Coverage Report

Created: 2026-05-16 07:57

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/wget/fuzz/wget_css_fuzzer.c
Line
Count
Source
1
/*
2
 * Copyright (c) 2017-2024, 2026 Free Software Foundation, Inc.
3
 *
4
 * This file is part of GNU Wget.
5
 *
6
 * GNU Wget is free software; you can redistribute it and/or modify
7
 * it under the terms of the GNU General Public License as published by
8
 * the Free Software Foundation; either version 3 of the License, or
9
 * (at your option) any later version.
10
 *
11
 * GNU Wget is distributed in the hope that it will be useful,
12
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14
 * GNU General Public License for more details.
15
 *
16
 * You should have received a copy of the GNU General Public License
17
 * along with Wget.  If not, see <https://www.gnu.org/licenses/>.
18
 */
19
20
#include <config.h>
21
22
#include <sys/types.h>
23
#include <dirent.h> // opendir, readdir
24
#include <stdint.h> // uint8_t
25
#include <stdio.h>  // fmemopen
26
#include <string.h>  // strncmp
27
#include <stdlib.h>  // free
28
#include <fcntl.h>  // open flags
29
#include <unistd.h>  // close
30
#include <setjmp.h> // longjmp, setjmp
31
32
#include "wget.h"
33
#undef fopen_wgetrc
34
35
#ifdef __cplusplus
36
  extern "C" {
37
#endif
38
  #include "html-url.h"
39
  #include "css-url.h"
40
41
  // declarations for wget internal functions
42
  int main_wget(int argc, const char **argv);
43
  void cleanup(void);
44
  FILE *fopen_wget(const char *pathname, const char *mode);
45
  FILE *fopen_wgetrc(const char *pathname, const char *mode);
46
  void exit_wget(int status);
47
#ifdef __cplusplus
48
  }
49
#endif
50
51
#include "fuzzer.h"
52
53
static const uint8_t *g_data;
54
static size_t g_size;
55
56
FILE *fopen_wget(const char *pathname, const char *mode)
57
0
{
58
0
  return fopen("/dev/null", mode);
59
0
}
60
61
FILE *fopen_wgetrc(const char *pathname, const char *mode)
62
0
{
63
0
#ifdef HAVE_FMEMOPEN
64
0
  return fmemopen((void *) g_data, g_size, mode);
65
#else
66
  return NULL;
67
#endif
68
0
}
69
70
static int do_jump;
71
static jmp_buf jmpbuf;
72
#ifdef FUZZING
73
void exit_wget(int status)
74
0
{
75
0
  longjmp(jmpbuf, 1);
76
0
}
77
#elif defined HAVE_DLFCN_H
78
#include <dlfcn.h> // dlsym
79
#ifndef RTLD_NEXT
80
#define RTLD_NEXT RTLD_GLOBAL
81
#endif
82
void exit(int status)
83
{
84
  if (do_jump) {
85
    longjmp(jmpbuf, 1);
86
  } else {
87
    void (*libc_exit)(int) = (void(*)(int)) dlsym (RTLD_NEXT, "exit");
88
    libc_exit(status);
89
  }
90
}
91
#endif
92
93
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
94
3.16k
{
95
3.16k
  if (size > 4096) // same as max_len = ... in .options file
96
10
    return 0;
97
98
3.15k
  struct map_context ctx = {
99
3.15k
    .text = (char *) data,
100
3.15k
    .parent_base = strdup("https://x.y"),
101
3.15k
    .document_file = NULL,
102
3.15k
  };
103
104
3.15k
  CLOSE_STDERR
105
106
3.15k
  do_jump = 1;
107
108
3.15k
  if (setjmp(jmpbuf))
109
0
    goto done;
110
111
3.15k
  get_urls_css(&ctx, 0, size);
112
3.15k
  free_urlpos(ctx.head);
113
3.15k
  free((void *) ctx.parent_base);
114
115
3.15k
done:
116
3.15k
  do_jump = 0;
117
118
3.15k
  RESTORE_STDERR
119
120
3.15k
  return 0;
121
3.15k
}