[glib: 3/4] fuzzing: Add fuzz tests for GUri parsing and escaping

[Philip Withnall <pwithnall src gnome org>]

commit dd11160f7fecb6fcda89b61afd76700a54bfe0a7
Author: Philip Withnall <withnall endlessm com>
Date:   Fri Jun 19 11:54:41 2020 +0100

    fuzzing: Add fuzz tests for GUri parsing and escaping
    
    Signed-off-by: Philip Withnall <withnall endlessm com>
    
    Helps: #110

 fuzzing/fuzz_uri_escape.c       | 29 +++++++++++++++++++++++++++++
 fuzzing/fuzz_uri_parse.c        | 26 ++++++++++++++++++++++++++
 fuzzing/fuzz_uri_parse_params.c | 20 ++++++++++++++++++++
 fuzzing/meson.build             |  3 +++
 4 files changed, 78 insertions(+)
---
diff --git a/fuzzing/fuzz_uri_escape.c b/fuzzing/fuzz_uri_escape.c
new file mode 100644
index 000000000..3b3afa734
--- /dev/null
+++ b/fuzzing/fuzz_uri_escape.c
@@ -0,0 +1,29 @@
+#include "fuzz.h"
+
+int
+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
+{
+  GBytes *unescaped_bytes = NULL;
+  gchar *escaped_string = NULL;
+
+  fuzz_set_logging_func ();
+
+  if (size > G_MAXSSIZE)
+    return 0;
+
+  unescaped_bytes = g_uri_unescape_bytes ((const gchar *) data, (gssize) size);
+  if (unescaped_bytes == NULL)
+    return 0;
+
+  escaped_string = g_uri_escape_bytes (g_bytes_get_data (unescaped_bytes, NULL),
+                                       g_bytes_get_size (unescaped_bytes),
+                                       NULL);
+  g_bytes_unref (unescaped_bytes);
+
+  if (escaped_string == NULL)
+    return 0;
+
+  g_free (escaped_string);
+
+  return 0;
+}
diff --git a/fuzzing/fuzz_uri_parse.c b/fuzzing/fuzz_uri_parse.c
new file mode 100644
index 000000000..5c2934f1a
--- /dev/null
+++ b/fuzzing/fuzz_uri_parse.c
@@ -0,0 +1,26 @@
+#include "fuzz.h"
+
+int
+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
+{
+  GUri *uri = NULL;
+  gchar *uri_string = NULL;
+  const GUriFlags flags = G_URI_FLAGS_NONE;
+
+  fuzz_set_logging_func ();
+
+  /* ignore @size */
+  uri = g_uri_parse ((const gchar *) data, flags, NULL);
+  if (uri == NULL)
+    return 0;
+
+  uri_string = g_uri_to_string (uri);
+  g_uri_unref (uri);
+
+  if (uri_string == NULL)
+    return 0;
+
+  g_free (uri_string);
+
+  return 0;
+}
diff --git a/fuzzing/fuzz_uri_parse_params.c b/fuzzing/fuzz_uri_parse_params.c
new file mode 100644
index 000000000..c075a2d68
--- /dev/null
+++ b/fuzzing/fuzz_uri_parse_params.c
@@ -0,0 +1,20 @@
+#include "fuzz.h"
+
+int
+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
+{
+  GHashTable *parsed_params = NULL;
+
+  fuzz_set_logging_func ();
+
+  if (size > G_MAXSSIZE)
+    return 0;
+
+  parsed_params = g_uri_parse_params ((const gchar *) data, (gssize) size, '&', FALSE);
+  if (parsed_params == NULL)
+    return 0;
+
+  g_hash_table_unref (parsed_params);
+
+  return 0;
+}
diff --git a/fuzzing/meson.build b/fuzzing/meson.build
index 7fdd8c909..1a591c4b7 100644
--- a/fuzzing/meson.build
+++ b/fuzzing/meson.build
@@ -2,6 +2,9 @@ fuzz_targets = [
   'fuzz_bookmark',
   'fuzz_dbus_message',
   'fuzz_key',
+  'fuzz_uri_escape',
+  'fuzz_uri_parse',
+  'fuzz_uri_parse_params',
   'fuzz_variant_binary',
   'fuzz_variant_text',
 ]