From 131fc7f00914f8defbb8ebfa09eae75346a2b326 Mon Sep 17 00:00:00 2001
From: cozis <heibyob@gmail.com>
Date: Mon, 25 Apr 2022 00:56:35 +0200
Subject: [PATCH] added fuzzer and fixed a couple of bugs found by it

---
 .gitignore |  4 +++-
 clean.sh   |  1 +
 fuzzer.c   | 33 +++++++++++++++++++++++++++++++++
 fuzzer.sh  |  4 ++++
 xjson.c    | 10 +++++++++-
 5 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 fuzzer.c
 create mode 100755 fuzzer.sh

diff --git a/.gitignore b/.gitignore
index b8463b0..67a18f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,9 @@
+out
 test
 vgcore.*
 *.gcno
 *.gcda
 *.gcov
 parse-file
-all.json
\ No newline at end of file
+samples
+fuzzer
\ No newline at end of file
diff --git a/clean.sh b/clean.sh
index f229bef..93deae7 100755
--- a/clean.sh
+++ b/clean.sh
@@ -1,3 +1,4 @@
 rm *.gcda
 rm *.gcno
+rm *.gcov
 rm vgcore.*
\ No newline at end of file
diff --git a/fuzzer.c b/fuzzer.c
new file mode 100644
index 0000000..1b70c9f
--- /dev/null
+++ b/fuzzer.c
@@ -0,0 +1,33 @@
+#include <assert.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <ctype.h>
+#include "xjson.h"
+
+__AFL_FUZZ_INIT();
+
+int main()
+{
+
+#ifdef __AFL_HAVE_MANUAL_CONTROL
+  __AFL_INIT();
+#endif
+
+    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF; // must be after __AFL_INIT
+                                                  // and before __AFL_LOOP!
+    char pool[65536];
+    xj_error  error;
+
+    while(__AFL_LOOP(10000)) 
+    {
+        int len = __AFL_FUZZ_TESTCASE_LEN;
+
+        xj_alloc *alloc = xj_alloc_using(pool, sizeof(pool), 4096, NULL);
+        assert(alloc != NULL);
+        
+        xj_decode(buf, len, alloc, &error);
+        
+        xj_alloc_del(alloc);
+    }
+    return 0;
+}
diff --git a/fuzzer.sh b/fuzzer.sh
new file mode 100755
index 0000000..d54e9fe
--- /dev/null
+++ b/fuzzer.sh
@@ -0,0 +1,4 @@
+afl-clang-fast fuzzer.c xjson.c -o fuzzer
+export AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
+export AFL_SKIP_CPUFREQ=1
+afl-fuzz -i samples/ -o out -m none -d -- ./fuzzer
\ No newline at end of file
diff --git a/xjson.c b/xjson.c
index fc44e60..a43d385 100644
--- a/xjson.c
+++ b/xjson.c
@@ -939,6 +939,8 @@ static xj_value *parse_number(context_t *ctx)
             return NULL;
         }
 
+        int exponent_start = ctx->i;
+
         _Bool negative_exponent = 0;
         if(ctx->str[ctx->i] == '+' || ctx->str[ctx->i] == '-')
         {
@@ -956,7 +958,7 @@ static xj_value *parse_number(context_t *ctx)
 
         if(!isdigit(ctx->str[ctx->i]))
         {
-            xj_report(ctx->error, ctx->str, ctx->i, "Expected digit as exponent");
+            xj_preport(ctx->error, ctx->str, ctx->i, "Expected digit as exponent");
             return NULL;
         }
 
@@ -968,6 +970,12 @@ static xj_value *parse_number(context_t *ctx)
             ctx->i += 1;
         }
 
+        if(exponent > 6)
+        {
+            xj_preport(ctx->error, ctx->str, exponent_start, "Exponent is too big");
+            return NULL;
+        }
+
         coeff = 1;
         for(int j = 0; j < exponent; j += 1)
             coeff *= 10;