/src/libyaml_emitter_fuzzer.c
Line | Count | Source (jump to first uncovered line) |
1 | | // Copyright 2020 Google LLC |
2 | | // |
3 | | // Licensed under the Apache License, Version 2.0 (the "License"); |
4 | | // you may not use this file except in compliance with the License. |
5 | | // You may obtain a copy of the License at |
6 | | // |
7 | | // http://www.apache.org/licenses/LICENSE-2.0 |
8 | | // |
9 | | // Unless required by applicable law or agreed to in writing, software |
10 | | // distributed under the License is distributed on an "AS IS" BASIS, |
11 | | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
12 | | // See the License for the specific language governing permissions and |
13 | | // limitations under the License. |
14 | | |
15 | | #include "yaml.h" |
16 | | #include "yaml_write_handler.h" |
17 | | #include <assert.h> |
18 | | #include <stdbool.h> |
19 | | #include <stdint.h> |
20 | | #include <stdio.h> |
21 | | #include <stdlib.h> |
22 | | #include <string.h> |
23 | | |
24 | | #ifdef NDEBUG |
25 | | #undef NDEBUG |
26 | | #endif |
27 | | |
28 | 342 | #define MAX_EVENTS 1024 |
29 | | |
30 | 0 | bool events_equal(yaml_event_t *event1, yaml_event_t *event2) { |
31 | | |
32 | 0 | const bool equal = true; |
33 | |
|
34 | 0 | if (event1->type != event2->type) |
35 | 0 | return equal; |
36 | | |
37 | 0 | switch (event1->type) { |
38 | 0 | case YAML_STREAM_START_EVENT: |
39 | 0 | return !equal; |
40 | | |
41 | 0 | case YAML_DOCUMENT_START_EVENT: |
42 | 0 | if ((event1->data.document_start.version_directive && |
43 | 0 | !event2->data.document_start.version_directive) || |
44 | 0 | (!event1->data.document_start.version_directive && |
45 | 0 | event2->data.document_start.version_directive) || |
46 | 0 | (event1->data.document_start.version_directive && |
47 | 0 | event2->data.document_start.version_directive && |
48 | 0 | (event1->data.document_start.version_directive->major != |
49 | 0 | event2->data.document_start.version_directive->major || |
50 | 0 | event1->data.document_start.version_directive->minor != |
51 | 0 | event2->data.document_start.version_directive->minor))) |
52 | 0 | return equal; |
53 | 0 | if ((event1->data.document_start.tag_directives.end - |
54 | 0 | event1->data.document_start.tag_directives.start) != |
55 | 0 | (event2->data.document_start.tag_directives.end - |
56 | 0 | event2->data.document_start.tag_directives.start)) |
57 | 0 | return equal; |
58 | 0 | for (int k = 0; k < (event1->data.document_start.tag_directives.end - |
59 | 0 | event1->data.document_start.tag_directives.start); |
60 | 0 | k++) { |
61 | 0 | if ((strcmp((char *)event1->data.document_start.tag_directives.start[k] |
62 | 0 | .handle, |
63 | 0 | (char *)event2->data.document_start.tag_directives.start[k] |
64 | 0 | .handle) != 0) || |
65 | 0 | (strcmp((char *)event1->data.document_start.tag_directives.start[k] |
66 | 0 | .prefix, |
67 | 0 | (char *)event2->data.document_start.tag_directives.start[k] |
68 | 0 | .prefix) != 0)) |
69 | 0 | return equal; |
70 | 0 | } |
71 | 0 | return !equal; |
72 | | |
73 | 0 | case YAML_DOCUMENT_END_EVENT: |
74 | 0 | return !equal; |
75 | | |
76 | 0 | case YAML_ALIAS_EVENT: |
77 | 0 | return (strcmp((char *)event1->data.alias.anchor, |
78 | 0 | (char *)event2->data.alias.anchor) == 0); |
79 | | |
80 | 0 | case YAML_SCALAR_EVENT: |
81 | 0 | if ((event1->data.scalar.anchor && !event2->data.scalar.anchor) || |
82 | 0 | (!event1->data.scalar.anchor && event2->data.scalar.anchor) || |
83 | 0 | (event1->data.scalar.anchor && event2->data.scalar.anchor && |
84 | 0 | strcmp((char *)event1->data.scalar.anchor, |
85 | 0 | (char *)event2->data.scalar.anchor) != 0)) |
86 | 0 | return equal; |
87 | 0 | if ((event1->data.scalar.tag && !event2->data.scalar.tag && |
88 | 0 | strcmp((char *)event1->data.scalar.tag, "!") != 0) || |
89 | 0 | (!event1->data.scalar.tag && event2->data.scalar.tag && |
90 | 0 | strcmp((char *)event2->data.scalar.tag, "!") != 0) || |
91 | 0 | (event1->data.scalar.tag && event2->data.scalar.tag && |
92 | 0 | strcmp((char *)event1->data.scalar.tag, |
93 | 0 | (char *)event2->data.scalar.tag) != 0)) |
94 | 0 | return equal; |
95 | 0 | if ((event1->data.scalar.length != event2->data.scalar.length) || |
96 | 0 | memcmp(event1->data.scalar.value, event2->data.scalar.value, |
97 | 0 | event1->data.scalar.length) != 0) |
98 | 0 | return equal; |
99 | 0 | if ((event1->data.scalar.plain_implicit != |
100 | 0 | event2->data.scalar.plain_implicit) || |
101 | 0 | (event1->data.scalar.quoted_implicit != |
102 | 0 | event2->data.scalar.quoted_implicit)) |
103 | 0 | return equal; |
104 | 0 | return !equal; |
105 | | |
106 | 0 | case YAML_SEQUENCE_START_EVENT: |
107 | 0 | if ((event1->data.sequence_start.anchor && |
108 | 0 | !event2->data.sequence_start.anchor) || |
109 | 0 | (!event1->data.sequence_start.anchor && |
110 | 0 | event2->data.sequence_start.anchor) || |
111 | 0 | (event1->data.sequence_start.anchor && |
112 | 0 | event2->data.sequence_start.anchor && |
113 | 0 | strcmp((char *)event1->data.sequence_start.anchor, |
114 | 0 | (char *)event2->data.sequence_start.anchor) != 0)) |
115 | 0 | return equal; |
116 | 0 | if ((event1->data.sequence_start.tag && !event2->data.sequence_start.tag) || |
117 | 0 | (!event1->data.sequence_start.tag && event2->data.sequence_start.tag) || |
118 | 0 | (event1->data.sequence_start.tag && event2->data.sequence_start.tag && |
119 | 0 | strcmp((char *)event1->data.sequence_start.tag, |
120 | 0 | (char *)event2->data.sequence_start.tag) != 0)) |
121 | 0 | return equal; |
122 | 0 | if ((event1->data.sequence_start.implicit != |
123 | 0 | event2->data.sequence_start.implicit)) |
124 | 0 | return equal; |
125 | 0 | return !equal; |
126 | | |
127 | 0 | case YAML_MAPPING_START_EVENT: |
128 | 0 | if ((event1->data.mapping_start.anchor && |
129 | 0 | !event2->data.mapping_start.anchor) || |
130 | 0 | (!event1->data.mapping_start.anchor && |
131 | 0 | event2->data.mapping_start.anchor) || |
132 | 0 | (event1->data.mapping_start.anchor && |
133 | 0 | event2->data.mapping_start.anchor && |
134 | 0 | strcmp((char *)event1->data.mapping_start.anchor, |
135 | 0 | (char *)event2->data.mapping_start.anchor) != 0)) |
136 | 0 | return equal; |
137 | 0 | if ((event1->data.mapping_start.tag && !event2->data.mapping_start.tag) || |
138 | 0 | (!event1->data.mapping_start.tag && event2->data.mapping_start.tag) || |
139 | 0 | (event1->data.mapping_start.tag && event2->data.mapping_start.tag && |
140 | 0 | strcmp((char *)event1->data.mapping_start.tag, |
141 | 0 | (char *)event2->data.mapping_start.tag) != 0)) |
142 | 0 | return equal; |
143 | 0 | if ((event1->data.mapping_start.implicit != |
144 | 0 | event2->data.mapping_start.implicit)) |
145 | 0 | return equal; |
146 | 0 | return !equal; |
147 | | |
148 | 0 | default: |
149 | 0 | return !equal; |
150 | 0 | } |
151 | 0 | } |
152 | | |
153 | 342 | bool copy_event(yaml_event_t *event_to, yaml_event_t *event_from) { |
154 | | |
155 | 342 | switch (event_from->type) { |
156 | 342 | case YAML_STREAM_START_EVENT: |
157 | 342 | return yaml_stream_start_event_initialize( |
158 | 342 | event_to, event_from->data.stream_start.encoding); |
159 | | |
160 | 0 | case YAML_STREAM_END_EVENT: |
161 | 0 | return yaml_stream_end_event_initialize(event_to); |
162 | | |
163 | 0 | case YAML_DOCUMENT_START_EVENT: |
164 | 0 | return yaml_document_start_event_initialize( |
165 | 0 | event_to, event_from->data.document_start.version_directive, |
166 | 0 | event_from->data.document_start.tag_directives.start, |
167 | 0 | event_from->data.document_start.tag_directives.end, |
168 | 0 | event_from->data.document_start.implicit); |
169 | | |
170 | 0 | case YAML_DOCUMENT_END_EVENT: |
171 | 0 | return yaml_document_end_event_initialize( |
172 | 0 | event_to, event_from->data.document_end.implicit); |
173 | | |
174 | 0 | case YAML_ALIAS_EVENT: |
175 | 0 | return yaml_alias_event_initialize(event_to, event_from->data.alias.anchor); |
176 | | |
177 | 0 | case YAML_SCALAR_EVENT: |
178 | 0 | return yaml_scalar_event_initialize( |
179 | 0 | event_to, event_from->data.scalar.anchor, event_from->data.scalar.tag, |
180 | 0 | event_from->data.scalar.value, event_from->data.scalar.length, |
181 | 0 | event_from->data.scalar.plain_implicit, |
182 | 0 | event_from->data.scalar.quoted_implicit, event_from->data.scalar.style); |
183 | | |
184 | 0 | case YAML_SEQUENCE_START_EVENT: |
185 | 0 | return yaml_sequence_start_event_initialize( |
186 | 0 | event_to, event_from->data.sequence_start.anchor, |
187 | 0 | event_from->data.sequence_start.tag, |
188 | 0 | event_from->data.sequence_start.implicit, |
189 | 0 | event_from->data.sequence_start.style); |
190 | | |
191 | 0 | case YAML_SEQUENCE_END_EVENT: |
192 | 0 | return yaml_sequence_end_event_initialize(event_to); |
193 | | |
194 | 0 | case YAML_MAPPING_START_EVENT: |
195 | 0 | return yaml_mapping_start_event_initialize( |
196 | 0 | event_to, event_from->data.mapping_start.anchor, |
197 | 0 | event_from->data.mapping_start.tag, |
198 | 0 | event_from->data.mapping_start.implicit, |
199 | 0 | event_from->data.mapping_start.style); |
200 | | |
201 | 0 | case YAML_MAPPING_END_EVENT: |
202 | 0 | return yaml_mapping_end_event_initialize(event_to); |
203 | 342 | } |
204 | | |
205 | 0 | return false; |
206 | 342 | } |
207 | | |
208 | 660 | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
209 | 660 | if (size < 2) |
210 | 1 | return 0; |
211 | | |
212 | 659 | yaml_parser_t parser; |
213 | 659 | yaml_emitter_t emitter; |
214 | 659 | yaml_event_t event; |
215 | 659 | yaml_event_t events[MAX_EVENTS]; |
216 | 659 | size_t event_number = 0; |
217 | 659 | bool done = false; |
218 | 659 | int count = 0; |
219 | 659 | bool is_canonical = data[0] & 1; |
220 | 659 | bool is_unicode = data[1] & 1; |
221 | 659 | data += 2; |
222 | 659 | size -= 2; |
223 | | |
224 | 659 | if (!yaml_parser_initialize(&parser)) |
225 | 0 | return 0; |
226 | | |
227 | 659 | yaml_parser_set_input_string(&parser, data, size); |
228 | 659 | if (!yaml_emitter_initialize(&emitter)) { |
229 | 0 | yaml_parser_delete(&parser); |
230 | 0 | return 0; |
231 | 0 | } |
232 | | |
233 | 659 | yaml_emitter_set_canonical(&emitter, is_canonical); |
234 | 659 | yaml_emitter_set_unicode(&emitter, is_unicode); |
235 | | |
236 | 659 | yaml_output_buffer_t out = {/*buf=*/NULL, /*size=*/0, /*capacity=*/1000}; |
237 | 659 | yaml_emitter_set_output(&emitter, yaml_write_handler, &out); |
238 | | |
239 | 659 | while (!done) { |
240 | 659 | if (!yaml_parser_parse(&parser, &event)) { |
241 | 317 | goto delete_parser; |
242 | 317 | } |
243 | | |
244 | 342 | done = (event.type == YAML_STREAM_END_EVENT); |
245 | 342 | if (event_number >= MAX_EVENTS) { |
246 | 0 | yaml_event_delete(&event); |
247 | 0 | goto delete_parser; |
248 | 0 | } |
249 | | |
250 | 342 | if (copy_event(&events[event_number++], &event)) { |
251 | 342 | yaml_event_delete(&event); |
252 | 342 | goto delete_parser; |
253 | 342 | } |
254 | | |
255 | 0 | if (!yaml_emitter_emit(&emitter, &event)) { |
256 | 0 | goto delete_parser; |
257 | 0 | } |
258 | |
|
259 | 0 | } |
260 | | |
261 | 0 | yaml_parser_delete(&parser); |
262 | |
|
263 | 0 | done = false; |
264 | 0 | if (!yaml_parser_initialize(&parser)) |
265 | 0 | goto error; |
266 | | |
267 | 0 | yaml_parser_set_input_string(&parser, out.buf, out.size); |
268 | |
|
269 | 0 | while (!done) { |
270 | 0 | if (!yaml_parser_parse(&parser, &event)) |
271 | 0 | break; |
272 | | |
273 | 0 | done = (event.type == YAML_STREAM_END_EVENT); |
274 | 0 | if (events_equal(events + count, &event)) { |
275 | 0 | yaml_event_delete(&event); |
276 | 0 | break; |
277 | 0 | } |
278 | | |
279 | 0 | yaml_event_delete(&event); |
280 | 0 | count++; |
281 | 0 | } |
282 | |
|
283 | 659 | delete_parser: |
284 | | |
285 | 659 | yaml_parser_delete(&parser); |
286 | | |
287 | 659 | error: |
288 | | |
289 | 659 | yaml_emitter_delete(&emitter); |
290 | | |
291 | 1.00k | for (int k = 0; k < event_number; k++) { |
292 | 342 | yaml_event_delete(events + k); |
293 | 342 | } |
294 | | |
295 | 659 | free(out.buf); |
296 | | |
297 | 659 | return 0; |
298 | 659 | } |