Coverage Report

Created: 2025-10-10 06:58

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/pjsip/tests/fuzz/fuzz-xml.c
Line
Count
Source
1
/* 
2
 * Copyright (C) 2023 Teluu Inc. (http://www.teluu.com)
3
 *
4
 * This program is free software; you can redistribute it and/or modify
5
 * it under the terms of the GNU General Public License as published by
6
 * the Free Software Foundation; either version 2 of the License, or
7
 * (at your option) any later version.
8
 *
9
 * This program is distributed in the hope that it will be useful,
10
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12
 * GNU General Public License for more details.
13
 *
14
 * You should have received a copy of the GNU General Public License
15
 * along with this program; if not, write to the Free Software
16
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA 
17
 */
18
#include <stdio.h>
19
#include <stdint.h>
20
#include <stdlib.h>
21
22
#include <pjlib.h>
23
#include <pjlib-util.h>
24
25
2.45k
#define kMinInputLength 10
26
1.22k
#define kMaxInputLength 5120
27
28
pj_pool_factory *mem;
29
30
1.20k
int XML_parse(uint8_t *data, size_t Size) {
31
32
1.20k
    pj_pool_t *pool;
33
1.20k
    pj_xml_node *root;
34
35
1.20k
    char *output;
36
1.20k
    size_t output_size;
37
38
1.20k
    pool = pj_pool_create(mem, "xml", 4096, 1024, NULL);
39
1.20k
    root = pj_xml_parse(pool, (char *)data, Size);
40
1.20k
    if (!root) {
41
778
        goto on_error;
42
778
    }
43
44
423
    output = (char*)pj_pool_zalloc(pool, Size + 512);
45
423
    output_size = pj_xml_print(root, output, Size + 512, PJ_TRUE);
46
423
    if (output_size < 1) {
47
0
        goto on_error;
48
0
    }
49
50
423
    pj_pool_release(pool);
51
423
    return 0;
52
53
778
on_error:
54
778
    pj_pool_release(pool);
55
778
    return 1;
56
423
}
57
58
extern int
59
LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
60
1.22k
{
61
62
1.22k
    if (Size < kMinInputLength || Size > kMaxInputLength) {
63
25
        return 1;
64
25
    }
65
66
1.20k
    int ret = 0;
67
1.20k
    uint8_t *data;
68
1.20k
    pj_caching_pool caching_pool;
69
70
    /* Add NULL byte */
71
1.20k
    data = (uint8_t *)calloc((Size+1), sizeof(uint8_t));
72
1.20k
    memcpy((void *)data, (void *)Data, Size);
73
74
    /* init Calls */
75
1.20k
    pj_init();
76
1.20k
    pj_caching_pool_init( &caching_pool, &pj_pool_factory_default_policy, 0);
77
1.20k
    pj_log_set_level(0);
78
79
1.20k
    mem = &caching_pool.factory;
80
81
    /*Calls fuzzer*/
82
1.20k
    ret = XML_parse(data, Size);
83
84
1.20k
    free(data);
85
1.20k
    pj_caching_pool_destroy(&caching_pool);
86
87
1.20k
    return ret;
88
1.22k
}