1 // Copyright 2016 The PDFium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include <cstddef> 6 #include <cstdint> 7 #include <memory> 8 9 #include "core/fxcrt/cfx_seekablestreamproxy.h" 10 #include "core/fxcrt/fx_safe_types.h" 11 #include "core/fxcrt/fx_system.h" 12 #include "core/fxcrt/xml/cfx_xmldoc.h" 13 #include "core/fxcrt/xml/cfx_xmlnode.h" 14 #include "core/fxcrt/xml/cfx_xmlparser.h" 15 #include "third_party/base/ptr_util.h" 16 17 namespace { 18 XFA_FDEExtension_GetDocumentNode(CFX_XMLDoc * pXMLDoc,bool bVerifyWellFormness=false)19CFX_XMLNode* XFA_FDEExtension_GetDocumentNode( 20 CFX_XMLDoc* pXMLDoc, 21 bool bVerifyWellFormness = false) { 22 if (!pXMLDoc) { 23 return nullptr; 24 } 25 CFX_XMLNode* pXMLFakeRoot = pXMLDoc->GetRoot(); 26 for (CFX_XMLNode* pXMLNode = 27 pXMLFakeRoot->GetNodeItem(CFX_XMLNode::FirstChild); 28 pXMLNode; pXMLNode = pXMLNode->GetNodeItem(CFX_XMLNode::NextSibling)) { 29 if (pXMLNode->GetType() == FX_XMLNODE_Element) { 30 if (bVerifyWellFormness) { 31 for (CFX_XMLNode* pNextNode = 32 pXMLNode->GetNodeItem(CFX_XMLNode::NextSibling); 33 pNextNode; 34 pNextNode = pNextNode->GetNodeItem(CFX_XMLNode::NextSibling)) { 35 if (pNextNode->GetType() == FX_XMLNODE_Element) { 36 return nullptr; 37 } 38 } 39 } 40 return pXMLNode; 41 } 42 } 43 return nullptr; 44 } 45 46 } // namespace 47 LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)48extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 49 FX_SAFE_SIZE_T safe_size = size; 50 if (!safe_size.IsValid()) 51 return 0; 52 53 RetainPtr<CFX_SeekableStreamProxy> stream = 54 pdfium::MakeRetain<CFX_SeekableStreamProxy>(const_cast<uint8_t*>(data), 55 size); 56 auto doc = pdfium::MakeUnique<CFX_XMLDoc>(); 57 if (!doc->LoadXML(pdfium::MakeUnique<CFX_XMLParser>(doc->GetRoot(), stream))) 58 return 0; 59 60 if (doc->DoLoad() < 100) 61 return 0; 62 63 (void)XFA_FDEExtension_GetDocumentNode(doc.get()); 64 return 0; 65 } 66