1 /*
2 * Copyright 2021 Google LLC
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 #include <sys/types.h>
17 #include <stdlib.h>
18 #include <stdio.h>
19 #include <stdint.h>
20 #include <unistd.h>
21 #include "tidybuffio.h"
22 #include "tidy.h"
23
24 // All boolean options. These will be set randomly
25 // based on the fuzzer data.
26 TidyOptionId bool_options[] = {
27 TidyJoinClasses,
28 TidyJoinStyles,
29 TidyKeepFileTimes,
30 TidyKeepTabs,
31 TidyLiteralAttribs,
32 TidyLogicalEmphasis,
33 TidyLowerLiterals,
34 TidyMakeBare,
35 TidyFixUri,
36 TidyForceOutput,
37 TidyGDocClean,
38 TidyHideComments,
39 TidyMark,
40 TidyXmlTags,
41 TidyMakeClean,
42 TidyAnchorAsName,
43 TidyMergeEmphasis,
44 TidyMakeBare,
45 TidyMetaCharset,
46 TidyMuteShow,
47 TidyNCR,
48 TidyNumEntities,
49 TidyOmitOptionalTags,
50 TidyPunctWrap,
51 TidyQuiet,
52 TidyQuoteAmpersand,
53 TidyQuoteMarks,
54 TidyQuoteNbsp,
55 TidyReplaceColor,
56 TidyShowFilename,
57 TidyShowInfo,
58 TidyShowMarkup,
59 TidyShowMetaChange,
60 TidyShowWarnings,
61 TidySkipNested,
62 TidyUpperCaseTags,
63 TidyWarnPropAttrs,
64 TidyWord2000,
65 TidyWrapAsp,
66 TidyWrapAttVals,
67 TidyWrapJste,
68 TidyWrapPhp,
69 TidyWrapScriptlets,
70 TidyWrapSection,
71 TidyWriteBack,
72 };
73
set_option(const uint8_t ** data,size_t * size,TidyDoc * tdoc,TidyOptionId tboolID)74 void set_option(const uint8_t** data, size_t *size, TidyDoc *tdoc, TidyOptionId tboolID) {
75 uint8_t decider;
76 decider = **data;
77 *data += 1;
78 *size -= 1;
79 if (decider % 2 == 0) tidyOptSetBool( *tdoc, tboolID, yes );
80 else { tidyOptSetBool( *tdoc, tboolID, no ); }
81 }
82
TidyXhtml(const uint8_t * data,size_t size,TidyBuffer * output,TidyBuffer * errbuf)83 int TidyXhtml(const uint8_t* data, size_t size, TidyBuffer* output, TidyBuffer* errbuf) {
84 uint8_t decider;
85
86 // We need enough data for picking all of the options. One byte per option.
87 if (size < 5+(sizeof(bool_options)/sizeof(bool_options[0]))) {
88 return 0;
89 }
90
91 TidyDoc tdoc = tidyCreate();
92
93 // Decide output format
94 decider = *data;
95 data++; size--;
96 if (decider % 3 == 0) tidyOptSetBool( tdoc, TidyXhtmlOut, yes );
97 else { tidyOptSetBool( tdoc, TidyXhtmlOut, no ); }
98
99 if (decider % 3 == 1) tidyOptSetBool( tdoc, TidyHtmlOut, yes );
100 else { tidyOptSetBool( tdoc, TidyHtmlOut, no ); }
101
102 if (decider % 3 == 2) tidyOptSetBool( tdoc, TidyXmlOut, yes );
103 else { tidyOptSetBool( tdoc, TidyXmlOut, no ); }
104
105 // Set options
106 for (int i=0; i < sizeof(bool_options)/sizeof(TidyOptionId); i++) {
107 set_option(&data, &size, &tdoc, bool_options[i]);
108 }
109
110 // Set an error buffer.
111 tidySetErrorBuffer(tdoc, errbuf);
112
113 // Parse the data
114 decider = *data;
115 data++; size--;
116 switch (decider % 2) {
117 case 0: {
118 char filename[256];
119 sprintf(filename, "/tmp/libfuzzer.%d", getpid());
120
121 FILE *fp = fopen(filename, "wb");
122 if (!fp) {
123 return 0;
124 }
125 fwrite(data, size, 1, fp);
126 fclose(fp);
127
128 tidyParseFile(tdoc, filename);
129 unlink(filename);
130 }
131 break;
132 case 1: {
133 char *inp = malloc(size+1);
134 inp[size] = '\0';
135 memcpy(inp, data, size);
136 tidyParseString(tdoc, inp);
137 free(inp);
138 }
139 }
140
141 // Cleanup
142 tidyRelease( tdoc );
143
144 return 0;
145 }
146
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)147 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
148 TidyBuffer fuzz_toutput;
149 TidyBuffer fuzz_terror;
150
151 tidyBufInit(&fuzz_toutput);
152 tidyBufInit(&fuzz_terror);
153
154 TidyXhtml(data, size, &fuzz_toutput, &fuzz_terror);
155
156 tidyBufFree(&fuzz_toutput);
157 tidyBufFree(&fuzz_terror);
158
159 return 0;
160 }
161