	33.9k	size_t failurePos, docSize, programSize, i;
111	33.9k	size_t totalStringSize = 0;
112	33.9k	int opts;
113	33.9k	int oomReport = 0;
114
115	33.9k	xmlFuzzDataInit(data, size);
116	33.9k	opts = (int) xmlFuzzReadInt(4);
117	33.9k	failurePos = xmlFuzzReadInt(4) % (size + 100);
118
119	33.9k	program = (const unsigned char *) xmlFuzzReadString(&programSize);
120	33.9k	if (programSize > 1000)
121	57	programSize = 1000;
122
123	33.9k	xmlFuzzReadEntities();
124	33.9k	docBuffer = xmlFuzzMainEntity(&docSize);
125	33.9k	if (docBuffer == NULL)
126	113	goto exit;
127
128		#ifdef DEBUG
129		fprintf(stderr, "Input document (%d bytes):\n", (int) docSize);
130		for (i = 0; (size_t) i < docSize; i++) {
131		int c = (unsigned char) docBuffer[i];
132
133		if ((c == '\n' \|\| (c >= 0x20 && c <= 0x7E)))
134		putc(c, stderr);
135		else
136		fprintf(stderr, "\\x%02X", c);
137		}
138		fprintf(stderr, "\nEOF\n");
139		#endif
140
141	33.8k	xmlFuzzInjectFailure(failurePos);
142	33.8k	reader = xmlReaderForMemory(docBuffer, docSize, NULL, NULL, opts);
143	33.8k	if (reader == NULL)
144	64	goto exit;
145
146	33.8k	xmlTextReaderSetStructuredErrorHandler(reader, xmlFuzzSErrorFunc, NULL);
147	33.8k	xmlTextReaderSetResourceLoader(reader, xmlFuzzResourceLoader, NULL);
148
149	33.8k	i = 0;
150	766k	while (i < programSize) {
151	733k	int op = program[i++];
152
153	733k	#define READ_BYTE() (i < programSize ? program[i++] : 0)
154	733k	#define FREE_STRING(str) \
155	733k	do { \
156	158k	if (str != NULL) { \
157	48.7k	totalStringSize += strlen((char *) str); \
158	48.7k	xmlFree(str); \
159	48.7k	} \
160	158k	} while (0)
161
162	733k	switch (op & 0x3F) {
163	48.4k	case OP_READ:
164	244k	default:
165	244k	startOp("Read");
166	244k	xmlTextReaderRead(reader);
167	244k	break;
168
169	13.1k	case OP_READ_INNER_XML: {
170	13.1k	xmlChar *result;
171
172	13.1k	startOp("ReadInnerXml");
173	13.1k	result = xmlTextReaderReadInnerXml(reader);
174	13.1k	FREE_STRING(result);
175	13.1k	break;
176	48.4k	}
177
178	30.7k	case OP_READ_OUTER_XML: {
179	30.7k	xmlChar *result;
180
181	30.7k	startOp("ReadOuterXml");
182	30.7k	result = xmlTextReaderReadOuterXml(reader);
183	30.7k	FREE_STRING(result);
184	30.7k	break;
185	48.4k	}
186
187	10.8k	case OP_READ_STRING: {
188	10.8k	xmlChar *result;
189
190	10.8k	startOp("ReadString");
191	10.8k	result = xmlTextReaderReadString(reader);
192	10.8k	FREE_STRING(result);
193	10.8k	break;
194	48.4k	}
195
196	11.1k	case OP_READ_ATTRIBUTE_VALUE:
197	11.1k	startOp("ReadAttributeValue");
198	11.1k	xmlTextReaderReadAttributeValue(reader);
199	11.1k	break;
200
201	9.25k	case OP_ATTRIBUTE_COUNT:
202	9.25k	startOp("AttributeCount");
203	9.25k	xmlTextReaderAttributeCount(reader);
204	9.25k	break;
205
206	3.64k	case OP_DEPTH:
207	3.64k	startOp("Depth");
208	3.64k	xmlTextReaderDepth(reader);
209	3.64k	break;
210
211	3.11k	case OP_HAS_ATTRIBUTES:
212	3.11k	startOp("HasAttributes");
213	3.11k	xmlTextReaderHasAttributes(reader);
214	3.11k	break;
215
216	11.6k	case OP_HAS_VALUE:
217	11.6k	startOp("HasValue");
218	11.6k	xmlTextReaderHasValue(reader);
219	11.6k	break;
220
221	6.83k	case OP_IS_DEFAULT:
222	6.83k	startOp("IsDefault");
223	6.83k	xmlTextReaderIsDefault(reader);
224	6.83k	break;
225
226	11.3k	case OP_IS_EMPTY_ELEMENT:
227	11.3k	startOp("IsEmptyElement");
228	11.3k	xmlTextReaderIsEmptyElement(reader);
229	11.3k	break;
230
231	11.3k	case OP_NODE_TYPE:
232	11.3k	startOp("NodeType");
233	11.3k	xmlTextReaderNodeType(reader);
234	11.3k	break;
235
236	3.61k	case OP_QUOTE_CHAR:
237	3.61k	startOp("QuoteChar");
238	3.61k	xmlTextReaderQuoteChar(reader);
239	3.61k	break;
240
241	6.41k	case OP_READ_STATE:
242	6.41k	startOp("ReadState");
243	6.41k	xmlTextReaderReadState(reader);
244	6.41k	break;
245
246	3.83k	case OP_IS_NAMESPACE_DECL:
247	3.83k	startOp("IsNamespaceDecl");
248	3.83k	xmlTextReaderIsNamespaceDecl(reader);
249	3.83k	break;
250
251	44.2k	case OP_CONST_BASE_URI:
252	44.2k	startOp("ConstBaseUri");
253	44.2k	xmlTextReaderConstBaseUri(reader);
254	44.2k	break;
255
256	1.37k	case OP_CONST_LOCAL_NAME:
257	1.37k	startOp("ConstLocalName");
258	1.37k	xmlTextReaderConstLocalName(reader);
259	1.37k	break;
260
261	4.16k	case OP_CONST_NAME:
262	4.16k	startOp("ConstName");
263	4.16k	xmlTextReaderConstName(reader);
264	4.16k	break;
265
266	5.28k	case OP_CONST_NAMESPACE_URI:
267	5.28k	startOp("ConstNamespaceUri");
268	5.28k	xmlTextReaderConstNamespaceUri(reader);
269	5.28k	break;
270
271	11.7k	case OP_CONST_PREFIX:
272	11.7k	startOp("ConstPrefix");
273	11.7k	xmlTextReaderConstPrefix(reader);
274	11.7k	break;
275
276	6.40k	case OP_CONST_XML_LANG:
277	6.40k	startOp("ConstXmlLang");
278	6.40k	xmlTextReaderConstXmlLang(reader);
279	6.40k	oomReport = -1;
280	6.40k	break;
281
282	5.53k	case OP_CONST_VALUE:
283	5.53k	startOp("ConstValue");
284	5.53k	xmlTextReaderConstValue(reader);
285	5.53k	break;
286
287	8.37k	case OP_BASE_URI: {
288	8.37k	xmlChar *result;
289
290	8.37k	startOp("BaseUri");
291	8.37k	result = xmlTextReaderBaseUri(reader);
292	8.37k	FREE_STRING(result);
293	8.37k	break;
294	48.4k	}
295
296	6.03k	case OP_LOCAL_NAME: {
297	6.03k	xmlChar *result;
298
299	6.03k	startOp("LocalName");
300	6.03k	result = xmlTextReaderLocalName(reader);
301	6.03k	FREE_STRING(result);
302	6.03k	break;
303	48.4k	}
304
305	6.48k	case OP_NAME: {
306	6.48k	xmlChar *result;
307
308	6.48k	startOp("Name");
309	6.48k	result = xmlTextReaderName(reader);
310	6.48k	FREE_STRING(result);
311	6.48k	break;
312	48.4k	}
313
314	3.21k	case OP_NAMESPACE_URI: {
315	3.21k	xmlChar *result;
316
317	3.21k	startOp("NamespaceUri");
318	3.21k	result = xmlTextReaderNamespaceUri(reader);
319	3.21k	FREE_STRING(result);
320	3.21k	break;
321	48.4k	}
322
323	4.02k	case OP_PREFIX: {
324	4.02k	xmlChar *result;
325
326	4.02k	startOp("Prefix");
327	4.02k	result = xmlTextReaderPrefix(reader);
328	4.02k	FREE_STRING(result);
329	4.02k	break;
330	48.4k	}
331
332	3.37k	case OP_XML_LANG: {
333	3.37k	xmlChar *result;
334
335	3.37k	startOp("XmlLang");
336	3.37k	result = xmlTextReaderXmlLang(reader);
337	3.37k	oomReport = -1;
338	3.37k	FREE_STRING(result);
339	3.37k	break;
340	48.4k	}
341
342	9.38k	case OP_VALUE: {
343	9.38k	xmlChar *result;
344
345	9.38k	startOp("Value");
346	9.38k	result = xmlTextReaderValue(reader);
347	9.38k	FREE_STRING(result);
348	9.38k	break;
349	48.4k	}
350
351	1.58k	case OP_CLOSE:
352	1.58k	startOp("Close");
353	1.58k	if (doc == NULL)
354	511	doc = xmlTextReaderCurrentDoc(reader);
355	1.58k	xmlTextReaderClose(reader);
356	1.58k	break;
357
358	4.30k	case OP_GET_ATTRIBUTE_NO: {
359	4.30k	xmlChar *result;
360	4.30k	int no = READ_BYTE();
361
362	4.30k	startOp("GetAttributeNo");
363	4.30k	result = xmlTextReaderGetAttributeNo(reader, no);
364	4.30k	FREE_STRING(result);
365	4.30k	break;
366	48.4k	}
367
368	27.6k	case OP_GET_ATTRIBUTE: {
369	27.6k	const xmlChar *name = xmlTextReaderConstName(reader);
370	27.6k	xmlChar *result;
371
372	27.6k	startOp("GetAttribute");
373	27.6k	result = xmlTextReaderGetAttribute(reader, name);
374	27.6k	FREE_STRING(result);
375	27.6k	break;
376	48.4k	}
377
378	22.9k	case OP_GET_ATTRIBUTE_NS: {
379	22.9k	const xmlChar localName, namespaceUri;
380	22.9k	xmlChar *result;
381
382	22.9k	startOp("GetAttributeNs");
383	22.9k	localName = xmlTextReaderConstLocalName(reader);
384	22.9k	namespaceUri = xmlTextReaderConstNamespaceUri(reader);
385	22.9k	result = xmlTextReaderGetAttributeNs(reader, localName,
386	22.9k	namespaceUri);
387	22.9k	FREE_STRING(result);
388	22.9k	break;
389	48.4k	}
390
391	3.87k	case OP_GET_REMAINDER:
392	3.87k	startOp("GetRemainder");
393	3.87k	if (doc == NULL)
394	1.81k	doc = xmlTextReaderCurrentDoc(reader);
395	3.87k	xmlFreeParserInputBuffer(xmlTextReaderGetRemainder(reader));
396	3.87k	break;
397
398	7.75k	case OP_LOOKUP_NAMESPACE: {
399	7.75k	const xmlChar *prefix = xmlTextReaderConstPrefix(reader);
400	7.75k	xmlChar *result;
401
402	7.75k	startOp("LookupNamespace");
403	7.75k	result = xmlTextReaderLookupNamespace(reader, prefix);
404	7.75k	FREE_STRING(result);
405	7.75k	break;
406	48.4k	}
407
408	7.28k	case OP_MOVE_TO_ATTRIBUTE_NO: {
409	7.28k	int no = READ_BYTE();
410
411	7.28k	startOp("MoveToAttributeNo");
412	7.28k	xmlTextReaderMoveToAttributeNo(reader, no);
413	7.28k	break;
414	48.4k	}
415
416	13.3k	case OP_MOVE_TO_ATTRIBUTE: {
417	13.3k	const xmlChar *name = xmlTextReaderConstName(reader);
418
419	13.3k	startOp("MoveToAttribute");
420	13.3k	xmlTextReaderMoveToAttribute(reader, name);
421	13.3k	break;
422	48.4k	}
423
424	10.5k	case OP_MOVE_TO_ATTRIBUTE_NS: {
425	10.5k	const xmlChar localName, namespaceUri;
426
427	10.5k	startOp("MoveToAttributeNs");
428	10.5k	localName = xmlTextReaderConstLocalName(reader);
429	10.5k	namespaceUri = xmlTextReaderConstNamespaceUri(reader);
430	10.5k	xmlTextReaderMoveToAttributeNs(reader, localName,
431	10.5k	namespaceUri);
432	10.5k	break;
433	48.4k	}
434
435	12.0k	case OP_MOVE_TO_FIRST_ATTRIBUTE:
436	12.0k	startOp("MoveToFirstAttribute");
437	12.0k	xmlTextReaderMoveToFirstAttribute(reader);
438	12.0k	break;
439
440	7.75k	case OP_MOVE_TO_NEXT_ATTRIBUTE:
441	7.75k	startOp("MoveToNextAttribute");
442	7.75k	xmlTextReaderMoveToNextAttribute(reader);
443	7.75k	break;
444
445	5.74k	case OP_MOVE_TO_ELEMENT:
446	5.74k	startOp("MoveToElement");
447	5.74k	xmlTextReaderMoveToElement(reader);
448	5.74k	break;
449
450	1.85k	case OP_NORMALIZATION:
451	1.85k	startOp("Normalization");
452	1.85k	xmlTextReaderNormalization(reader);
453	1.85k	break;
454
455	3.65k	case OP_CONST_ENCODING:
456	3.65k	startOp("ConstEncoding");
457	3.65k	xmlTextReaderConstEncoding(reader);
458	3.65k	break;
459
460	7.49k	case OP_GET_PARSER_PROP: {
461	7.49k	int prop = READ_BYTE();
462
463	7.49k	startOp("GetParserProp");
464	7.49k	xmlTextReaderGetParserProp(reader, prop);
465	7.49k	break;
466	48.4k	}
467
468	10.9k	case OP_CURRENT_NODE:
469	10.9k	startOp("CurrentNode");
470	10.9k	xmlTextReaderCurrentNode(reader);
471	10.9k	break;
472
473	5.76k	case OP_GET_PARSER_LINE_NUMBER:
474	5.76k	startOp("GetParserLineNumber");
475	5.76k	xmlTextReaderGetParserLineNumber(reader);
476	5.76k	break;
477
478	10.1k	case OP_GET_PARSER_COLUMN_NUMBER:
479	10.1k	startOp("GetParserColumnNumber");
480	10.1k	xmlTextReaderGetParserColumnNumber(reader);
481	10.1k	break;
482
483	7.08k	case OP_PRESERVE:
484	7.08k	startOp("Preserve");
485	7.08k	xmlTextReaderPreserve(reader);
486	7.08k	break;
487
488	6.91k	case OP_CURRENT_DOC: {
489	6.91k	xmlDocPtr result;
490
491	6.91k	startOp("CurrentDoc");
492	6.91k	result = xmlTextReaderCurrentDoc(reader);
493	6.91k	if (doc == NULL)
494	2.54k	doc = result;
495	6.91k	break;
496	48.4k	}
497
498	8.00k	case OP_EXPAND:
499	8.00k	startOp("Expand");
500	8.00k	xmlTextReaderExpand(reader);
501	8.00k	break;
502
503	20.6k	case OP_NEXT:
504	20.6k	startOp("Next");
505	20.6k	xmlTextReaderNext(reader);
506	20.6k	break;
507
508	7.36k	case OP_NEXT_SIBLING:
509	7.36k	startOp("NextSibling");
510	7.36k	xmlTextReaderNextSibling(reader);
511	7.36k	break;
512
513	3.55k	case OP_IS_VALID:
514	3.55k	startOp("IsValid");
515	3.55k	xmlTextReaderIsValid(reader);
516	3.55k	break;
517
518	4.50k	case OP_CONST_XML_VERSION:
519	4.50k	startOp("ConstXmlVersion");
520	4.50k	xmlTextReaderConstXmlVersion(reader);
521	4.50k	break;
522
523	4.00k	case OP_STANDALONE:
524	4.00k	startOp("Standalone");
525	4.00k	xmlTextReaderStandalone(reader);
526	4.00k	break;
527
528	5.68k	case OP_BYTE_CONSUMED:
529	5.68k	startOp("ByteConsumed");
530	5.68k	xmlTextReaderByteConsumed(reader);
531	5.68k	oomReport = -1;
532	5.68k	break;
533	733k	}
534
535	733k	if (totalStringSize > docSize * 2)
536	1.06k	break;
537	733k	}
538
539	33.8k	error = xmlTextReaderGetLastError(reader);
540	33.8k	if (error->code == XML_ERR_NO_MEMORY)
541	7.72k	oomReport = 1;
542	33.8k	xmlFuzzCheckFailureReport("reader", oomReport, error->code == XML_IO_EIO);
543
544	33.8k	xmlFreeTextReader(reader);
545
546	33.8k	if (doc != NULL)
547	3.34k	xmlFreeDoc(doc);
548
549	33.9k	exit:
550	33.9k	xmlFuzzInjectFailure(0);
551	33.9k	xmlFuzzDataCleanup();
552	33.9k	xmlResetLastError();
553	33.9k	return(0);
554	33.8k	}
555
556		size_t
557		LLVMFuzzerCustomMutator(char *data, size_t size, size_t maxSize,
558	0	unsigned seed) {
559	0	static const xmlFuzzChunkDesc chunks[] = {
560	0	{ 4, XML_FUZZ_PROB_ONE / 10 }, /* opts */
561	0	{ 4, XML_FUZZ_PROB_ONE / 10 }, /* failurePos */
562	0	{ 0, 0 }
563	0	};
564
565	0	return xmlFuzzMutateChunks(chunks, data, size, maxSize, seed,
566	0	LLVMFuzzerMutate);
567	0	}
568