1 /*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * https://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <assert.h>
18 #include <limits.h> // for INT_MAX
19 #include <stdint.h>
20 #include <string.h>
21
22 #include "expat.h"
23 #include "siphash.h"
24
25 // Macros to convert preprocessor macros to string literals. See
26 // https://gcc.gnu.org/onlinedocs/gcc-3.4.3/cpp/Stringification.html
27 #define xstr(s) str(s)
28 #define str(s) #s
29
30 // The encoder type that we wish to fuzz should come from the compile-time
31 // definition `ENCODING_FOR_FUZZING`. This allows us to have a separate fuzzer
32 // binary for
33 #ifndef ENCODING_FOR_FUZZING
34 # error "ENCODING_FOR_FUZZING was not provided to this fuzz target."
35 #endif
36
37 // 16-byte deterministic hash key.
38 static unsigned char hash_key[16] = "FUZZING IS FUN!";
39
40 static void XMLCALL
start(void * userData,const XML_Char * name,const XML_Char ** atts)41 start(void *userData, const XML_Char *name, const XML_Char **atts) {
42 (void)userData;
43 (void)name;
44 (void)atts;
45 }
46 static void XMLCALL
end(void * userData,const XML_Char * name)47 end(void *userData, const XML_Char *name) {
48 (void)userData;
49 (void)name;
50 }
51
52 static void XMLCALL
may_stop_character_handler(void * userData,const XML_Char * s,int len)53 may_stop_character_handler(void *userData, const XML_Char *s, int len) {
54 XML_Parser parser = (XML_Parser)userData;
55 if (len > 1 && s[0] == 's') {
56 XML_StopParser(parser, s[1] == 'r' ? XML_FALSE : XML_TRUE);
57 }
58 }
59
60 static void
ParseOneInput(XML_Parser p,const uint8_t * data,size_t size)61 ParseOneInput(XML_Parser p, const uint8_t *data, size_t size) {
62 // Set the hash salt using siphash to generate a deterministic hash.
63 struct sipkey *key = sip_keyof(hash_key);
64 XML_SetHashSalt(p, (unsigned long)siphash24(data, size, key));
65 (void)sip24_valid;
66
67 XML_SetUserData(p, p);
68 XML_SetElementHandler(p, start, end);
69 XML_SetCharacterDataHandler(p, may_stop_character_handler);
70 assert(size <= INT_MAX);
71 void *buf = XML_GetBuffer(p, (int)size);
72 assert(buf);
73 memcpy(buf, data, size);
74 XML_ParseBuffer(p, (int)size, 0);
75 buf = XML_GetBuffer(p, (int)size);
76 if (buf == NULL) {
77 return;
78 }
79 memcpy(buf, data, size);
80 if (XML_ParseBuffer(p, (int)size, 1) == XML_STATUS_ERROR) {
81 XML_ErrorString(XML_GetErrorCode(p));
82 }
83 XML_GetCurrentLineNumber(p);
84 if (size % 2) {
85 XML_ParserReset(p, NULL);
86 }
87 }
88
89 int
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)90 LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
91 if (size == 0)
92 return 0;
93
94 XML_Parser parentParser = XML_ParserCreate(xstr(ENCODING_FOR_FUZZING));
95 assert(parentParser);
96 ParseOneInput(parentParser, data, size);
97 // not freed yet, but used later and freed then
98
99 XML_Parser namespaceParser = XML_ParserCreateNS(NULL, '!');
100 assert(namespaceParser);
101 ParseOneInput(namespaceParser, data, size);
102 XML_ParserFree(namespaceParser);
103
104 XML_Parser externalEntityParser
105 = XML_ExternalEntityParserCreate(parentParser, "e1", NULL);
106 if (externalEntityParser != NULL) {
107 ParseOneInput(externalEntityParser, data, size);
108 XML_ParserFree(externalEntityParser);
109 }
110
111 XML_Parser externalDtdParser
112 = XML_ExternalEntityParserCreate(parentParser, NULL, NULL);
113 if (externalDtdParser != NULL) {
114 ParseOneInput(externalDtdParser, data, size);
115 XML_ParserFree(externalDtdParser);
116 }
117
118 // finally frees this parser which served as parent
119 XML_ParserFree(parentParser);
120 return 0;
121 }
122