From cff5618d4e847b9f13e1f051d56e09ee00cfb089 Mon Sep 17 00:00:00 2001 From: Dan Sinclair Date: Wed, 25 Jan 2017 11:37:16 -0500 Subject: Fix CSS fuzzer input size Currently we use the size provided by clusterfuzz when initializing the css syntax parser. This maybe incorrect as the CFX_WideString may have a different count after converting to UTF. Use the wide string length instead of the provided size. We need to guard against strings that convert to blank when doing the wide conversion so add an early exit. BUG=682551 Change-Id: I3e014647fcf869681098a1b4446306b8b3eb9323 Reviewed-on: https://pdfium-review.googlesource.com/2391 Reviewed-by: Tom Sepez Commit-Queue: dsinclair --- testing/libfuzzer/pdf_css_fuzzer.cc | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/testing/libfuzzer/pdf_css_fuzzer.cc b/testing/libfuzzer/pdf_css_fuzzer.cc index 9135b25f3d..f02f006ea0 100644 --- a/testing/libfuzzer/pdf_css_fuzzer.cc +++ b/testing/libfuzzer/pdf_css_fuzzer.cc @@ -15,8 +15,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { CFX_WideString input = CFX_WideString::FromUTF8( CFX_ByteStringC(data, static_cast(size))); + // If we convert the input into an empty string bail out. + if (input.GetLength() == 0) + return 0; + CFDE_CSSSyntaxParser parser; - parser.Init(input.c_str(), size); + parser.Init(input.c_str(), input.GetLength()); FDE_CSSSyntaxStatus status; do { -- cgit v1.2.3