kc3-lang/libxml2/fuzz/xpath.c
Tag
-
Show log
Commit
-
Hash : 85c817a2
Author :
Date : 2021-02-22T21:28:21
Improve fuzzer stability - Add more calls to xmlInitializeCatalog. - Call xmlResetLastError after fuzzing each input.
-
fuzz/xpath.c
-
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
/* * xpath.c: a libFuzzer target to test XPath and XPointer expressions. * * See Copyright for the status of this software. */ #include <libxml/parser.h> #include <libxml/xpointer.h> #include "fuzz.h" int LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED, char ***argv ATTRIBUTE_UNUSED) { xmlInitParser(); xmlSetGenericErrorFunc(NULL, xmlFuzzErrorFunc); return 0; } int LLVMFuzzerTestOneInput(const char *data, size_t size) { xmlDocPtr doc; const char *expr, *xml; size_t exprSize, xmlSize; if (size > 10000) return(0); xmlFuzzDataInit(data, size); expr = xmlFuzzReadString(&exprSize); xml = xmlFuzzReadString(&xmlSize); /* Recovery mode allows more input to be fuzzed. */ doc = xmlReadMemory(xml, xmlSize, NULL, NULL, XML_PARSE_RECOVER); if (doc != NULL) { xmlXPathContextPtr xpctxt = xmlXPathNewContext(doc); /* Operation limit to avoid timeout */ xpctxt->opLimit = 500000; xmlXPathFreeObject(xmlXPtrEval(BAD_CAST expr, xpctxt)); xmlXPathFreeContext(xpctxt); } xmlFreeDoc(doc); xmlFuzzDataCleanup(); xmlResetLastError(); return(0); }