/src/pupnp/fuzzer/FuzzIxml.c
Line | Count | Source (jump to first uncovered line) |
1 | | #include "ixml.h" |
2 | | #include <stdint.h> |
3 | | #include <stdio.h> |
4 | | #include <stdlib.h> |
5 | | #include <string.h> |
6 | | #include <unistd.h> |
7 | | |
8 | 7.23k | #define kMinInputLength 10 |
9 | 3.61k | #define kMaxInputLength 5120 |
10 | | |
11 | | int CheckXML(char *filename) |
12 | 3.59k | { |
13 | | |
14 | 3.59k | int rc; |
15 | 3.59k | DOMString s; |
16 | 3.59k | IXML_Document *doc = NULL; |
17 | | |
18 | 3.59k | rc = ixmlLoadDocumentEx(filename, &doc); |
19 | 3.59k | if (rc != IXML_SUCCESS) { |
20 | 2.51k | return rc; |
21 | 2.51k | } |
22 | | |
23 | 1.08k | s = ixmlPrintDocument(doc); |
24 | 1.08k | if (s == NULL || s[0] == '\0') { |
25 | 0 | ixmlDocument_free(doc); |
26 | 0 | return 1; |
27 | 0 | } |
28 | | |
29 | 1.08k | ixmlFreeDOMString(s); |
30 | 1.08k | ixmlDocument_free(doc); |
31 | | |
32 | 1.08k | return 0; |
33 | 1.08k | } |
34 | | |
35 | | extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) |
36 | 3.61k | { |
37 | 3.61k | int ret; |
38 | 3.61k | char filename[256]; |
39 | 3.61k | FILE *fp; |
40 | | |
41 | 3.61k | if (Size < kMinInputLength || Size > kMaxInputLength) { |
42 | 20 | return 1; |
43 | 20 | } |
44 | | |
45 | 3.59k | sprintf(filename, "/tmp/libfuzzer.%d", getpid()); |
46 | 3.59k | fp = fopen(filename, "wb"); |
47 | 3.59k | if (!fp) { |
48 | 0 | return 0; |
49 | 0 | } |
50 | | |
51 | 3.59k | fwrite(Data, Size, 1, fp); |
52 | 3.59k | fclose(fp); |
53 | | |
54 | 3.59k | ret = CheckXML(filename); |
55 | 3.59k | unlink(filename); |
56 | 3.59k | return ret; |
57 | 3.59k | } |