Coverage Report

Created: 2025-08-26 06:48

/src/pugixml/tests/fuzz_xpath.cpp
Line
Count
Source
1
#include "../src/pugixml.hpp"
2
#include "fuzzer/FuzzedDataProvider.h"
3
4
#include <stdint.h>
5
#include <string.h>
6
#include <string>
7
8
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size)
9
14.7k
{
10
14.7k
  FuzzedDataProvider fdp(Data, Size);
11
14.7k
  std::string text = fdp.ConsumeRandomLengthString(1024);
12
13
14.7k
#ifndef PUGIXML_NO_EXCEPTIONS
14
14.7k
  try
15
14.7k
#endif
16
14.7k
  {
17
14.7k
    pugi::xpath_variable_set vars;
18
14.7k
    size_t var_count = fdp.ConsumeIntegralInRange<size_t>(0, 50);
19
14.7k
    std::vector<std::string> var_name_storage;
20
30.9k
    for (size_t i = 0; i < var_count; ++i)
21
16.1k
    {
22
16.1k
      var_name_storage.push_back(fdp.ConsumeRandomLengthString(128));
23
24
16.1k
      const int xpath_value_type_count = pugi::xpath_type_boolean + 1;
25
16.1k
      pugi::xpath_value_type value_type = static_cast<pugi::xpath_value_type>(fdp.ConsumeIntegralInRange(0, xpath_value_type_count));
26
16.1k
      vars.add(var_name_storage.back().c_str(), value_type);
27
16.1k
    }
28
14.7k
    pugi::xpath_query q(text.c_str(), &vars);
29
30
14.7k
    std::vector<uint8_t> xml_buffer = fdp.ConsumeBytes<uint8_t>(fdp.ConsumeIntegralInRange(0, 1024));
31
14.7k
    pugi::xml_document doc;
32
14.7k
    doc.load_buffer(xml_buffer.data(), xml_buffer.size(), pugi::parse_full);
33
34
14.7k
    q.evaluate_boolean(doc);
35
14.7k
    q.evaluate_number(doc);
36
14.7k
    q.evaluate_string(doc);
37
14.7k
    q.evaluate_node(doc);
38
14.7k
    q.evaluate_node_set(doc);
39
14.7k
  }
40
14.7k
#ifndef PUGIXML_NO_EXCEPTIONS
41
14.7k
  catch (pugi::xpath_exception&)
42
14.7k
  {
43
5.78k
  }
44
14.7k
#endif
45
14.7k
  return 0;
46
14.7k
}