summaryrefslogtreecommitdiff
path: root/tests/test_parse.cpp
diff options
context:
space:
mode:
authorArseny Kapoulkine <arseny.kapoulkine@gmail.com>2015-03-12 20:21:59 -0700
committerArseny Kapoulkine <arseny.kapoulkine@gmail.com>2015-03-12 20:21:59 -0700
commit0542b1869b6970003caa954ebc5f1dea41d48032 (patch)
treeb6845a48a40b9fd6a835e66b3c2a25807e08c1f1 /tests/test_parse.cpp
parent604861e520d2d6579674a1c2bd5e59cb10f7ecd2 (diff)
Fix buffer overrun when parsing comments inside DOCTYPE
Diffstat (limited to 'tests/test_parse.cpp')
-rw-r--r--tests/test_parse.cpp14
1 files changed, 14 insertions, 0 deletions
diff --git a/tests/test_parse.cpp b/tests/test_parse.cpp
index 1b1e807..7bb2663 100644
--- a/tests/test_parse.cpp
+++ b/tests/test_parse.cpp
@@ -1091,3 +1091,17 @@ TEST(parse_close_tag_eof)
CHECK(doc.load_buffer_inplace(test2, 12 * sizeof(char_t)).status == status_end_element_mismatch);
CHECK_STRING(doc.first_child().name(), STR("node"));
}
+
+TEST(parse_fuzz_doctype)
+{
+ unsigned char data[] =
+ {
+ 0x3b, 0x3c, 0x21, 0x44, 0x4f, 0x43, 0x54, 0x59, 0x50, 0x45, 0xef, 0xbb, 0xbf, 0x3c, 0x3f, 0x78,
+ 0x6d, 0x6c, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x31, 0x2e, 0x30, 0x22,
+ 0x3f, 0x3e, 0x3c, 0x21, 0x2d, 0x2d, 0x20, 0xe9, 0x80, 0xb1, 0xe5, 0xa0, 0xb1, 0xe3, 0x82, 0xb4,
+ 0xe3, 0x83, 0xb3, 0x20, 0xef, 0x83, 0x97, 0xe3, 0xa9, 0x2a, 0x20, 0x2d, 0x2d, 0x3e
+ };
+
+ xml_document doc;
+ CHECK(doc.load_buffer(data, sizeof(data)).status == status_bad_doctype);
+}