diff options
Diffstat (limited to 'fuzz')
| -rw-r--r-- | fuzz/plist_write_fuzzer.cc | 102 | ||||
| -rw-r--r-- | fuzz/plist_write_fuzzer.dict | 78 | ||||
| -rw-r--r-- | fuzz/plist_write_fuzzer.options | 3 |
3 files changed, 183 insertions, 0 deletions
diff --git a/fuzz/plist_write_fuzzer.cc b/fuzz/plist_write_fuzzer.cc new file mode 100644 index 0000000..22ccf15 --- /dev/null +++ b/fuzz/plist_write_fuzzer.cc @@ -0,0 +1,102 @@ + /* + * plist_write_fuzzer.cc + * plist writer fuzz target for libFuzzer + * + * Copyright (c) 2017 Nikias Bassen All Rights Reserved. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#include <plist/plist.h> + +#include <stddef.h> +#include <stdint.h> + +static plist_format_t select_output_format(uint8_t mode) +{ + switch (mode % 6) { + case 0: return PLIST_FORMAT_XML; + case 1: return PLIST_FORMAT_JSON; + case 2: return PLIST_FORMAT_OSTEP; + case 3: return PLIST_FORMAT_PRINT; + case 4: return PLIST_FORMAT_LIMD; + default: return PLIST_FORMAT_PLUTIL; + } +} + +static plist_write_options_t select_options(uint8_t opt) +{ + unsigned int options = PLIST_OPT_NONE; + + if (opt & 0x01) { + options |= PLIST_OPT_COMPACT; + } + if (opt & 0x02) { + options |= PLIST_OPT_COERCE; + } + if (opt & 0x04) { + options |= PLIST_OPT_NO_NEWLINE; + } + if (opt & 0x08) { + options |= PLIST_OPT_PARTIAL_DATA; + } + if (opt & 0x10) { + options |= PLIST_OPT_INDENT; + options |= PLIST_OPT_INDENT_BY(1); + } + + return static_cast<plist_write_options_t>(options); +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + if (!data || size < 3 || size > 4096) { + return 0; + } + + const uint8_t mode = data[size - 2]; + const uint8_t opt = data[size - 1]; + + plist_t root = NULL; + plist_format_t in_format = PLIST_FORMAT_NONE; + + plist_err_t err = plist_from_memory( + reinterpret_cast<const char*>(data), + static_cast<uint32_t>(size - 2), + &root, + &in_format + ); + + if (err != PLIST_ERR_SUCCESS || !root) { + plist_free(root); + return 0; + } + + char* output = NULL; + uint32_t output_len = 0; + + (void)plist_write_to_string( + root, + &output, + &output_len, + select_output_format(mode), + select_options(opt) + ); + + plist_mem_free(output); + plist_free(root); + + return 0; +} diff --git a/fuzz/plist_write_fuzzer.dict b/fuzz/plist_write_fuzzer.dict new file mode 100644 index 0000000..6aba5a8 --- /dev/null +++ b/fuzz/plist_write_fuzzer.dict @@ -0,0 +1,78 @@ +# +# Dictionary for plist_write_fuzzer. +# ---------------------------------- +# +# Basic plist, JSON, and OpenStep tokens. + +bplist_magic="bplist00" + +xml_decl="<?xml" +xml_doctype="<!DOCTYPE plist" +xml_plist_open="<plist" +xml_plist_close="</plist>" +xml_version="version=\"1.0\"" + +xml_dict_open="<dict>" +xml_dict_close="</dict>" +xml_array_open="<array>" +xml_array_close="</array>" +xml_key_open="<key>" +xml_key_close="</key>" + +xml_string_open="<string>" +xml_string_close="</string>" +xml_integer_open="<integer>" +xml_integer_close="</integer>" +xml_real_open="<real>" +xml_real_close="</real>" +xml_true="<true/>" +xml_false="<false/>" +xml_data_open="<data>" +xml_data_close="</data>" +xml_date_open="<date>" +xml_date_close="</date>" + +xml_amp="&" +xml_lt="<" +xml_gt=">" +xml_quot=""" +xml_apos="'" + +json_lbrace="{" +json_rbrace="}" +json_lbracket="[" +json_rbracket="]" +json_colon=":" +json_comma="," +json_quote="\"" + +json_true="true" +json_false="false" +json_null="null" + +json_key_uid="\"UID\"" +json_key_data="\"data\"" +json_key_date="\"date\"" +json_key_string="\"string\"" +json_key_array="\"array\"" +json_key_dict="\"dict\"" + +ostep_lbrace="{" +ostep_rbrace="}" +ostep_lparen="(" +ostep_rparen=")" +ostep_equal="=" +ostep_semicolon=";" +ostep_comma="," +ostep_quote="\"" +ostep_data_open="<" +ostep_data_close=">" + +num_zero="0" +num_one="1" +num_minus_one="-1" +num_large="18446744073709551615" +real_zero="0.0" +real_one="1.0" +date_sample="2024-01-01T00:00:00Z" +base64_sample="QUJDRA==" diff --git a/fuzz/plist_write_fuzzer.options b/fuzz/plist_write_fuzzer.options new file mode 100644 index 0000000..0415461 --- /dev/null +++ b/fuzz/plist_write_fuzzer.options @@ -0,0 +1,3 @@ +[libfuzzer] +max_len = 4096 +dict = plist_write_fuzzer.dict |