From 741356699309189d723e25231b73aafaf12b0022 Mon Sep 17 00:00:00 2001
From: Jeewoong Kim <dnd414@gmail.com>
Date: Tue, 7 Jul 2026 21:46:20 +0900
Subject: [PATCH] fuzz: add plist writer API fuzzer

---
 fuzz/plist_write_fuzzer.cc      | 102 ++++++++++++++++++++++++++++++++
 fuzz/plist_write_fuzzer.dict    |  78 ++++++++++++++++++++++++
 fuzz/plist_write_fuzzer.options |   3 +
 3 files changed, 183 insertions(+)
 create mode 100644 fuzz/plist_write_fuzzer.cc
 create mode 100644 fuzz/plist_write_fuzzer.dict
 create mode 100644 fuzz/plist_write_fuzzer.options

diff --git a/fuzz/plist_write_fuzzer.cc b/fuzz/plist_write_fuzzer.cc
new file mode 100644
index 000000000..22ccf155a
--- /dev/null
+++ b/fuzz/plist_write_fuzzer.cc
@@ -0,0 +1,102 @@
+ /*
+ * plist_write_fuzzer.cc
+ * plist writer fuzz target for libFuzzer
+ *
+ * Copyright (c) 2017 Nikias Bassen All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include <plist/plist.h>
+
+#include <stddef.h>
+#include <stdint.h>
+
+static plist_format_t select_output_format(uint8_t mode)
+{
+    switch (mode % 6) {
+    case 0: return PLIST_FORMAT_XML;
+    case 1: return PLIST_FORMAT_JSON;
+    case 2: return PLIST_FORMAT_OSTEP;
+    case 3: return PLIST_FORMAT_PRINT;
+    case 4: return PLIST_FORMAT_LIMD;
+    default: return PLIST_FORMAT_PLUTIL;
+    }
+}
+
+static plist_write_options_t select_options(uint8_t opt)
+{
+    unsigned int options = PLIST_OPT_NONE;
+
+    if (opt & 0x01) {
+        options |= PLIST_OPT_COMPACT;
+    }
+    if (opt & 0x02) {
+        options |= PLIST_OPT_COERCE;
+    }
+    if (opt & 0x04) {
+        options |= PLIST_OPT_NO_NEWLINE;
+    }
+    if (opt & 0x08) {
+        options |= PLIST_OPT_PARTIAL_DATA;
+    }
+    if (opt & 0x10) {
+        options |= PLIST_OPT_INDENT;
+        options |= PLIST_OPT_INDENT_BY(1);
+    }
+
+    return static_cast<plist_write_options_t>(options);
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    if (!data || size < 3 || size > 4096) {
+        return 0;
+    }
+
+    const uint8_t mode = data[size - 2];
+    const uint8_t opt = data[size - 1];
+
+    plist_t root = NULL;
+    plist_format_t in_format = PLIST_FORMAT_NONE;
+
+    plist_err_t err = plist_from_memory(
+        reinterpret_cast<const char*>(data),
+        static_cast<uint32_t>(size - 2),
+        &root,
+        &in_format
+    );
+
+    if (err != PLIST_ERR_SUCCESS || !root) {
+        plist_free(root);
+        return 0;
+    }
+
+    char* output = NULL;
+    uint32_t output_len = 0;
+
+    (void)plist_write_to_string(
+        root,
+        &output,
+        &output_len,
+        select_output_format(mode),
+        select_options(opt)
+    );
+
+    plist_mem_free(output);
+    plist_free(root);
+
+    return 0;
+}
diff --git a/fuzz/plist_write_fuzzer.dict b/fuzz/plist_write_fuzzer.dict
new file mode 100644
index 000000000..6aba5a8a5
--- /dev/null
+++ b/fuzz/plist_write_fuzzer.dict
@@ -0,0 +1,78 @@
+#
+# Dictionary for plist_write_fuzzer.
+# ----------------------------------
+#
+# Basic plist, JSON, and OpenStep tokens.
+
+bplist_magic="bplist00"
+
+xml_decl="<?xml"
+xml_doctype="<!DOCTYPE plist"
+xml_plist_open="<plist"
+xml_plist_close="</plist>"
+xml_version="version=\"1.0\""
+
+xml_dict_open="<dict>"
+xml_dict_close="</dict>"
+xml_array_open="<array>"
+xml_array_close="</array>"
+xml_key_open="<key>"
+xml_key_close="</key>"
+
+xml_string_open="<string>"
+xml_string_close="</string>"
+xml_integer_open="<integer>"
+xml_integer_close="</integer>"
+xml_real_open="<real>"
+xml_real_close="</real>"
+xml_true="<true/>"
+xml_false="<false/>"
+xml_data_open="<data>"
+xml_data_close="</data>"
+xml_date_open="<date>"
+xml_date_close="</date>"
+
+xml_amp="&amp;"
+xml_lt="&lt;"
+xml_gt="&gt;"
+xml_quot="&quot;"
+xml_apos="&apos;"
+
+json_lbrace="{"
+json_rbrace="}"
+json_lbracket="["
+json_rbracket="]"
+json_colon=":"
+json_comma=","
+json_quote="\""
+
+json_true="true"
+json_false="false"
+json_null="null"
+
+json_key_uid="\"UID\""
+json_key_data="\"data\""
+json_key_date="\"date\""
+json_key_string="\"string\""
+json_key_array="\"array\""
+json_key_dict="\"dict\""
+
+ostep_lbrace="{"
+ostep_rbrace="}"
+ostep_lparen="("
+ostep_rparen=")"
+ostep_equal="="
+ostep_semicolon=";"
+ostep_comma=","
+ostep_quote="\""
+ostep_data_open="<"
+ostep_data_close=">"
+
+num_zero="0"
+num_one="1"
+num_minus_one="-1"
+num_large="18446744073709551615"
+real_zero="0.0"
+real_one="1.0"
+date_sample="2024-01-01T00:00:00Z"
+base64_sample="QUJDRA=="
diff --git a/fuzz/plist_write_fuzzer.options b/fuzz/plist_write_fuzzer.options
new file mode 100644
index 000000000..04154616b
--- /dev/null
+++ b/fuzz/plist_write_fuzzer.options
@@ -0,0 +1,3 @@
+[libfuzzer]
+max_len = 4096
+dict = plist_write_fuzzer.dict