[libxml2]Add libxml2 library

2026-07-26 16:57:28 +08:00
parent 0a44ec8a06
commit e841ac915d
3790 changed files with 668244 additions and 0 deletions
@@ -0,0 +1,236 @@
+/*
+ * html.c: a libFuzzer target to test several HTML parser interfaces.
+ *
+ * See Copyright for the status of this software.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <libxml/HTMLparser.h>
+#include <libxml/HTMLtree.h>
+#include <libxml/catalog.h>
+#include "fuzz.h"
+
+int
+LLVMFuzzerInitialize(int *argc ATTRIBUTE_UNUSED,
+                     char ***argv ATTRIBUTE_UNUSED) {
+    xmlFuzzMemSetup();
+    xmlInitParser();
+#ifdef LIBXML_CATALOG_ENABLED
+    xmlInitializeCatalog();
+    xmlCatalogSetDefaults(XML_CATA_ALLOW_NONE);
+#endif
+
+    return 0;
+}
+
+int
+LLVMFuzzerTestOneInput(const char *data, size_t size) {
+    xmlParserCtxtPtr ctxt;
+    htmlDocPtr doc;
+    const char *docBuffer;
+    size_t failurePos, docSize, maxChunkSize;
+    int opts, errorCode;
+#ifdef LIBXML_OUTPUT_ENABLED
+    xmlOutputBufferPtr out = NULL;
+#endif
+
+    xmlFuzzDataInit(data, size);
+    opts = (int) xmlFuzzReadInt(4);
+    failurePos = xmlFuzzReadInt(4) % (size + 100);
+
+    maxChunkSize = xmlFuzzReadInt(4) % (size + size / 8 + 1);
+    if (maxChunkSize == 0)
+        maxChunkSize = 1;
+
+    docBuffer = xmlFuzzReadRemaining(&docSize);
+    if (docBuffer == NULL) {
+        xmlFuzzDataCleanup();
+        return(0);
+    }
+
+    /* Pull parser */
+
+    xmlFuzzInjectFailure(failurePos);
+    ctxt = htmlNewParserCtxt();
+    if (ctxt == NULL) {
+        errorCode = XML_ERR_NO_MEMORY;
+    } else {
+        xmlCtxtSetErrorHandler(ctxt, xmlFuzzSErrorFunc, NULL);
+        doc = htmlCtxtReadMemory(ctxt, docBuffer, docSize, NULL, NULL, opts);
+        errorCode = ctxt->errNo;
+        xmlFuzzCheckFailureReport("htmlCtxtReadMemory",
+                                  errorCode == XML_ERR_NO_MEMORY,
+                                  errorCode == XML_IO_EIO);
+
+        if (doc != NULL) {
+            xmlDocPtr copy;
+
+#ifdef LIBXML_OUTPUT_ENABLED
+            const xmlChar *content;
+
+            /*
+             * Also test the serializer. Call htmlDocContentDumpOutput with our
+             * own buffer to avoid encoding the output. The HTML encoding is
+             * excruciatingly slow (see htmlEntityValueLookup).
+             */
+            out = xmlAllocOutputBuffer(NULL);
+            htmlDocContentDumpOutput(out, doc, NULL);
+            content = xmlOutputBufferGetContent(out);
+            xmlFuzzCheckFailureReport("htmlDocContentDumpOutput",
+                                      content == NULL, 0);
+            if (content == NULL) {
+                xmlOutputBufferClose(out);
+                out = NULL;
+            }
+#endif
+
+            copy = xmlCopyDoc(doc, 1);
+            xmlFuzzCheckFailureReport("xmlCopyNode", copy == NULL, 0);
+            xmlFreeDoc(copy);
+
+            xmlFreeDoc(doc);
+        }
+
+        htmlFreeParserCtxt(ctxt);
+    }
+
+
+    /* Push parser */
+
+#ifdef LIBXML_PUSH_ENABLED
+    xmlFuzzInjectFailure(failurePos);
+    ctxt = htmlCreatePushParserCtxt(NULL, NULL, NULL, 0, NULL,
+                                    XML_CHAR_ENCODING_NONE);
+
+    if (ctxt != NULL) {
+        size_t consumed;
+        int errorCodePush, numChunks, maxChunks;
+
+        xmlCtxtSetErrorHandler(ctxt, xmlFuzzSErrorFunc, NULL);
+        htmlCtxtUseOptions(ctxt, opts);
+
+        consumed = 0;
+        numChunks = 0;
+        maxChunks = 50 + docSize / 100;
+        while (numChunks == 0 ||
+               (consumed < docSize && numChunks < maxChunks)) {
+            size_t chunkSize;
+            int terminate;
+
+            numChunks += 1;
+            chunkSize = docSize - consumed;
+
+            if (numChunks < maxChunks && chunkSize > maxChunkSize) {
+                chunkSize = maxChunkSize;
+                terminate = 0;
+            } else {
+                terminate = 1;
+            }
+
+            htmlParseChunk(ctxt, docBuffer + consumed, chunkSize, terminate);
+            consumed += chunkSize;
+        }
+
+        errorCodePush = ctxt->errNo;
+        xmlFuzzCheckFailureReport("htmlParseChunk",
+                                  errorCodePush == XML_ERR_NO_MEMORY,
+                                  errorCodePush == XML_IO_EIO);
+        doc = ctxt->myDoc;
+
+        /*
+         * Push and pull parser differ in when exactly they
+         * stop parsing, and the error code is the *last* error
+         * reported, so we can't check whether the codes match.
+         */
+        if (errorCode != XML_ERR_NO_MEMORY &&
+            errorCode != XML_IO_EIO &&
+            errorCodePush != XML_ERR_NO_MEMORY &&
+            errorCodePush != XML_IO_EIO &&
+            (errorCode == XML_ERR_OK) != (errorCodePush == XML_ERR_OK)) {
+            fprintf(stderr, "pull/push parser error mismatch: %d != %d\n",
+                    errorCode, errorCodePush);
+#if 0
+            FILE *f = fopen("c.html", "wb");
+            fwrite(docBuffer, docSize, 1, f);
+            fclose(f);
+            fprintf(stderr, "opts: %X\n", opts);
+#endif
+            abort();
+        }
+
+#ifdef LIBXML_OUTPUT_ENABLED
+        /*
+         * Verify that pull and push parser produce the same result.
+         *
+         * The NOBLANKS option doesn't work reliably in push mode.
+         */
+        if ((opts & XML_PARSE_NOBLANKS) == 0 &&
+            errorCode == XML_ERR_OK &&
+            errorCodePush == XML_ERR_OK &&
+            out != NULL) {
+            xmlOutputBufferPtr outPush;
+            const xmlChar *content, *contentPush;
+
+            outPush = xmlAllocOutputBuffer(NULL);
+            htmlDocContentDumpOutput(outPush, doc, NULL);
+            content = xmlOutputBufferGetContent(out);
+            contentPush = xmlOutputBufferGetContent(outPush);
+
+            if (content != NULL && contentPush != NULL) {
+                size_t outSize = xmlOutputBufferGetSize(out);
+
+                if (outSize != xmlOutputBufferGetSize(outPush) ||
+                    memcmp(content, contentPush, outSize) != 0) {
+                    fprintf(stderr, "pull/push parser roundtrip "
+                            "mismatch\n");
+#if 0
+                    FILE *f = fopen("c.html", "wb");
+                    fwrite(docBuffer, docSize, 1, f);
+                    fclose(f);
+                    fprintf(stderr, "opts: %X\n", opts);
+                    fprintf(stderr, "---\n%s\n---\n%s\n---\n",
+                            xmlOutputBufferGetContent(out),
+                            xmlOutputBufferGetContent(outPush));
+#endif
+                    abort();
+                }
+            }
+
+            xmlOutputBufferClose(outPush);
+        }
+#endif
+
+        xmlFreeDoc(doc);
+        htmlFreeParserCtxt(ctxt);
+    }
+#endif
+
+    /* Cleanup */
+
+#ifdef LIBXML_OUTPUT_ENABLED
+    xmlOutputBufferClose(out);
+#endif
+
+    xmlFuzzInjectFailure(0);
+    xmlFuzzDataCleanup();
+    xmlResetLastError();
+
+    return(0);
+}
+
+size_t
+LLVMFuzzerCustomMutator(char *data, size_t size, size_t maxSize,
+                        unsigned seed) {
+    static const xmlFuzzChunkDesc chunks[] = {
+        { 4, XML_FUZZ_PROB_ONE / 10 }, /* opts */
+        { 4, XML_FUZZ_PROB_ONE / 10 }, /* failurePos */
+        { 0, 0 }
+    };
+
+    return xmlFuzzMutateChunks(chunks, data, size, maxSize, seed,
+                               LLVMFuzzerMutate);
+}
+