1  /*
       2   * xml.c: a libFuzzer target to test several XML parser interfaces.
       3   *
       4   * See Copyright for the status of this software.
       5   */
       6  
       7  #include <libxml/catalog.h>
       8  #include <libxml/parser.h>
       9  #include <libxml/tree.h>
      10  #include <libxml/xmlerror.h>
      11  #include <libxml/xmlreader.h>
      12  #include "fuzz.h"
      13  
      14  int
      15  LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED,
      16                       char ***argv ATTRIBUTE_UNUSED) {
      17      xmlFuzzMemSetup();
      18      xmlInitParser();
      19  #ifdef LIBXML_CATALOG_ENABLED
      20      xmlInitializeCatalog();
      21  #endif
      22      xmlSetGenericErrorFunc(NULL, xmlFuzzErrorFunc);
      23      xmlSetExternalEntityLoader(xmlFuzzEntityLoader);
      24  
      25      return 0;
      26  }
      27  
      28  int
      29  LLVMFuzzerTestOneInput(const char *data, size_t size) {
      30      xmlDocPtr doc;
      31      const char *docBuffer, *docUrl;
      32      size_t maxAlloc, docSize;
      33      int opts;
      34  
      35      xmlFuzzDataInit(data, size);
      36      opts = (int) xmlFuzzReadInt(4);
      37      /*
      38       * Disable options that are known to cause timeouts
      39       */
      40      opts &= ~XML_PARSE_XINCLUDE &
      41              ~XML_PARSE_DTDVALID &
      42              ~XML_PARSE_SAX1;
      43      maxAlloc = xmlFuzzReadInt(4) % (size + 1);
      44  
      45      xmlFuzzReadEntities();
      46      docBuffer = xmlFuzzMainEntity(&docSize);
      47      docUrl = xmlFuzzMainUrl();
      48      if (docBuffer == NULL)
      49          goto exit;
      50  
      51      /* Pull parser */
      52  
      53      xmlFuzzMemSetLimit(maxAlloc);
      54      doc = xmlReadMemory(docBuffer, docSize, docUrl, NULL, opts);
      55  
      56  #ifdef LIBXML_OUTPUT_ENABLED
      57      {
      58          xmlChar *out;
      59          int outSize;
      60  
      61          /* Also test the serializer. */
      62          xmlDocDumpMemory(doc, &out, &outSize);
      63          xmlFree(out);
      64      }
      65  #endif
      66  
      67      xmlFreeDoc(doc);
      68  
      69      /* Push parser */
      70  
      71  #ifdef LIBXML_PUSH_ENABLED
      72      {
      73          static const size_t maxChunkSize = 128;
      74          xmlParserCtxtPtr ctxt;
      75          size_t consumed, chunkSize;
      76  
      77          xmlFuzzMemSetLimit(maxAlloc);
      78          ctxt = xmlCreatePushParserCtxt(NULL, NULL, NULL, 0, docUrl);
      79          if (ctxt == NULL)
      80              goto exit;
      81          xmlCtxtUseOptions(ctxt, opts);
      82  
      83          for (consumed = 0; consumed < docSize; consumed += chunkSize) {
      84              chunkSize = docSize - consumed;
      85              if (chunkSize > maxChunkSize)
      86                  chunkSize = maxChunkSize;
      87              xmlParseChunk(ctxt, docBuffer + consumed, chunkSize, 0);
      88          }
      89  
      90          xmlParseChunk(ctxt, NULL, 0, 1);
      91          xmlFreeDoc(ctxt->myDoc);
      92          xmlFreeParserCtxt(ctxt);
      93      }
      94  #endif
      95  
      96      /* Reader */
      97  
      98  #ifdef LIBXML_READER_ENABLED
      99      {
     100          xmlTextReaderPtr reader;
     101          int j;
     102  
     103          xmlFuzzMemSetLimit(maxAlloc);
     104          reader = xmlReaderForMemory(docBuffer, docSize, NULL, NULL, opts);
     105          if (reader == NULL)
     106              goto exit;
     107          while (xmlTextReaderRead(reader) == 1) {
     108              if (xmlTextReaderNodeType(reader) == XML_ELEMENT_NODE) {
     109                  int i, n = xmlTextReaderAttributeCount(reader);
     110                  for (i=0; i<n; i++) {
     111                      xmlTextReaderMoveToAttributeNo(reader, i);
     112                      while (xmlTextReaderReadAttributeValue(reader) == 1);
     113                  }
     114              }
     115          }
     116          for (j = 0; j < 10; j++)
     117              xmlTextReaderRead(reader);
     118          xmlFreeTextReader(reader);
     119      }
     120  #endif
     121  
     122  exit:
     123      xmlFuzzMemSetLimit(0);
     124      xmlFuzzDataCleanup();
     125      xmlResetLastError();
     126      return(0);
     127  }
     128