Skip to content

Fuzz target for parseXML with 2 crashing testcases #8

@JohanEngelen

Description

@JohanEngelen

The (libFuzzer) fuzz target I used is:

import ldc.libfuzzer;
mixin DefineTestOneInput!fuzzMe;

int fuzzMe(in ubyte[] data) {
    import dxml.parser;
    try {
        int sum;
        auto range = parseXML(cast(char[])data);
        foreach (elem; range) {
            // Do something unpredictable to actually test the parser
            sum += cast(int) elem.type;
        }
        return sum > 1;
    }
    catch (XMLParsingException) {
        return 0;
    }
}

Compiled with LDC 1.9: bin/ldc2 -g -i -fsanitize=fuzzer fuzz_dxml.d

  1. Error: core.exception.RangeError@std/utf.d(3324): Range violation
    testcase: [0x3c,0xff,0x3e,0x3e,0x3a,0x3c,0x2f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x31,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xd8,0xd8,0xd8,0xd8,0xd8,0xff,0xff,0xff]

  2. Error: core.exception.AssertError@dxml/parser.d(5466): Assertion failure
    testcase: [0x3c,0x3f]

(perhaps add this fuzz target, and others, to a dedicated /fuzz/ folder, see e.g. https://github.com/openssl/openssl/tree/master/fuzz)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions