| 1 | /*
|
|---|
| 2 | * xml.c: a libFuzzer target to test several XML parser interfaces.
|
|---|
| 3 | *
|
|---|
| 4 | * See Copyright for the status of this software.
|
|---|
| 5 | */
|
|---|
| 6 |
|
|---|
| 7 | #include <libxml/catalog.h>
|
|---|
| 8 | #include <libxml/parser.h>
|
|---|
| 9 | #include <libxml/tree.h>
|
|---|
| 10 | #include <libxml/xmlerror.h>
|
|---|
| 11 | #include <libxml/xmlreader.h>
|
|---|
| 12 | #include "fuzz.h"
|
|---|
| 13 |
|
|---|
| 14 | int
|
|---|
| 15 | LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED,
|
|---|
| 16 | char ***argv ATTRIBUTE_UNUSED) {
|
|---|
| 17 | xmlFuzzMemSetup();
|
|---|
| 18 | xmlInitParser();
|
|---|
| 19 | #ifdef LIBXML_CATALOG_ENABLED
|
|---|
| 20 | xmlInitializeCatalog();
|
|---|
| 21 | #endif
|
|---|
| 22 | xmlSetGenericErrorFunc(NULL, xmlFuzzErrorFunc);
|
|---|
| 23 | xmlSetExternalEntityLoader(xmlFuzzEntityLoader);
|
|---|
| 24 |
|
|---|
| 25 | return 0;
|
|---|
| 26 | }
|
|---|
| 27 |
|
|---|
| 28 | int
|
|---|
| 29 | LLVMFuzzerTestOneInput(const char *data, size_t size) {
|
|---|
| 30 | xmlDocPtr doc;
|
|---|
| 31 | const char *docBuffer, *docUrl;
|
|---|
| 32 | size_t maxAlloc, docSize;
|
|---|
| 33 | int opts;
|
|---|
| 34 |
|
|---|
| 35 | xmlFuzzDataInit(data, size);
|
|---|
| 36 | opts = (int) xmlFuzzReadInt(4);
|
|---|
| 37 | /*
|
|---|
| 38 | * Disable options that are known to cause timeouts
|
|---|
| 39 | */
|
|---|
| 40 | opts &= ~XML_PARSE_XINCLUDE &
|
|---|
| 41 | ~XML_PARSE_DTDVALID &
|
|---|
| 42 | ~XML_PARSE_SAX1;
|
|---|
| 43 | maxAlloc = xmlFuzzReadInt(4) % (size + 1);
|
|---|
| 44 |
|
|---|
| 45 | xmlFuzzReadEntities();
|
|---|
| 46 | docBuffer = xmlFuzzMainEntity(&docSize);
|
|---|
| 47 | docUrl = xmlFuzzMainUrl();
|
|---|
| 48 | if (docBuffer == NULL)
|
|---|
| 49 | goto exit;
|
|---|
| 50 |
|
|---|
| 51 | /* Pull parser */
|
|---|
| 52 |
|
|---|
| 53 | xmlFuzzMemSetLimit(maxAlloc);
|
|---|
| 54 | doc = xmlReadMemory(docBuffer, docSize, docUrl, NULL, opts);
|
|---|
| 55 |
|
|---|
| 56 | #ifdef LIBXML_OUTPUT_ENABLED
|
|---|
| 57 | {
|
|---|
| 58 | xmlChar *out;
|
|---|
| 59 | int outSize;
|
|---|
| 60 |
|
|---|
| 61 | /* Also test the serializer. */
|
|---|
| 62 | xmlDocDumpMemory(doc, &out, &outSize);
|
|---|
| 63 | xmlFree(out);
|
|---|
| 64 | }
|
|---|
| 65 | #endif
|
|---|
| 66 |
|
|---|
| 67 | xmlFreeDoc(doc);
|
|---|
| 68 |
|
|---|
| 69 | /* Push parser */
|
|---|
| 70 |
|
|---|
| 71 | #ifdef LIBXML_PUSH_ENABLED
|
|---|
| 72 | {
|
|---|
| 73 | static const size_t maxChunkSize = 128;
|
|---|
| 74 | xmlParserCtxtPtr ctxt;
|
|---|
| 75 | size_t consumed, chunkSize;
|
|---|
| 76 |
|
|---|
| 77 | xmlFuzzMemSetLimit(maxAlloc);
|
|---|
| 78 | ctxt = xmlCreatePushParserCtxt(NULL, NULL, NULL, 0, docUrl);
|
|---|
| 79 | if (ctxt == NULL)
|
|---|
| 80 | goto exit;
|
|---|
| 81 | xmlCtxtUseOptions(ctxt, opts);
|
|---|
| 82 |
|
|---|
| 83 | for (consumed = 0; consumed < docSize; consumed += chunkSize) {
|
|---|
| 84 | chunkSize = docSize - consumed;
|
|---|
| 85 | if (chunkSize > maxChunkSize)
|
|---|
| 86 | chunkSize = maxChunkSize;
|
|---|
| 87 | xmlParseChunk(ctxt, docBuffer + consumed, chunkSize, 0);
|
|---|
| 88 | }
|
|---|
| 89 |
|
|---|
| 90 | xmlParseChunk(ctxt, NULL, 0, 1);
|
|---|
| 91 | xmlFreeDoc(ctxt->myDoc);
|
|---|
| 92 | xmlFreeParserCtxt(ctxt);
|
|---|
| 93 | }
|
|---|
| 94 | #endif
|
|---|
| 95 |
|
|---|
| 96 | /* Reader */
|
|---|
| 97 |
|
|---|
| 98 | #ifdef LIBXML_READER_ENABLED
|
|---|
| 99 | {
|
|---|
| 100 | xmlTextReaderPtr reader;
|
|---|
| 101 | int j;
|
|---|
| 102 |
|
|---|
| 103 | xmlFuzzMemSetLimit(maxAlloc);
|
|---|
| 104 | reader = xmlReaderForMemory(docBuffer, docSize, NULL, NULL, opts);
|
|---|
| 105 | if (reader == NULL)
|
|---|
| 106 | goto exit;
|
|---|
| 107 | while (xmlTextReaderRead(reader) == 1) {
|
|---|
| 108 | if (xmlTextReaderNodeType(reader) == XML_ELEMENT_NODE) {
|
|---|
| 109 | int i, n = xmlTextReaderAttributeCount(reader);
|
|---|
| 110 | for (i=0; i<n; i++) {
|
|---|
| 111 | xmlTextReaderMoveToAttributeNo(reader, i);
|
|---|
| 112 | while (xmlTextReaderReadAttributeValue(reader) == 1);
|
|---|
| 113 | }
|
|---|
| 114 | }
|
|---|
| 115 | }
|
|---|
| 116 | for (j = 0; j < 10; j++)
|
|---|
| 117 | xmlTextReaderRead(reader);
|
|---|
| 118 | xmlFreeTextReader(reader);
|
|---|
| 119 | }
|
|---|
| 120 | #endif
|
|---|
| 121 |
|
|---|
| 122 | exit:
|
|---|
| 123 | xmlFuzzMemSetLimit(0);
|
|---|
| 124 | xmlFuzzDataCleanup();
|
|---|
| 125 | xmlResetLastError();
|
|---|
| 126 | return(0);
|
|---|
| 127 | }
|
|---|
| 128 |
|
|---|
