1
0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-10-26 20:25:14 +03:00
Commit Graph

16 Commits

Author SHA1 Message Date
Nick Wellnhofer
e115194e6f fuzz: Check malloc failure reports in XML fuzzers 2023-12-11 22:13:06 +01:00
Nick Wellnhofer
c13a019134 fuzz: Test xmlTextReaderRead after EOF or failure 2023-10-15 13:04:54 +02:00
Nick Wellnhofer
fa48187304 fuzz: Disable XML_PARSE_SAX1 option in xml fuzzer
There a no plans to fix quadratic behavior in the legacy SAX1 interface.
2023-09-30 14:45:53 +02:00
Nick Wellnhofer
f9d717af97 fuzz: Allow to fuzz without push, reader or output modules 2023-09-21 13:05:49 +02:00
Nick Wellnhofer
da274bfa55 build: Fix build when certain modules are disabled 2023-09-21 02:26:43 +02:00
Nick Wellnhofer
4eba9f9cfc fuzz: Separate fuzzer for DTD validation 2023-03-12 16:19:33 +01:00
Nick Wellnhofer
42322eba82 fuzz: Inject random malloc failures
Fixes #344.
2023-03-08 14:14:22 +01:00
Nick Wellnhofer
541b1e2850 fuzz: Support variable integer sizes in fuzz data
Also switch to big-endian.
2023-03-08 13:59:00 +01:00
Nick Wellnhofer
09dac45ab9 fuzz: Add separate XInclude fuzzer
XIncludes involve XPath processing which can still lead to timeouts when
fuzzing. This will probably take a while to fix. The rest of the XML
parsing code should hopefully run without timeouts now. OSS-Fuzz only
shows a single timeout test case, so separate the XInclude from the core
XML fuzzer.
2022-12-26 18:12:26 +01:00
Nick Wellnhofer
c885bebb5d fuzz: Remove size limit, disable XInclude
Now that entity expansion issues should be fixed, we should get more
interesting timeout errors from OSS-Fuzz. Disable XInclude for now,
since it often timeouts in XPath computations. The XInclude tests should
be moved to a separate fuzz target.
2022-12-23 23:12:52 +01:00
Nick Wellnhofer
85c817a200 Improve fuzzer stability
- Add more calls to xmlInitializeCatalog.
- Call xmlResetLastError after fuzzing each input.
2021-02-22 22:29:28 +01:00
Nick Wellnhofer
e2b975c317 Handle malloc failures in fuzzing code
Avoid misdiagnosis in OOM situations.
2020-12-18 14:10:13 +01:00
Nick Wellnhofer
9086988ffa Enforce maximum length of fuzz input
Remove the libfuzzer max_len option which doesn't apply to other
fuzzing engines. Enforce the maximum length directly in the fuzz
targets. For the xml target, lower the maximum when expanding entities
to avoid timeout and OOM errors.
2020-12-16 16:12:07 +01:00
Nick Wellnhofer
8c3ef083ca Pass URL of main entity in XML fuzzer 2020-08-24 23:17:34 +02:00
Nick Wellnhofer
6c128fd58a Fuzz XInclude engine 2020-08-08 14:32:44 +02:00
Nick Wellnhofer
00ed736eec Add a couple of libFuzzer targets
- XML fuzzer
  Currently tests the pull parser, push parser and reader, as well as
  serialization. Supports splitting fuzz data into multiple documents
  for things like external DTDs or entities. The seed corpus is built
  from parts of the test suite.

- Regexp fuzzer
  Seed corpus was statically generated from test suite.

- URI fuzzer
  Tests parsing and most other functions from uri.c.
2020-06-05 13:53:11 +02:00