niceSOFT/libxml2: XML parser and toolkit

fuzz/html.c
235 строк7 KB
Nick Wellnhofer
fuzz: Mutate fuzz data chunks separately
20 фев 2025, 14:22
20 фев 2025, 14:22c6c6d8a
/*
 * html.c: a libFuzzer target to test several HTML parser interfaces.
 *
 * See Copyright for the status of this software.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <libxml/HTMLparser.h>
#include <libxml/HTMLtree.h>
#include <libxml/catalog.h>
#include "fuzz.h"

int
LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED,
                     char ***argv ATTRIBUTE_UNUSED) {
    xmlFuzzMemSetup();
    xmlInitParser();
#ifdef LIBXML_CATALOG_ENABLED
    xmlInitializeCatalog();
    xmlCatalogSetDefaults(XML_CATA_ALLOW_NONE);
#endif

    return 0;
}

int
LLVMFuzzerTestOneInput(const char *data, size_t size) {
    xmlParserCtxtPtr ctxt;
    htmlDocPtr doc;
    const char *docBuffer;
    size_t failurePos, docSize, maxChunkSize;
    int opts, errorCode;
#ifdef LIBXML_OUTPUT_ENABLED
    xmlOutputBufferPtr out = NULL;
#endif

    xmlFuzzDataInit(data, size);
    opts = (int) xmlFuzzReadInt(4);
    failurePos = xmlFuzzReadInt(4) % (size + 100);

    maxChunkSize = xmlFuzzReadInt(4) % (size + size / 8 + 1);
    if (maxChunkSize == 0)
        maxChunkSize = 1;

    docBuffer = xmlFuzzReadRemaining(&docSize);
    if (docBuffer == NULL) {
        xmlFuzzDataCleanup();
        return(0);
    }

    /* Pull parser */

    xmlFuzzInjectFailure(failurePos);
    ctxt = htmlNewParserCtxt();
    if (ctxt == NULL) {
        errorCode = XML_ERR_NO_MEMORY;
    } else {
        xmlCtxtSetErrorHandler(ctxt, xmlFuzzSErrorFunc, NULL);
        doc = htmlCtxtReadMemory(ctxt, docBuffer, docSize, NULL, NULL, opts);
        errorCode = ctxt->errNo;
        xmlFuzzCheckFailureReport("htmlCtxtReadMemory",
                                  errorCode == XML_ERR_NO_MEMORY,
                                  errorCode == XML_IO_EIO);

        if (doc != NULL) {
            xmlDocPtr copy;

#ifdef LIBXML_OUTPUT_ENABLED
            const xmlChar *content;

            /*
             * Also test the serializer. Call htmlDocContentDumpOutput with our
             * own buffer to avoid encoding the output. The HTML encoding is
             * excruciatingly slow (see htmlEntityValueLookup).
             */
            out = xmlAllocOutputBuffer(NULL);
            htmlDocContentDumpOutput(out, doc, NULL);
            content = xmlOutputBufferGetContent(out);
            xmlFuzzCheckFailureReport("htmlDocContentDumpOutput",
                                      content == NULL, 0);
            if (content == NULL) {
                xmlOutputBufferClose(out);
                out = NULL;
            }
#endif

            copy = xmlCopyDoc(doc, 1);
            xmlFuzzCheckFailureReport("xmlCopyNode", copy == NULL, 0);
            xmlFreeDoc(copy);

            xmlFreeDoc(doc);
        }

        htmlFreeParserCtxt(ctxt);
    }


    /* Push parser */

#ifdef LIBXML_PUSH_ENABLED
    xmlFuzzInjectFailure(failurePos);
    ctxt = htmlCreatePushParserCtxt(NULL, NULL, NULL, 0, NULL,
                                    XML_CHAR_ENCODING_NONE);

    if (ctxt != NULL) {
        size_t consumed;
        int errorCodePush, numChunks, maxChunks;

        xmlCtxtSetErrorHandler(ctxt, xmlFuzzSErrorFunc, NULL);
        htmlCtxtUseOptions(ctxt, opts);

        consumed = 0;
        numChunks = 0;
        maxChunks = 50 + docSize / 100;
        while (numChunks == 0 ||
               (consumed < docSize && numChunks < maxChunks)) {
            size_t chunkSize;
            int terminate;

            numChunks += 1;
            chunkSize = docSize - consumed;

            if (numChunks < maxChunks && chunkSize > maxChunkSize) {
                chunkSize = maxChunkSize;
                terminate = 0;
            } else {
                terminate = 1;
            }

            htmlParseChunk(ctxt, docBuffer + consumed, chunkSize, terminate);
            consumed += chunkSize;
        }

        errorCodePush = ctxt->errNo;
        xmlFuzzCheckFailureReport("htmlParseChunk",
                                  errorCodePush == XML_ERR_NO_MEMORY,
                                  errorCodePush == XML_IO_EIO);
        doc = ctxt->myDoc;

        /*
         * Push and pull parser differ in when exactly they
         * stop parsing, and the error code is the *last* error
         * reported, so we can't check whether the codes match.
         */
        if (errorCode != XML_ERR_NO_MEMORY &&
            errorCode != XML_IO_EIO &&
            errorCodePush != XML_ERR_NO_MEMORY &&
            errorCodePush != XML_IO_EIO &&
            (errorCode == XML_ERR_OK) != (errorCodePush == XML_ERR_OK)) {
            fprintf(stderr, "pull/push parser error mismatch: %d != %d\n",
                    errorCode, errorCodePush);
#if 0
            FILE *f = fopen("c.html", "wb");
            fwrite(docBuffer, docSize, 1, f);
            fclose(f);
            fprintf(stderr, "opts: %X\n", opts);
#endif
            abort();
        }

#ifdef LIBXML_OUTPUT_ENABLED
        /*
         * Verify that pull and push parser produce the same result.
         *
         * The NOBLANKS option doesn't work reliably in push mode.
         */
        if ((opts & XML_PARSE_NOBLANKS) == 0 &&
            errorCode == XML_ERR_OK &&
            errorCodePush == XML_ERR_OK &&
            out != NULL) {
            xmlOutputBufferPtr outPush;
            const xmlChar *content, *contentPush;

            outPush = xmlAllocOutputBuffer(NULL);
            htmlDocContentDumpOutput(outPush, doc, NULL);
            content = xmlOutputBufferGetContent(out);
            contentPush = xmlOutputBufferGetContent(outPush);

            if (content != NULL && contentPush != NULL) {
                size_t outSize = xmlOutputBufferGetSize(out);

                if (outSize != xmlOutputBufferGetSize(outPush) ||
                    memcmp(content, contentPush, outSize) != 0) {
                    fprintf(stderr, "pull/push parser roundtrip "
                            "mismatch\n");
#if 0
                    FILE *f = fopen("c.html", "wb");
                    fwrite(docBuffer, docSize, 1, f);
                    fclose(f);
                    fprintf(stderr, "opts: %X\n", opts);
                    fprintf(stderr, "---\n%s\n---\n%s\n---\n",
                            xmlOutputBufferGetContent(out),
                            xmlOutputBufferGetContent(outPush));
#endif
                    abort();
                }
            }

            xmlOutputBufferClose(outPush);
        }
#endif

        xmlFreeDoc(doc);
        htmlFreeParserCtxt(ctxt);
    }
#endif

    /* Cleanup */

#ifdef LIBXML_OUTPUT_ENABLED
    xmlOutputBufferClose(out);
#endif

    xmlFuzzInjectFailure(0);
    xmlFuzzDataCleanup();
    xmlResetLastError();

    return(0);
}

size_t
LLVMFuzzerCustomMutator(char *data, size_t size, size_t maxSize,
                        unsigned seed) {
    static const xmlFuzzChunkDesc chunks[] = {
        { 4, XML_FUZZ_PROB_ONE / 10 }, /* opts */
        { 4, XML_FUZZ_PROB_ONE / 10 }, /* failurePos */
        { 0, 0 }
    };

    return xmlFuzzMutateChunks(chunks, data, size, maxSize, seed,
                               LLVMFuzzerMutate);
}