libFuzzer: add xml_windows fuzzer

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de97a82ea9f0a848302b39fb330240d1245b46ea..b552af39ca3a88561f61815632a4e5a2e37a58a6 100644 (file)
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -182,6 +182,8 @@ jobs:
           sanitizer:
         - target: xml
           sanitizer: --asan --ubsan
+        - target: xml_windows
+          sanitizer: --asan --ubsan
         - target: compress
           sanitizer:
         - target: compress

diff --git a/tools/libFuzzer/xml_windows/corpus/dll b/tools/libFuzzer/xml_windows/corpus/dll
new file mode 100644 (file)
index 0000000..7a9f1d2
Binary files /dev/null and b/tools/libFuzzer/xml_windows/corpus/dll differ

diff --git a/tools/libFuzzer/xml_windows/corpus/registry b/tools/libFuzzer/xml_windows/corpus/registry
new file mode 100644 (file)
index 0000000..c416b0e
Binary files /dev/null and b/tools/libFuzzer/xml_windows/corpus/registry differ

diff --git a/tools/libFuzzer/xml_windows/fuzz.c b/tools/libFuzzer/xml_windows/fuzz.c
new file mode 100644 (file)
index 0000000..2816378
--- /dev/null
+++ b/tools/libFuzzer/xml_windows/fuzz.c
@@ -0,0 +1,43 @@
+#include "../fuzzer.h"
+
+#include <sys/stat.h>
+
+#define TMPDIR "/tmp/fuzz-xml-windows/"
+
+static void
+write_file(const char *path, const void *data, size_t size)
+{
+       int fd;
+       ssize_t res;
+
+       fd = open(path, O_WRONLY|O_TRUNC|O_CREAT, 0600);
+       assert(fd >= 0);
+       res = write(fd, data, size);
+       assert(res == size);
+       close(fd);
+}
+
+/* Fuzz set_windows_specific_info() in xml_windows.c. */
+int LLVMFuzzerTestOneInput(const uint8_t *in, size_t insize)
+{
+       WIMStruct *wim;
+       int ret;
+
+       mkdir(TMPDIR, 0700);
+       mkdir(TMPDIR "Windows", 0700);
+       mkdir(TMPDIR "Windows", 0700);
+       mkdir(TMPDIR "Windows/System32", 0700);
+       mkdir(TMPDIR "Windows/System32/config", 0700);
+       write_file(TMPDIR "Windows/System32/kernel32.dll", in, insize);
+       write_file(TMPDIR "Windows/System32/config/SYSTEM", in, insize);
+       write_file(TMPDIR "Windows/System32/config/SOFTWARE", in, insize);
+
+       ret = wimlib_create_new_wim(WIMLIB_COMPRESSION_TYPE_NONE, &wim);
+       assert(!ret);
+
+       ret = wimlib_add_image(wim, TMPDIR, NULL, NULL, 0);
+       assert(!ret);
+
+       wimlib_free(wim);
+       return 0;
+}