summaryrefslogtreecommitdiff
path: root/testing/libfuzzer
diff options
context:
space:
mode:
authordsinclair <dsinclair@chromium.org>2016-06-14 07:34:20 -0700
committerCommit bot <commit-bot@chromium.org>2016-06-14 07:34:20 -0700
commit756d37943415ca15d491b79ba78012225a06db76 (patch)
tree817ecb7fc2a84e7562006931ff97ad46858fe4d3 /testing/libfuzzer
parentfc6326d6cd51878c8ec3b8b51767dce368d07f67 (diff)
downloadpdfium-756d37943415ca15d491b79ba78012225a06db76.tar.xz
Add fuzzer for FDE CSS syntax parser.
This CL adds a fuzzer for the CSS Syntax parser in XFA. BUG=chromium:587126 Review-Url: https://codereview.chromium.org/2068513002
Diffstat (limited to 'testing/libfuzzer')
-rw-r--r--testing/libfuzzer/BUILD.gn16
-rw-r--r--testing/libfuzzer/fuzzers.gyp13
-rw-r--r--testing/libfuzzer/pdf_css_fuzzer.cc31
3 files changed, 60 insertions, 0 deletions
diff --git a/testing/libfuzzer/BUILD.gn b/testing/libfuzzer/BUILD.gn
index 5382313e01..3659c36225 100644
--- a/testing/libfuzzer/BUILD.gn
+++ b/testing/libfuzzer/BUILD.gn
@@ -5,6 +5,8 @@
import("../../pdfium.gni")
config("libfuzzer_config") {
+ configs = [ "//third_party/pdfium:pdfium_core_config" ]
+
defines = [
"PNG_PREFIX",
"PNG_USE_READ_MACROS",
@@ -122,6 +124,20 @@ if (pdf_enable_xfa) {
":libfuzzer_config",
]
}
+ source_set("pdf_css_fuzzer") {
+ testonly = true
+ sources = [
+ "pdf_css_fuzzer.cc",
+ ]
+ deps = [
+ "//third_party/pdfium:pdfium",
+ ]
+ configs -= [ "//build/config/compiler:chromium_code" ]
+ configs += [
+ "//build/config/compiler:no_chromium_code",
+ ":libfuzzer_config",
+ ]
+ }
}
source_set("pdf_jpx_fuzzer") {
diff --git a/testing/libfuzzer/fuzzers.gyp b/testing/libfuzzer/fuzzers.gyp
index 3f1d8123b6..5f2a4d1bd9 100644
--- a/testing/libfuzzer/fuzzers.gyp
+++ b/testing/libfuzzer/fuzzers.gyp
@@ -15,6 +15,8 @@
'include_dirs': [
# This is implicit in GN.
'<(DEPTH)',
+ '../../third_party/freetype/include',
+ '../../third_party/freetype/include/freetype',
],
'conditions': [
['pdf_enable_v8==1', {
@@ -119,6 +121,17 @@
'xfa_codec_fuzzer.h',
],
},
+ {
+ 'target_name': 'pdf_css_fuzzer',
+ 'type': 'executable',
+ 'dependencies': [
+ '../../pdfium.gyp:pdfium',
+ ],
+ 'sources': [
+ 'pdf_css_fuzzer.cc',
+ 'unittest_main.cc',
+ ],
+ },
],
}],
['OS=="linux"', {
diff --git a/testing/libfuzzer/pdf_css_fuzzer.cc b/testing/libfuzzer/pdf_css_fuzzer.cc
new file mode 100644
index 0000000000..da8b1f53f6
--- /dev/null
+++ b/testing/libfuzzer/pdf_css_fuzzer.cc
@@ -0,0 +1,31 @@
+// Copyright 2016 The PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+
+#include "core/fxcrt/include/fx_string.h"
+#include "xfa/fde/css/fde_css.h"
+#include "xfa/fde/css/fde_csssyntax.h"
+#include "xfa/fgas/crt/fgas_stream.h"
+#include "xfa/fxfa/parser/xfa_utils.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ CFDE_CSSSyntaxParser parser;
+
+ CFX_WideString input = CFX_WideString::FromUTF8(
+ CFX_ByteStringC(data, static_cast<FX_STRSIZE>(size)));
+ std::unique_ptr<IFX_Stream, ReleaseDeleter<IFX_Stream>> stream(
+ XFA_CreateWideTextRead(input));
+ if (!stream)
+ return 0;
+
+ parser.Init(stream.get(), 1024);
+
+ FDE_CSSSYNTAXSTATUS status = parser.DoSyntaxParse();
+ while (status != FDE_CSSSYNTAXSTATUS_Error &&
+ status != FDE_CSSSYNTAXSTATUS_EOS)
+ status = parser.DoSyntaxParse();
+
+ return 0;
+}