Coverage Report

Created: 2025-07-11 06:45

/src/pupnp/fuzzer/FuzzIxml.c
Line
Count
Source (jump to first uncovered line)
1
#include "ixml.h"
2
#include <stdint.h>
3
#include <stdio.h>
4
#include <stdlib.h>
5
#include <string.h>
6
#include <unistd.h>
7
8
7.23k
#define kMinInputLength 10
9
3.61k
#define kMaxInputLength 5120
10
11
int CheckXML(char *filename)
12
3.59k
{
13
14
3.59k
  int rc;
15
3.59k
  DOMString s;
16
3.59k
  IXML_Document *doc = NULL;
17
18
3.59k
  rc = ixmlLoadDocumentEx(filename, &doc);
19
3.59k
  if (rc != IXML_SUCCESS) {
20
2.51k
    return rc;
21
2.51k
  }
22
23
1.08k
  s = ixmlPrintDocument(doc);
24
1.08k
  if (s == NULL || s[0] == '\0') {
25
0
    ixmlDocument_free(doc);
26
0
    return 1;
27
0
  }
28
29
1.08k
  ixmlFreeDOMString(s);
30
1.08k
  ixmlDocument_free(doc);
31
32
1.08k
  return 0;
33
1.08k
}
34
35
extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
36
3.61k
{
37
3.61k
  int ret;
38
3.61k
  char filename[256];
39
3.61k
  FILE *fp;
40
41
3.61k
  if (Size < kMinInputLength || Size > kMaxInputLength) {
42
20
    return 1;
43
20
  }
44
45
3.59k
  sprintf(filename, "/tmp/libfuzzer.%d", getpid());
46
3.59k
  fp = fopen(filename, "wb");
47
3.59k
  if (!fp) {
48
0
    return 0;
49
0
  }
50
51
3.59k
  fwrite(Data, Size, 1, fp);
52
3.59k
  fclose(fp);
53
54
3.59k
  ret = CheckXML(filename);
55
3.59k
  unlink(filename);
56
3.59k
  return ret;
57
3.59k
}