fuzz/fuzz.c

/*
 * fuzz.c: Common functions for fuzzing.
 *
 * See Copyright for the status of this software.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>

#include <libxml/hash.h>
#include <libxml/parser.h>
#include <libxml/parserInternals.h>
#include <libxml/tree.h>
#include <libxml/xmlIO.h>
#include "fuzz.h"

typedef struct {
    const char *data;
    size_t size;
} xmlFuzzEntityInfo;

/* Single static instance for now */
static struct {
    /* Original data */
    const char *data;
    size_t size;

    /* Remaining data */
    const char *ptr;
    size_t remaining;

    /* Buffer for unescaped strings */
    char *outBuf;
    char *outPtr; /* Free space at end of buffer */

    xmlHashTablePtr entities; /* Maps URLs to xmlFuzzEntityInfos */

    /* The first entity is the main entity. */
    const char *mainUrl;
    xmlFuzzEntityInfo *mainEntity;
    const char *secondaryUrl;
    xmlFuzzEntityInfo *secondaryEntity;
} fuzzData;

size_t fuzzNumAttempts;
size_t fuzzFailurePos;
int fuzzAllocFailed;
int fuzzIoFailed;

/**
 * xmlFuzzErrorFunc:
 *
 * An error function that simply discards all errors.
 */
void
xmlFuzzErrorFunc(void *ctx ATTRIBUTE_UNUSED, const char *msg ATTRIBUTE_UNUSED,
                 ...) {
}

/**
 * xmlFuzzSErrorFunc:
 *
 * A structured error function that simply discards all errors.
 */
void
xmlFuzzSErrorFunc(void *ctx ATTRIBUTE_UNUSED,
                  const xmlError *error ATTRIBUTE_UNUSED) {
}

/*
 * Failure injection.
 *
 * To debug issues involving injected failures, it's often helpful to set
 * FAILURE_ABORT to 1. This should provide a backtrace of the failed
 * operation.
 */

#define XML_FUZZ_FAILURE_ABORT   0

void
xmlFuzzInjectFailure(size_t failurePos) {
    fuzzNumAttempts = 0;
    fuzzFailurePos = failurePos;
    fuzzAllocFailed = 0;
    fuzzIoFailed = 0;
}

static int
xmlFuzzTryMalloc(void) {
    if (fuzzFailurePos > 0) {
        fuzzNumAttempts += 1;
        if (fuzzNumAttempts == fuzzFailurePos) {
#if XML_FUZZ_FAILURE_ABORT
            abort();
#endif
            fuzzAllocFailed = 1;
            return -1;
        }
    }

    return 0;
}

static int
xmlFuzzTryIo(void) {
    if (fuzzFailurePos > 0) {
        fuzzNumAttempts += 1;
        if (fuzzNumAttempts == fuzzFailurePos) {
#if XML_FUZZ_FAILURE_ABORT
            abort();
#endif
            fuzzIoFailed = 1;
            return -1;
        }
    }

    return 0;
}

static void *
xmlFuzzMalloc(size_t size) {
    void *ret;

    if (xmlFuzzTryMalloc() < 0)
        return NULL;

    ret = malloc(size);
    if (ret == NULL)
        fuzzAllocFailed = 1;

    return ret;
}

static void *
xmlFuzzRealloc(void *ptr, size_t size) {
    void *ret;

    if (xmlFuzzTryMalloc() < 0)
        return NULL;

    ret = realloc(ptr, size);
    if (ret == NULL)
        fuzzAllocFailed = 1;

    return ret;
}

void
xmlFuzzMemSetup(void) {
    xmlMemSetup(free, xmlFuzzMalloc, xmlFuzzRealloc, xmlMemStrdup);
}

int
xmlFuzzMallocFailed(void) {
    return fuzzAllocFailed;
}

void
xmlFuzzResetFailure(void) {
    fuzzAllocFailed = 0;
    fuzzIoFailed = 0;
}

void
xmlFuzzCheckFailureReport(const char *func, int oomReport, int ioReport) {
    if (oomReport >= 0 && fuzzAllocFailed != oomReport) {
        fprintf(stderr, "%s: malloc failure %s reported\n",
                func, fuzzAllocFailed ? "not" : "erroneously");
        abort();
    }
    if (ioReport >= 0 && fuzzIoFailed != ioReport) {
        fprintf(stderr, "%s: IO failure %s reported\n",
                func, fuzzIoFailed ? "not" : "erroneously");
        abort();
    }
    fuzzAllocFailed = 0;
    fuzzIoFailed = 0;
}

/**
 * xmlFuzzDataInit:
 *
 * Initialize fuzz data provider.
 */
void
xmlFuzzDataInit(const char *data, size_t size) {
    fuzzData.data = data;
    fuzzData.size = size;
    fuzzData.ptr = data;
    fuzzData.remaining = size;

    fuzzData.outBuf = xmlMalloc(size + 1);
    fuzzData.outPtr = fuzzData.outBuf;

    fuzzData.entities = xmlHashCreate(8);
    fuzzData.mainUrl = NULL;
    fuzzData.mainEntity = NULL;
    fuzzData.secondaryUrl = NULL;
    fuzzData.secondaryEntity = NULL;
}

/**
 * xmlFuzzDataFree:
 *
 * Cleanup fuzz data provider.
 */
void
xmlFuzzDataCleanup(void) {
    xmlFree(fuzzData.outBuf);
    xmlHashFree(fuzzData.entities, xmlHashDefaultDeallocator);
}

/**
 * xmlFuzzWriteInt:
 * @out:  output file
 * @v:  integer to write
 * @size:  size of integer in bytes
 *
 * Write an integer to the fuzz data.
 */
void
xmlFuzzWriteInt(FILE *out, size_t v, int size) {
    int shift;

    while (size > (int) sizeof(size_t)) {
        putc(0, out);
        size--;
    }

    shift = size * 8;
    while (shift > 0) {
        shift -= 8;
        putc((v >> shift) & 255, out);
    }
}

/**
 * xmlFuzzReadInt:
 * @size:  size of integer in bytes
 *
 * Read an integer from the fuzz data.
 */
size_t
xmlFuzzReadInt(int size) {
    size_t ret = 0;

    while ((size > 0) && (fuzzData.remaining > 0)) {
        unsigned char c = (unsigned char) *fuzzData.ptr++;
        fuzzData.remaining--;
        ret = (ret << 8) | c;
        size--;
    }

    return ret;
}

/**
 * xmlFuzzBytesRemaining:
 *
 * Return number of remaining bytes in fuzz data.
 */
size_t
xmlFuzzBytesRemaining(void) {
    return(fuzzData.remaining);
}

/**
 * xmlFuzzReadRemaining:
 * @size:  size of string in bytes
 *
 * Read remaining bytes from fuzz data.
 */
const char *
xmlFuzzReadRemaining(size_t *size) {
    const char *ret = fuzzData.ptr;

    *size = fuzzData.remaining;
    fuzzData.ptr += fuzzData.remaining;
    fuzzData.remaining = 0;

    return(ret);
}

/*
 * xmlFuzzWriteString:
 * @out:  output file
 * @str:  string to write
 *
 * Write a random-length string to file in a format similar to
 * FuzzedDataProvider. Backslash followed by newline marks the end of the
 * string. Two backslashes are used to escape a backslash.
 */
void
xmlFuzzWriteString(FILE *out, const char *str) {
    for (; *str; str++) {
        int c = (unsigned char) *str;
        putc(c, out);
        if (c == '\\')
            putc(c, out);
    }
    putc('\\', out);
    putc('\n', out);
}

/**
 * xmlFuzzReadString:
 * @size:  size of string in bytes
 *
 * Read a random-length string from the fuzz data.
 *
 * The format is similar to libFuzzer's FuzzedDataProvider but treats
 * backslash followed by newline as end of string. This makes the fuzz data
 * more readable. A backslash character is escaped with another backslash.
 *
 * Returns a zero-terminated string or NULL if the fuzz data is exhausted.
 */
const char *
xmlFuzzReadString(size_t *size) {
    const char *out = fuzzData.outPtr;

    while (fuzzData.remaining > 0) {
        int c = *fuzzData.ptr++;
        fuzzData.remaining--;

        if ((c == '\\') && (fuzzData.remaining > 0)) {
            int c2 = *fuzzData.ptr;

            if (c2 == '\n') {
                fuzzData.ptr++;
                fuzzData.remaining--;
                if (size != NULL)
                    *size = fuzzData.outPtr - out;
                *fuzzData.outPtr++ = '\0';
                return(out);
            }
            if (c2 == '\\') {
                fuzzData.ptr++;
                fuzzData.remaining--;
            }
        }

        *fuzzData.outPtr++ = c;
    }

    if (fuzzData.outPtr > out) {
        if (size != NULL)
            *size = fuzzData.outPtr - out;
        *fuzzData.outPtr++ = '\0';
        return(out);
    }

    if (size != NULL)
        *size = 0;
    return(NULL);
}

/**
 * xmlFuzzReadEntities:
 *
 * Read entities like the main XML file, external DTDs, external parsed
 * entities from fuzz data.
 */
void
xmlFuzzReadEntities(void) {
    size_t num = 0;

    while (1) {
        const char *url, *entity;
        size_t urlSize, entitySize;
        xmlFuzzEntityInfo *entityInfo;

        url = xmlFuzzReadString(&urlSize);
        if (url == NULL) break;

        entity = xmlFuzzReadString(&entitySize);
        if (entity == NULL) break;

        /*
         * Cap URL size to avoid quadratic behavior when generating
         * error messages or looking up entities.
         */
        if (urlSize < 50 &&
            xmlHashLookup(fuzzData.entities, (xmlChar *)url) == NULL) {
            entityInfo = xmlMalloc(sizeof(xmlFuzzEntityInfo));
            if (entityInfo == NULL)
                break;
            entityInfo->data = entity;
            entityInfo->size = entitySize;

            xmlHashAddEntry(fuzzData.entities, (xmlChar *)url, entityInfo);

            if (num == 0) {
                fuzzData.mainUrl = url;
                fuzzData.mainEntity = entityInfo;
            } else if (num == 1) {
                fuzzData.secondaryUrl = url;
                fuzzData.secondaryEntity = entityInfo;
            }

            num++;
        }
    }
}

/**
 * xmlFuzzMainUrl:
 *
 * Returns the main URL.
 */
const char *
xmlFuzzMainUrl(void) {
    return(fuzzData.mainUrl);
}

/**
 * xmlFuzzMainEntity:
 * @size:  size of the main entity in bytes
 *
 * Returns the main entity.
 */
const char *
xmlFuzzMainEntity(size_t *size) {
    if (fuzzData.mainEntity == NULL)
        return(NULL);
    *size = fuzzData.mainEntity->size;
    return(fuzzData.mainEntity->data);
}

/**
 * xmlFuzzSecondaryUrl:
 *
 * Returns the secondary URL.
 */
const char *
xmlFuzzSecondaryUrl(void) {
    return(fuzzData.secondaryUrl);
}

/**
 * xmlFuzzSecondaryEntity:
 * @size:  size of the secondary entity in bytes
 *
 * Returns the secondary entity.
 */
const char *
xmlFuzzSecondaryEntity(size_t *size) {
    if (fuzzData.secondaryEntity == NULL)
        return(NULL);
    *size = fuzzData.secondaryEntity->size;
    return(fuzzData.secondaryEntity->data);
}

/**
 * xmlFuzzResourceLoader:
 *
 * The resource loader for fuzz data.
 */
xmlParserErrors
xmlFuzzResourceLoader(void *data ATTRIBUTE_UNUSED, const char *URL,
                      const char *ID ATTRIBUTE_UNUSED,
                      xmlResourceType type ATTRIBUTE_UNUSED,
                      xmlParserInputFlags flags ATTRIBUTE_UNUSED,
                      xmlParserInputPtr *out) {
    xmlParserInputPtr input;
    xmlFuzzEntityInfo *entity;

    entity = xmlHashLookup(fuzzData.entities, (xmlChar *) URL);
    if (entity == NULL)
        return(XML_IO_ENOENT);

    /* IO failure injection */
    if (xmlFuzzTryIo() < 0)
        return(XML_IO_EIO);

    input = xmlNewInputFromMemory(URL, entity->data, entity->size,
                                  XML_INPUT_BUF_STATIC |
                                  XML_INPUT_BUF_ZERO_TERMINATED);
    if (input == NULL)
        return(XML_ERR_NO_MEMORY);

    *out = input;
    return(XML_ERR_OK);
}

char *
xmlSlurpFile(const char *path, size_t *sizeRet) {
    FILE *file;
    struct stat statbuf;
    char *data;
    size_t size;

    if ((stat(path, &statbuf) != 0) || (!S_ISREG(statbuf.st_mode)))
        return(NULL);
    size = statbuf.st_size;
    file = fopen(path, "rb");
    if (file == NULL)
        return(NULL);
    data = xmlMalloc(size + 1);
    if (data != NULL) {
        if (fread(data, 1, size, file) != size) {
            xmlFree(data);
            data = NULL;
        } else {
            data[size] = 0;
            if (sizeRet != NULL)
                *sizeRet = size;
        }
    }
    fclose(file);

    return(data);
}

int
xmlFuzzOutputWrite(void *ctxt ATTRIBUTE_UNUSED,
                   const char *buffer ATTRIBUTE_UNUSED, int len) {
    if (xmlFuzzTryIo() < 0)
        return -XML_IO_EIO;

    return len;
}

int
xmlFuzzOutputClose(void *ctxt ATTRIBUTE_UNUSED) {
    if (xmlFuzzTryIo() < 0)
        return XML_IO_EIO;

    return 0;
}

/**
 * xmlFuzzMutateChunks:
 * @chunks: array of chunk descriptions
 * @data: fuzz data (from LLVMFuzzerCustomMutator)
 * @size: data size (from LLVMFuzzerCustomMutator)
 * @maxSize: max data size (from LLVMFuzzerCustomMutator)
 * @seed: seed (from LLVMFuzzerCustomMutator)
 * @mutator: mutator function, use LLVMFuzzerMutate
 *
 * Mutates one of several chunks with a given probability.
 *
 * Probability is a value between 0 and XML_FUZZ_PROB_ONE.
 *
 * The last chunk has flexible size and must have size and
 * mutateProb set to 0.
 *
 * Returns the size of the mutated data like LLVMFuzzerCustomMutator.
 */
size_t
xmlFuzzMutateChunks(const xmlFuzzChunkDesc *chunks,
                    char *data, size_t size, size_t maxSize, unsigned seed,
                    xmlFuzzMutator mutator) {
    size_t off = 0;
    size_t ret, chunkSize, maxChunkSize, mutSize;
    unsigned prob = seed % XML_FUZZ_PROB_ONE;
    unsigned descSize = 0;
    int i = 0;

    while (1) {
        unsigned descProb;

        descSize = chunks[i].size;
        descProb = chunks[i].mutateProb;

        if (descSize == 0 ||
            off + descSize > size ||
            off + descSize >= maxSize ||
            prob < descProb)
            break;

        off += descSize;
        prob -= descProb;
        i += 1;
    }

    chunkSize = size - off;
    maxChunkSize = maxSize - off;

    if (descSize != 0) {
        if (chunkSize > descSize)
            chunkSize = descSize;
        if (maxChunkSize > descSize)
            maxChunkSize = descSize;
    }

    mutSize = mutator(data + off, chunkSize, maxChunkSize);

    if (size > off + chunkSize) {
        size_t j;

        for (j = mutSize; j < chunkSize; j++)
            data[off + j] = 0;

        ret = size;
    } else {
        ret = off + mutSize;
    }

    return ret;
}