Fix pdf_xfa_fdp_fuzzer attribute tag creation
There is an incorrect ordering in the way attributes are added to the
xfa_string. This fixes the ordering.
Bug: chromium:1276950
Change-Id: I5ae6964e5940fcd6b38c69845c3b72c67a9af28c
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/87970
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/testing/fuzzers/pdf_xfa_fdp_fuzzer.cc b/testing/fuzzers/pdf_xfa_fdp_fuzzer.cc
index 297d4e0..86d3139 100644
--- a/testing/fuzzers/pdf_xfa_fdp_fuzzer.cc
+++ b/testing/fuzzers/pdf_xfa_fdp_fuzzer.cc
@@ -714,7 +714,7 @@
// Will create a single XFA attributes, with both lhs and rhs.
std::string getXfaElemAttributes(FuzzedDataProvider* data_provider) {
// Generate a set of tags, and a set of values for the tags.
- return GenXfaTagName(data_provider) + " = " + GenXfaTagValue(data_provider);
+ return GenXfaTagName(data_provider) + "=" + GenXfaTagValue(data_provider);
}
// Creates an XFA structure wrapped in <xdp tags.
@@ -728,19 +728,17 @@
std::vector<std::string> xml_stack;
xml_stack.reserve(elem_count);
for (int i = 0; i < elem_count; i++) {
- xfa_string += "<";
std::string tag = GenXfaTag(data_provider);
+ xfa_string += "<" + tag;
// in 30% of cases, add attributes
- std::string attribute_string;
if (data_provider->ConsumeIntegralInRange(1, 100) > 70) {
size_t attribute_count = data_provider->ConsumeIntegralInRange(1, 5);
for (; 0 < attribute_count; attribute_count--) {
- attribute_string += getXfaElemAttributes(data_provider);
+ xfa_string += " " + getXfaElemAttributes(data_provider);
}
}
- xfa_string += attribute_string;
- xfa_string += tag + ">";
+ xfa_string += ">";
// If needed, add a body to the tag
if (tag == "script") {
