Sjlver commented 6 years ago

Fix a number of bugs in hoedown's parsing code.

A series of 11 commits that harden Hoextdown against potential buffer overflows and other bugs. Mostly, these do not change functionality. The one exception is attribute rendering, which was re-written.

codecov-io commented 6 years ago

Codecov Report

Merging #56 into master will increase coverage by 0.63%. The diff coverage is 97.01%.

@@            Coverage Diff             @@
##           master      #56      +/-   ##
==========================================
+ Coverage   77.23%   77.87%   +0.63%     
==========================================
  Files          14       14              
  Lines        3466     3521      +55     
==========================================
+ Hits         2677     2742      +65     
+ Misses        789      779      -10

Impacted Files	Coverage Δ
src/html.c	`87.43% <100%> (+2.33%)`	:arrow_up:
src/context_test.c	`98.51% <100%> (+0.19%)`	:arrow_up:
src/document.c	`88.92% <92.98%> (+0.11%)`	:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 19b30fc...65b87ca. Read the comment docs.

kjdev commented 6 years ago

Thanks.

Sjlver commented 6 years ago

@kjdev : Many of the bugs in this PR were found through fuzzing through the Google Autofuzz project. Autofuzz is an internal project, but a similar service is offered for free to open-source software. This is called OSS-Fuzz and described on the Google Opensource blog.

Hoextdown is eligible for inclusion to the OSS-Fuzz project. This can provide additional continuous fuzzing. I encourage you to investigate the options for integrating Hoextdown in OSS-Fuzz. If you have any questions about it, don't hesitate to let me know.

kjdev / hoextdown

Multiple fixes to parsing and html rendering #56

Codecov Report