Coverage Report

Created: 2025-08-03 06:50

/src/pupnp/fuzzer/FuzzIxml.c
Line
Count
Source (jump to first uncovered line)
1
#include "ixml.h"
2
#include <stdint.h>
3
#include <stdio.h>
4
#include <stdlib.h>
5
#include <string.h>
6
#include <unistd.h>
7
8
7.42k
#define kMinInputLength 10
9
3.70k
#define kMaxInputLength 5120
10
11
int CheckXML(char *filename)
12
3.69k
{
13
14
3.69k
  int rc;
15
3.69k
  DOMString s;
16
3.69k
  IXML_Document *doc = NULL;
17
18
3.69k
  rc = ixmlLoadDocumentEx(filename, &doc);
19
3.69k
  if (rc != IXML_SUCCESS) {
20
2.61k
    return rc;
21
2.61k
  }
22
23
1.07k
  s = ixmlPrintDocument(doc);
24
1.07k
  if (s == NULL || s[0] == '\0') {
25
0
    ixmlDocument_free(doc);
26
0
    return 1;
27
0
  }
28
29
1.07k
  ixmlFreeDOMString(s);
30
1.07k
  ixmlDocument_free(doc);
31
32
1.07k
  return 0;
33
1.07k
}
34
35
extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
36
3.71k
{
37
3.71k
  int ret;
38
3.71k
  char filename[256];
39
3.71k
  FILE *fp;
40
41
3.71k
  if (Size < kMinInputLength || Size > kMaxInputLength) {
42
22
    return 1;
43
22
  }
44
45
3.69k
  sprintf(filename, "/tmp/libfuzzer.%d", getpid());
46
3.69k
  fp = fopen(filename, "wb");
47
3.69k
  if (!fp) {
48
0
    return 0;
49
0
  }
50
51
3.69k
  fwrite(Data, Size, 1, fp);
52
3.69k
  fclose(fp);
53
54
3.69k
  ret = CheckXML(filename);
55
3.69k
  unlink(filename);
56
3.69k
  return ret;
57
3.69k
}