diff options
author | Max Moroz <dor3s1@gmail.com> | 2017-02-15 16:31:15 +0100 |
---|---|---|
committer | Abhishek Arya <inferno@chromium.org> | 2017-02-15 07:31:15 -0800 |
commit | 69b9b7033f6d0ecbeed387580419d8b270105e8e (patch) | |
tree | 9624413fa494676040de7ae8ef2dab0ca4bf6e79 | |
parent | b5d293759abf55a4221ee673374f5abfcb1a888e (diff) |
[libxml2] Add hash-based combination of flags as an "options" argument. (#388)
-rw-r--r-- | projects/libxml2/libxml2_xml_read_memory_fuzzer.cc | 36 |
1 files changed, 24 insertions, 12 deletions
diff --git a/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc b/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc index 1b1fb8a1..4ae6035b 100644 --- a/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc +++ b/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc @@ -3,8 +3,12 @@ // found in the LICENSE file. #include <cassert> -#include <stddef.h> -#include <stdint.h> +#include <cstddef> +#include <cstdint> + +#include <functional> +#include <limits> +#include <string> #include "libxml/parser.h" #include "libxml/xmlsave.h" @@ -16,16 +20,24 @@ void ignore (void* ctx, const char* msg, ...) { extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { xmlSetGenericErrorFunc(NULL, &ignore); - if (auto doc = xmlReadMemory(reinterpret_cast<const char*>(data), - static_cast<int>(size), "noname.xml", NULL, - 0 /*or:XML_PARSE_RECOVER*/)) { - auto buf = xmlBufferCreate(); - assert(buf); - auto ctxt = xmlSaveToBuffer(buf, NULL, 0); - xmlSaveDoc(ctxt, doc); - xmlSaveClose(ctxt); - xmlFreeDoc(doc); - xmlBufferFree(buf); + // Test default empty options value and some random combination. + std::string data_string(reinterpret_cast<const char*>(data), size); + const std::size_t data_hash = std::hash<std::string>()(data_string); + const int max_option_value = std::numeric_limits<int>::max(); + const int random_option_value = data_hash % max_option_value; + const int options[] = {0, random_option_value}; + + for (const auto option_value : options) { + if (auto doc = xmlReadMemory(data_string.c_str(), data_string.length(), + "noname.xml", NULL, option_value)) { + auto buf = xmlBufferCreate(); + assert(buf); + auto ctxt = xmlSaveToBuffer(buf, NULL, 0); + xmlSaveDoc(ctxt, doc); + xmlSaveClose(ctxt); + xmlFreeDoc(doc); + xmlBufferFree(buf); + } } return 0; |