[libxml2] Add hash-based combination of flags as an "options" argument. (#388)

1 files changed, 24 insertions, 12 deletions

diff --git a/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc b/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc
index 1b1fb8a18..4ae6035b7 100644
--- a/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc
+++ b/projects/libxml2/libxml2_xml_read_memory_fuzzer.cc
@@ -3,8 +3,12 @@
 // found in the LICENSE file.
 
 #include <cassert>
-#include <stddef.h>
-#include <stdint.h>
+#include <cstddef>
+#include <cstdint>
+
+#include <functional>
+#include <limits>
+#include <string>
 
 #include "libxml/parser.h"
 #include "libxml/xmlsave.h"
@@ -16,16 +20,24 @@ void ignore (void* ctx, const char* msg, ...) {
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   xmlSetGenericErrorFunc(NULL, &ignore);
 
-  if (auto doc = xmlReadMemory(reinterpret_cast<const char*>(data),
-                               static_cast<int>(size), "noname.xml", NULL,
-                               0 /*or:XML_PARSE_RECOVER*/)) {
-    auto buf = xmlBufferCreate();
-    assert(buf);
-    auto ctxt = xmlSaveToBuffer(buf, NULL, 0);
-    xmlSaveDoc(ctxt, doc);
-    xmlSaveClose(ctxt);
-    xmlFreeDoc(doc);
-    xmlBufferFree(buf);
+  // Test default empty options value and some random combination.
+  std::string data_string(reinterpret_cast<const char*>(data), size);
+  const std::size_t data_hash = std::hash<std::string>()(data_string);
+  const int max_option_value = std::numeric_limits<int>::max();
+  const int random_option_value = data_hash % max_option_value;
+  const int options[] = {0, random_option_value};
+
+  for (const auto option_value : options) {
+    if (auto doc = xmlReadMemory(data_string.c_str(), data_string.length(),
+                                 "noname.xml", NULL, option_value)) {
+      auto buf = xmlBufferCreate();
+      assert(buf);
+      auto ctxt = xmlSaveToBuffer(buf, NULL, 0);
+      xmlSaveDoc(ctxt, doc);
+      xmlSaveClose(ctxt);
+      xmlFreeDoc(doc);
+      xmlBufferFree(buf);
+    }
   }
 
   return 0;