Function generateFuzzedNodeXML

fuzzing/bt_fuzzer.cpp:23–61

                                            "threshold", "max_repeats" };

std::string generateFuzzedNodeXML(FuzzedDataProvider& fdp, int depth = 0)
{
  // Prevent stack overflow with max depth
  if(depth > 6)
  {  // Reasonable limit for XML tree depth
    return "<AlwaysSuccess/>";
  }

  std::string xml;
  const std::string node_type = fdp.PickValueInArray(NODE_TYPES);

  xml += "<" + node_type;

  size_t num_attributes = fdp.ConsumeIntegralInRange<size_t>(0, 3);
  for(size_t i = 0; i < num_attributes; i++)
  {
    const std::string attr = fdp.PickValueInArray(NODE_ATTRIBUTES);
    std::string value = fdp.ConsumeRandomLengthString(10);
    xml += " " + attr + "=\"" + value + "\"";
  }

  if(depth > 3 || fdp.ConsumeBool())
  {
    xml += "/>";
  }
  else
  {
    xml += ">";
    // Add some child nodes recursively with depth limit
    size_t num_children = fdp.ConsumeIntegralInRange<size_t>(0, 2);
    for(size_t i = 0; i < num_children; i++)
    {
      xml += generateFuzzedNodeXML(fdp, depth + 1);
    }
    xml += "</" + node_type + ">";
  }

  return xml;
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{