1 // Copyright 2016 The PDFium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include <cstddef> 6 #include <cstdint> 7 #include <memory> 8 9 #include "core/fxcrt/fx_basic.h" 10 #include "core/fxcrt/fx_safe_types.h" 11 #include "core/fxcrt/fx_system.h" 12 #include "third_party/base/ptr_util.h" 13 #include "xfa/fde/xml/fde_xml_imp.h" 14 #include "xfa/fxfa/parser/cxfa_xml_parser.h" 15 #include "xfa/fxfa/parser/cxfa_widetextread.h" 16 17 namespace { 18 XFA_FDEExtension_GetDocumentNode(CFDE_XMLDoc * pXMLDoc,bool bVerifyWellFormness=false)19CFDE_XMLNode* XFA_FDEExtension_GetDocumentNode( 20 CFDE_XMLDoc* pXMLDoc, 21 bool bVerifyWellFormness = false) { 22 if (!pXMLDoc) { 23 return nullptr; 24 } 25 CFDE_XMLNode* pXMLFakeRoot = pXMLDoc->GetRoot(); 26 for (CFDE_XMLNode* pXMLNode = 27 pXMLFakeRoot->GetNodeItem(CFDE_XMLNode::FirstChild); 28 pXMLNode; pXMLNode = pXMLNode->GetNodeItem(CFDE_XMLNode::NextSibling)) { 29 if (pXMLNode->GetType() == FDE_XMLNODE_Element) { 30 if (bVerifyWellFormness) { 31 for (CFDE_XMLNode* pNextNode = 32 pXMLNode->GetNodeItem(CFDE_XMLNode::NextSibling); 33 pNextNode; 34 pNextNode = pNextNode->GetNodeItem(CFDE_XMLNode::NextSibling)) { 35 if (pNextNode->GetType() == FDE_XMLNODE_Element) { 36 return nullptr; 37 } 38 } 39 } 40 return pXMLNode; 41 } 42 } 43 return nullptr; 44 } 45 46 } // namespace 47 LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)48extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 49 FX_SAFE_STRSIZE safe_size = size; 50 if (!safe_size.IsValid()) 51 return 0; 52 53 CFX_WideString input = 54 CFX_WideString::FromUTF8(CFX_ByteStringC(data, safe_size.ValueOrDie())); 55 auto stream = pdfium::MakeRetain<CXFA_WideTextRead>(input); 56 if (!stream) 57 return 0; 58 59 auto doc = pdfium::MakeUnique<CFDE_XMLDoc>(); 60 if (!doc->LoadXML(pdfium::MakeUnique<CXFA_XMLParser>(doc->GetRoot(), stream))) 61 return 0; 62 63 if (doc->DoLoad(nullptr) < 100) 64 return 0; 65 66 (void)XFA_FDEExtension_GetDocumentNode(doc.get()); 67 return 0; 68 } 69