1 /*
2 * uri.c: a libFuzzer target to test the URI module.
3 *
4 * See Copyright for the status of this software.
5 */
6
7 #include <libxml/uri.h>
8 #include "fuzz.h"
9
10 int
LLVMFuzzerInitialize(int * argc ATTRIBUTE_UNUSED,char *** argv ATTRIBUTE_UNUSED)11 LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED,
12 char ***argv ATTRIBUTE_UNUSED) {
13 xmlFuzzMemSetup();
14
15 return 0;
16 }
17
18 int
LLVMFuzzerTestOneInput(const char * data,size_t size)19 LLVMFuzzerTestOneInput(const char *data, size_t size) {
20 xmlURIPtr uri;
21 size_t maxAlloc;
22 const char *str1, *str2;
23 char *copy;
24 xmlChar *strRes;
25 int intRes;
26
27 if (size > 10000)
28 return(0);
29
30 xmlFuzzDataInit(data, size);
31 maxAlloc = xmlFuzzReadInt(4) % (size * 8 + 100);
32 str1 = xmlFuzzReadString(NULL);
33 str2 = xmlFuzzReadString(NULL);
34
35 xmlFuzzMemSetLimit(maxAlloc);
36
37 xmlFuzzResetMallocFailed();
38 intRes = xmlParseURISafe(str1, &uri);
39 xmlFuzzCheckMallocFailure("xmlParseURISafe", intRes == -1);
40
41 if (uri != NULL) {
42 xmlFuzzResetMallocFailed();
43 strRes = xmlSaveUri(uri);
44 xmlFuzzCheckMallocFailure("xmlSaveURI", strRes == NULL);
45 xmlFree(strRes);
46 xmlFreeURI(uri);
47 }
48
49 xmlFreeURI(xmlParseURI(str1));
50
51 uri = xmlParseURIRaw(str1, 1);
52 xmlFree(xmlSaveUri(uri));
53 xmlFreeURI(uri);
54
55 xmlFuzzResetMallocFailed();
56 strRes = BAD_CAST xmlURIUnescapeString(str1, -1, NULL);
57 xmlFuzzCheckMallocFailure("xmlURIUnescapeString",
58 str1 != NULL && strRes == NULL);
59 xmlFree(strRes);
60
61 xmlFree(xmlURIEscape(BAD_CAST str1));
62
63 xmlFuzzResetMallocFailed();
64 strRes = xmlCanonicPath(BAD_CAST str1);
65 xmlFuzzCheckMallocFailure("xmlCanonicPath",
66 str1 != NULL && strRes == NULL);
67 xmlFree(strRes);
68
69 xmlFuzzResetMallocFailed();
70 strRes = xmlPathToURI(BAD_CAST str1);
71 xmlFuzzCheckMallocFailure("xmlPathToURI", str1 != NULL && strRes == NULL);
72 xmlFree(strRes);
73
74 xmlFuzzResetMallocFailed();
75 intRes = xmlBuildURISafe(BAD_CAST str2, BAD_CAST str1, &strRes);
76 xmlFuzzCheckMallocFailure("xmlBuildURISafe", intRes == -1);
77 xmlFree(strRes);
78
79 xmlFree(xmlBuildURI(BAD_CAST str2, BAD_CAST str1));
80
81 xmlFuzzResetMallocFailed();
82 intRes = xmlBuildRelativeURISafe(BAD_CAST str2, BAD_CAST str1, &strRes);
83 xmlFuzzCheckMallocFailure("xmlBuildRelativeURISafe", intRes == -1);
84 xmlFree(strRes);
85
86 xmlFree(xmlBuildRelativeURI(BAD_CAST str2, BAD_CAST str1));
87
88 xmlFuzzResetMallocFailed();
89 strRes = xmlURIEscapeStr(BAD_CAST str1, BAD_CAST str2);
90 xmlFuzzCheckMallocFailure("xmlURIEscapeStr",
91 str1 != NULL && strRes == NULL);
92 xmlFree(strRes);
93
94 copy = (char *) xmlCharStrdup(str1);
95 xmlNormalizeURIPath(copy);
96 xmlFree(copy);
97
98 xmlFuzzMemSetLimit(0);
99 xmlFuzzDataCleanup();
100
101 return 0;
102 }
103
104