Coverage Report

Created: 2026-10-28 07:09

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/MapServer/fuzzers/sldfuzzer.c
Line
Count
Source
1
#include "src/mapserver.h"
2
#include "src/mapio.h"
3
#include "src/mapogcsld.h"
4
5
#include <stdlib.h>
6
#include <string.h>
7
8
9.99k
#define kMaxInputLength 65536
9
10
extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
11
extern int LLVMFuzzerInitialize(int *argc, char ***argv);
12
13
10
int LLVMFuzzerInitialize(int *argc, char ***argv) {
14
10
  (void)argc;
15
10
  (void)argv;
16
10
  msIO_setHeaderEnabled(MS_FALSE);
17
10
  return 0;
18
10
}
19
20
9.98k
static mapObj *buildMap(void) {
21
9.98k
  mapObj *map = msNewMapObj();
22
9.98k
  if (!map)
23
0
    return NULL;
24
25
9.98k
  if (msGrowMapLayers(map) == NULL) {
26
0
    msFreeMap(map);
27
0
    return NULL;
28
0
  }
29
9.98k
  if (initLayer(GET_LAYER(map, map->numlayers), map) == -1) {
30
0
    msFreeMap(map);
31
0
    return NULL;
32
0
  }
33
9.98k
  GET_LAYER(map, map->numlayers)->index = map->numlayers;
34
9.98k
  GET_LAYER(map, map->numlayers)->name = msStrdup("fuzz");
35
9.98k
  GET_LAYER(map, map->numlayers)->type = MS_LAYER_POLYGON;
36
9.98k
  map->layerorder[map->numlayers] = map->numlayers;
37
9.98k
  map->numlayers++;
38
39
9.98k
  return map;
40
9.98k
}
41
42
9.99k
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
43
9.99k
  if (Size == 0 || Size > kMaxInputLength)
44
7
    return 0;
45
46
9.98k
  char *sld = (char *)malloc(Size + 1);
47
9.98k
  if (!sld)
48
0
    return 0;
49
9.98k
  memcpy(sld, Data, Size);
50
9.98k
  sld[Size] = '\0';
51
52
9.98k
  mapObj *map = buildMap();
53
9.98k
  if (map) {
54
9.98k
    (void)msSLDApplySLD(map, sld, 0, NULL, NULL);
55
9.98k
    msFreeMap(map);
56
9.98k
  }
57
58
9.98k
  free(sld);
59
9.98k
  msResetErrorList();
60
61
9.98k
  return 0;
62
9.98k
}