commit f64a73075d78d8d6a06ae47e5e58660d8c87cebc
author Ryan Harrison <rharrison@chromium.org> Thu Oct 19 16:07:24 2017 -0400
committer Chromium commit bot <commit-bot@chromium.org> Thu Oct 19 20:34:47 2017 +0000
tree 34114d1c8caab56ff62b926e6495962179d97aff
parent 646634b46fb90dc90000996687e528313c5a1f3e

Implement fuzzer for FormCalc parsing

This adds a fuzzer that tests the FormCalc parsing code independent of
parsing an entire XFA file or performing translation to JS.

BUG=pdfium:920

Change-Id: I3d2c336d9cb6f4ebf114ded5f57a44a8342c4228
Reviewed-on: https://pdfium-review.googlesource.com/16391
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

testing/libfuzzer/BUILD.gn

diff --git a/testing/libfuzzer/BUILD.gn b/testing/libfuzzer/BUILD.gn
index d23fb88..20c64d9 100644
--- a/testing/libfuzzer/BUILD.gn
+++ b/testing/libfuzzer/BUILD.gn
@@ -46,6 +46,7 @@
       ":pdf_codec_tiff_fuzzer",
       ":pdf_css_fuzzer",
       ":pdf_fm2js_fuzzer",
+      ":pdf_formcalc_fuzzer",
       ":pdf_lzw_fuzzer",
       ":pdf_xml_fuzzer",
     ]
@@ -130,6 +131,12 @@
     ]
   }
 
+  pdfium_fuzzer("pdf_formcalc_fuzzer") {
+    sources = [
+      "pdf_formcalc_fuzzer.cc",
+    ]
+  }
+
   pdfium_fuzzer("pdf_lzw_fuzzer") {
     sources = [
       "pdf_lzw_fuzzer.cc",

testing/libfuzzer/pdf_formcalc_fuzzer.cc

diff --git a/testing/libfuzzer/pdf_formcalc_fuzzer.cc b/testing/libfuzzer/pdf_formcalc_fuzzer.cc
new file mode 100644
index 0000000..08e22bb
--- /dev/null
+++ b/testing/libfuzzer/pdf_formcalc_fuzzer.cc
@@ -0,0 +1,16 @@
+// Copyright 2017 The PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/fxcrt/cfx_widetextbuf.h"
+#include "core/fxcrt/fx_string.h"
+#include "xfa/fxfa/fm2js/cxfa_fmparser.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  WideString input = WideString::FromUTF8(ByteStringView(data, size));
+
+  CXFA_FMParser parser(input.AsStringView());
+  parser.Parse();
+
+  return 0;
+}