extend libxml2_xml_read_memory_fuzzer to call xmlSaveDoc (#387)

* extend libxml2_xml_read_memory_fuzzer to call xmlSaveDoc

1 files changed, 10 insertions, 1 deletions

diff --git a/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc b/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc
index 464a6e95..1b1fb8a1 100644
--- a/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc
+++ b/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc
@@ -2,10 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <cassert>
 #include <stddef.h>
 #include <stdint.h>
 
 #include "libxml/parser.h"
+#include "libxml/xmlsave.h"
 
 void ignore (void* ctx, const char* msg, ...) {
   // Error handler to avoid spam of error messages from libxml parser.
@@ -15,8 +17,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   xmlSetGenericErrorFunc(NULL, &ignore);
 
   if (auto doc = xmlReadMemory(reinterpret_cast<const char*>(data),
-                               static_cast<int>(size), "noname.xml", NULL, 0)) {
+                               static_cast<int>(size), "noname.xml", NULL,
+                               0 /*or:XML_PARSE_RECOVER*/)) {
+    auto buf = xmlBufferCreate();
+    assert(buf);
+    auto ctxt = xmlSaveToBuffer(buf, NULL, 0);
+    xmlSaveDoc(ctxt, doc);
+    xmlSaveClose(ctxt);
     xmlFreeDoc(doc);
+    xmlBufferFree(buf);
   }
 
   return 0;