kc3-lang/libxml2/fuzz/testFuzzer.c

• Show log

  Commit

• Hash : 0d9da029
  Author :
  Date : 2020-08-24T03:16:25
  

  Test fuzz targets with dummy driver
  
  Run fuzz targets with files in seed corpus during test.
  

Download

• fuzz/testFuzzer.c

• /*
   * testFuzzer.c: Test program for the custom entity loader used to fuzz
   * with multiple inputs.
   *
   * See Copyright for the status of this software.
   */
  
  #include <string.h>
  #include <glob.h>
  #include <libxml/parser.h>
  #include <libxml/tree.h>
  #include <libxml/xmlstring.h>
  #include "fuzz.h"
  
  #define LLVMFuzzerInitialize fuzzHtmlInit
  #define LLVMFuzzerTestOneInput fuzzHtml
  #include "html.c"
  #undef LLVMFuzzerInitialize
  #undef LLVMFuzzerTestOneInput
  
  #define LLVMFuzzerInitialize fuzzRegexpInit
  #define LLVMFuzzerTestOneInput fuzzRegexp
  #include "regexp.c"
  #undef LLVMFuzzerInitialize
  #undef LLVMFuzzerTestOneInput
  
  #define LLVMFuzzerInitialize fuzzSchemaInit
  #define LLVMFuzzerTestOneInput fuzzSchema
  #include "schema.c"
  #undef LLVMFuzzerInitialize
  #undef LLVMFuzzerTestOneInput
  
  #define LLVMFuzzerInitialize fuzzUriInit
  #define LLVMFuzzerTestOneInput fuzzUri
  #include "uri.c"
  #undef LLVMFuzzerInitialize
  #undef LLVMFuzzerTestOneInput
  
  #define LLVMFuzzerInitialize fuzzXmlInit
  #define LLVMFuzzerTestOneInput fuzzXml
  #include "xml.c"
  #undef LLVMFuzzerInitialize
  #undef LLVMFuzzerTestOneInput
  
  #define LLVMFuzzerInitialize fuzzXPathInit
  #define LLVMFuzzerTestOneInput fuzzXPath
  #include "xpath.c"
  #undef LLVMFuzzerInitialize
  #undef LLVMFuzzerTestOneInput
  
  typedef int
  (*initFunc)(int *argc, char ***argv);
  typedef int
  (*fuzzFunc)(const char *data, size_t size);
  
  int numInputs;
  
  static int
  testFuzzer(initFunc init, fuzzFunc fuzz, const char *pattern) {
      glob_t globbuf;
      int ret = -1;
      int i;
  
      if (glob(pattern, 0, NULL, &globbuf) != 0) {
          fprintf(stderr, "pattern %s matches no files\n", pattern);
          return(-1);
      }
  
      if (init != NULL)
          init(NULL, NULL);
  
      for (i = 0; i < globbuf.gl_pathc; i++) {
          const char *path = globbuf.gl_pathv[i];
          char *data;
          size_t size;
  
          data = xmlSlurpFile(path, &size);
          if (data == NULL) {
              fprintf(stderr, "couldn't read %s\n", path);
              goto error;
          }
          fuzz(data, size);
          xmlFree(data);
  
          numInputs++;
      }
  
      ret = 0;
  error:
      globfree(&globbuf);
      return(ret);
  }
  
  static int
  testEntityLoader() {
      static const char data[] =
          "doc.xml\\\n"
          "<!DOCTYPE doc SYSTEM \"doc.dtd\">\n"
          "<doc>&ent;</doc>\\\n"
          "doc.dtd\\\n"
          "<!ELEMENT doc (#PCDATA)>\n"
          "<!ENTITY ent SYSTEM \"ent.txt\">\\\n"
          "ent.txt\\\n"
          "Hello, world!\\\n";
      static xmlChar expected[] =
          "<?xml version=\"1.0\"?>\n"
          "<!DOCTYPE doc SYSTEM \"doc.dtd\">\n"
          "<doc>Hello, world!</doc>\n";
      const char *docBuffer;
      size_t docSize;
      xmlDocPtr doc;
      xmlChar *out;
      int ret = 0;
  
      xmlSetExternalEntityLoader(xmlFuzzEntityLoader);
  
      xmlFuzzDataInit(data, sizeof(data) - 1);
      xmlFuzzReadEntities();
      docBuffer = xmlFuzzMainEntity(&docSize);
      doc = xmlReadMemory(docBuffer, docSize, NULL, NULL,
                          XML_PARSE_NOENT | XML_PARSE_DTDLOAD);
  
      xmlDocDumpMemory(doc, &out, NULL);
      if (xmlStrcmp(out, expected) != 0) {
          fprintf(stderr, "Expected:\n%sGot:\n%s", expected, out);
          ret = 1;
      }
  
      xmlFree(out);
      xmlFreeDoc(doc);
      xmlFuzzDataCleanup();
  
      return(ret);
  }
  
  int
  main() {
      int ret = 0;
  
      if (testEntityLoader() != 0)
          ret = 1;
      if (testFuzzer(fuzzHtmlInit, fuzzHtml, "seed/html/*") != 0)
          ret = 1;
      if (testFuzzer(fuzzRegexpInit, fuzzRegexp, "seed/regexp/*") != 0)
          ret = 1;
      if (testFuzzer(fuzzSchemaInit, fuzzSchema, "seed/schema/*") != 0)
          ret = 1;
      if (testFuzzer(NULL, fuzzUri, "seed/uri/*") != 0)
          ret = 1;
      if (testFuzzer(fuzzXmlInit, fuzzXml, "seed/xml/*") != 0)
          ret = 1;
      if (testFuzzer(fuzzXPathInit, fuzzXPath, "seed/xpath/*") != 0)
          ret = 1;
  
      if (ret == 0)
          printf("Successfully tested %d inputs\n", numInputs);
  
      return(ret);
  }
  
  

Download