File size: 3,054 Bytes
6baed57
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
/*
 * fuzz.h: Common functions and macros for fuzzing.
 *
 * See Copyright for the status of this software.
 */

#ifndef __XML_FUZZERCOMMON_H__
#define __XML_FUZZERCOMMON_H__

#include <stddef.h>
#include <stdio.h>
#include <libxml/parser.h>

#ifdef __cplusplus
extern "C" {
#endif

#if __GNUC__ * 100 + __GNUC_MINOR__ >= 207 || defined(__clang__)
  #define ATTRIBUTE_UNUSED __attribute__((unused))
#else
  #define ATTRIBUTE_UNUSED
#endif

#if defined(LIBXML_HTML_ENABLED)
  #define HAVE_HTML_FUZZER
#endif
#if 1
  #define HAVE_LINT_FUZZER
#endif
#if defined(LIBXML_READER_ENABLED)
  #define HAVE_READER_FUZZER
#endif
#if defined(LIBXML_REGEXP_ENABLED)
  #define HAVE_REGEXP_FUZZER
#endif
#if defined(LIBXML_SCHEMAS_ENABLED)
  #define HAVE_SCHEMA_FUZZER
#endif
#if 1
  #define HAVE_URI_FUZZER
#endif
#if defined(LIBXML_VALID_ENABLED)
  #define HAVE_VALID_FUZZER
#endif
#if defined(LIBXML_XINCLUDE_ENABLED)
  #define HAVE_XINCLUDE_FUZZER
#endif
#if 1
  #define HAVE_XML_FUZZER
#endif
#if defined(LIBXML_XPTR_ENABLED)
  #define HAVE_XPATH_FUZZER
#endif

#define XML_FUZZ_PROB_ONE (1u << 16)

typedef size_t
(*xmlFuzzMutator)(char *data, size_t size, size_t maxSize);

typedef struct {
    unsigned size;
    unsigned mutateProb;
} xmlFuzzChunkDesc;

int
LLVMFuzzerInitialize(int *argc, char ***argv);

int
LLVMFuzzerTestOneInput(const char *data, size_t size);

size_t
LLVMFuzzerMutate(char *data, size_t size, size_t maxSize);

size_t
LLVMFuzzerCustomMutator(char *data, size_t size, size_t maxSize,
                        unsigned seed);

void
xmlFuzzErrorFunc(void *ctx, const char *msg, ...);

void
xmlFuzzSErrorFunc(void *ctx, const xmlError *error);

void
xmlFuzzMemSetup(void);

void
xmlFuzzInjectFailure(size_t failurePos);

int
xmlFuzzMallocFailed(void);

void
xmlFuzzResetFailure(void);

void
xmlFuzzCheckFailureReport(const char *func, int oomReport, int ioReport);

void
xmlFuzzDataInit(const char *data, size_t size);

void
xmlFuzzDataCleanup(void);

void
xmlFuzzWriteInt(FILE *out, size_t v, int size);

size_t
xmlFuzzReadInt(int size);

size_t
xmlFuzzBytesRemaining(void);

const char *
xmlFuzzReadRemaining(size_t *size);

void
xmlFuzzWriteString(FILE *out, const char *str);

const char *
xmlFuzzReadString(size_t *size);

void
xmlFuzzReadEntities(void);

const char *
xmlFuzzMainUrl(void);

const char *
xmlFuzzMainEntity(size_t *size);

const char *
xmlFuzzSecondaryUrl(void);

const char *
xmlFuzzSecondaryEntity(size_t *size);

xmlParserErrors
xmlFuzzResourceLoader(void *data, const char *URL, const char *ID,
                      xmlResourceType type, xmlParserInputFlags flags,
                      xmlParserInputPtr *out);

char *
xmlSlurpFile(const char *path, size_t *size);

int
xmlFuzzOutputWrite(void *ctxt, const char *buffer, int len);

int
xmlFuzzOutputClose(void *ctxt);

size_t
xmlFuzzMutateChunks(const xmlFuzzChunkDesc *chunks,
                    char *data, size_t size, size_t maxSize, unsigned seed,
                    xmlFuzzMutator mutator);

#ifdef __cplusplus
}
#endif

#endif /* __XML_FUZZERCOMMON_H__ */