From b345db464bbf97521f46b0eba4ae55d4f54d0688 Mon Sep 17 00:00:00 2001
From: Arthur Chan <arthur.chan@adalogics.com>
Date: Tue, 3 Nov 2026 08:23:29 +0000
Subject: [PATCH 1/2] OSS-Fuzz: Create new fuzzer/corpus/dict targets xml
 processing

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
---
 cmake/fuzzing_build.cmake                     |   2 +-
 fuzzing/bt_xml_roundtrip_fuzzer.cpp           | 309 ++++++++++++++++++
 .../bt_xml_roundtrip_fuzzer/raw-malformed-xml | Bin 0 -> 56 bytes
 .../bt_xml_roundtrip_fuzzer/raw-model-doc     | Bin 0 -> 153 bytes
 .../bt_xml_roundtrip_fuzzer/raw-valid-xml     | Bin 0 -> 388 bytes
 .../roundtrip-model-section                   | Bin 0 -> 14 bytes
 .../roundtrip-single-tree                     | Bin 0 -> 16 bytes
 .../roundtrip-subtree-model                   | Bin 0 -> 15 bytes
 .../dictionaries/bt_xml_roundtrip_fuzzer.dict |  36 ++
 9 files changed, 346 insertions(+), 1 deletion(-)
 create mode 100644 fuzzing/bt_xml_roundtrip_fuzzer.cpp
 create mode 100644 fuzzing/corpus/bt_xml_roundtrip_fuzzer/raw-malformed-xml
 create mode 100644 fuzzing/corpus/bt_xml_roundtrip_fuzzer/raw-model-doc
 create mode 100644 fuzzing/corpus/bt_xml_roundtrip_fuzzer/raw-valid-xml
 create mode 100644 fuzzing/corpus/bt_xml_roundtrip_fuzzer/roundtrip-model-section
 create mode 100644 fuzzing/corpus/bt_xml_roundtrip_fuzzer/roundtrip-single-tree
 create mode 100644 fuzzing/corpus/bt_xml_roundtrip_fuzzer/roundtrip-subtree-model
 create mode 100644 fuzzing/dictionaries/bt_xml_roundtrip_fuzzer.dict

diff --git a/cmake/fuzzing_build.cmake b/cmake/fuzzing_build.cmake
index 43f367001..45f21c282 100644
--- a/cmake/fuzzing_build.cmake
+++ b/cmake/fuzzing_build.cmake
@@ -106,7 +106,7 @@ endfunction()
 
 # Function to add fuzzing targets - compatible with both local and OSS-Fuzz builds
 function(add_fuzzing_targets)
-  set(FUZZERS bt_fuzzer script_fuzzer bb_fuzzer)
+  set(FUZZERS bt_fuzzer script_fuzzer bb_fuzzer bt_xml_roundtrip_fuzzer)
 
   foreach(fuzzer ${FUZZERS})
     add_executable(${fuzzer} fuzzing/${fuzzer}.cpp)
diff --git a/fuzzing/bt_xml_roundtrip_fuzzer.cpp b/fuzzing/bt_xml_roundtrip_fuzzer.cpp
new file mode 100644
index 000000000..c37bce5d1
--- /dev/null
+++ b/fuzzing/bt_xml_roundtrip_fuzzer.cpp
@@ -0,0 +1,309 @@
+// Fuzz target: bt_xml_roundtrip_fuzzer
+//
+// Threat model: BehaviorTree.CPP both *reads* XML from untrusted sources and
+// *writes* XML that other tools re-read (Groot2 project files, exported
+// trees, persisted models). A divergence between writer and reader is a bug
+// on its own; the writer path (WriteTreeToXML, writeTreeNodesModelXML,
+// writeTreeXSD) and the model/manifest reading paths are dark in production
+// coverage (xml_parsing.cpp 50.6%, tinyxml2 writer paths unexercised).
+//
+// Strategy:
+//   mode 0: raw fuzz bytes into VerifyXML / registerBehaviorTreeFromText
+//           (parser error and recovery paths),
+//   modes 1-3: generate a *valid* document (optionally with two trees or a
+//           <TreeNodesModel> section), build the tree, export it with
+//           WriteTreeToXML (both metadata/builtin-model flags), re-parse the
+//           export in a fresh factory, export again, and additionally
+//           generate + re-verify the nodes-model XML and the XSD writer.
+//
+// All generation is bounded exactly as in bt_tree_exec_fuzzer (depth, child
+// counts, no infinite loops, no real sleeps). No tree is ticked here: the
+// tick engine belongs to bt_tree_exec_fuzzer; this target owns the parse and
+// serialize surface.
+//
+// Expected bug classes: memory-safety in tinyxml2 writer/reader paths,
+// XML attribute escaping/unescaping mismatches, logic divergence between
+// export and re-import (lost or duplicated attributes/ports).
+
+#include "behaviortree_cpp/bt_factory.h"
+#include "behaviortree_cpp/blackboard.h"
+#include "behaviortree_cpp/xml_parsing.h"
+
+#include <fuzzer/FuzzedDataProvider.h>
+
+#include <cstdint>
+#include <string>
+#include <unordered_map>
+
+namespace
+{
+
+constexpr int kMaxDepth = 3;
+
+const char* kConditionScripts[] = {
+  "var > 0", "var < 5", "flag", "!flag", "str == 'abc'", "var == MODE_A"
+};
+const char* kLiterals[] = { "1", "2", "true", "false", "1.5", "hello", "{var}" };
+const char* kStatuses[] = { "SUCCESS", "FAILURE", "SKIPPED" };
+
+std::string pickCondition(FuzzedDataProvider& fdp)
+{
+  return fdp.PickValueInArray(kConditionScripts);
+}
+
+std::string genConditionLeaf(FuzzedDataProvider& fdp)
+{
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 2))
+  {
+    case 0:
+      return "<ScriptCondition code=\"" + pickCondition(fdp) + "\"/>";
+    case 1:
+      return "<AlwaysSuccess/>";
+    default:
+      return "<AlwaysFailure/>";
+  }
+}
+
+std::string genLeaf(FuzzedDataProvider& fdp)
+{
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 8))
+  {
+    case 0:
+      return "<AlwaysSuccess/>";
+    case 1:
+      return "<AlwaysFailure/>";
+    case 2:
+      return "<Script code=\"var = var + 1\"/>";
+    case 3:
+      return "<ScriptCondition code=\"" + pickCondition(fdp) + "\"/>";
+    case 4:
+      return std::string("<SetBlackboard output_key=\"var2\" value=\"") +
+             fdp.PickValueInArray(kLiterals) + "\"/>";
+    case 5:
+      return "<Sleep msec=\"1\"/>";
+    case 6:
+      return "<UnsetBlackboard key=\"var2\"/>";
+    case 7:
+      return "<Script code=\"{txt}\"/>";
+    default:
+      return "<AlwaysSuccess name=\"task_a\"/>";
+  }
+}
+
+std::string genDecorator(FuzzedDataProvider& fdp, int depth);
+std::string genControl(FuzzedDataProvider& fdp, int depth);
+
+std::string genNode(FuzzedDataProvider& fdp, int depth)
+{
+  if(depth >= kMaxDepth)
+  {
+    return genLeaf(fdp);
+  }
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 2))
+  {
+    case 0:
+      return genLeaf(fdp);
+    case 1:
+      return genDecorator(fdp, depth);
+    default:
+      return genControl(fdp, depth);
+  }
+}
+
+std::string genDecorator(FuzzedDataProvider& fdp, int depth)
+{
+  const std::string child = genNode(fdp, depth + 1);
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 10))
+  {
+    case 0:
+      return "<Inverter>" + child + "</Inverter>";
+    case 1:
+      return "<ForceSuccess>" + child + "</ForceSuccess>";
+    case 2:
+      return "<ForceFailure>" + child + "</ForceFailure>";
+    case 3:
+      return "<KeepRunningUntilFailure>" + child + "</KeepRunningUntilFailure>";
+    case 4:
+      return "<RunOnce>" + child + "</RunOnce>";
+    case 5:
+      return "<Repeat num_cycles=\"2\">" + child + "</Repeat>";
+    case 6:
+      return "<RetryUntilSuccessful num_attempts=\"2\">" + child +
+             "</RetryUntilSuccessful>";
+    case 7:
+      return "<Timeout msec=\"10\">" + child + "</Timeout>";
+    case 8:
+      return "<Delay delay_msec=\"1\">" + child + "</Delay>";
+    case 9:
+      return "<Precondition if=\"" + pickCondition(fdp) + "\" else=\"" +
+             std::string(fdp.PickValueInArray(kStatuses)) + "\">" + child +
+             "</Precondition>";
+    default:
+      return std::string("<LoopString queue=\"a;b\" value=\"{loops}\" if_empty=\"") +
+             fdp.PickValueInArray(kStatuses) + "\">" + child + "</LoopString>";
+  }
+}
+
+std::string genChildrenBody(FuzzedDataProvider& fdp, int depth, size_t count)
+{
+  std::string body;
+  for(size_t i = 0; i < count; i++)
+  {
+    body += genNode(fdp, depth + 1);
+  }
+  return body;
+}
+
+std::string genControl(FuzzedDataProvider& fdp, int depth)
+{
+  const size_t n = fdp.ConsumeIntegralInRange<size_t>(1, 3);
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 10))
+  {
+    case 0:
+      return "<Sequence>" + genChildrenBody(fdp, depth, n) + "</Sequence>";
+    case 1:
+      return "<ReactiveSequence>" + genChildrenBody(fdp, depth, n) +
+             "</ReactiveSequence>";
+    case 2:
+      return "<AsyncSequence>" + genChildrenBody(fdp, depth, n) +
+             "</AsyncSequence>";
+    case 3:
+      return "<Fallback>" + genChildrenBody(fdp, depth, n) + "</Fallback>";
+    case 4:
+      return "<ReactiveFallback>" + genChildrenBody(fdp, depth, n) +
+             "</ReactiveFallback>";
+    case 5:
+      return "<AsyncFallback>" + genChildrenBody(fdp, depth, n) +
+             "</AsyncFallback>";
+    case 6:
+    {
+      const size_t children = fdp.ConsumeIntegralInRange<size_t>(1, 3);
+      return "<Parallel success_count=\"1\" failure_count=\"" +
+             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) +
+             "\">" + genChildrenBody(fdp, depth, children) + "</Parallel>";
+    }
+    case 7:
+      return "<ParallelAll failure_count=\"1\">" + genChildrenBody(fdp, depth, n) +
+             "</ParallelAll>";
+    case 8:
+      return "<IfThenElse>" + genConditionLeaf(fdp) + genNode(fdp, depth + 1) +
+             "</IfThenElse>";
+    case 9:
+      return "<Switch3 variable=\"{var}\" case_1=\"1\" case_2=\"2\" case_3=\"3\">" +
+             genChildrenBody(fdp, depth, 4) + "</Switch3>";
+    default:
+      return "<WhileDoElse>" + genConditionLeaf(fdp) + genNode(fdp, depth + 1) +
+             "</WhileDoElse>";
+  }
+}
+
+std::string wrapTree(const std::string& tree_id, const std::string& body)
+{
+  return "<BehaviorTree ID=\"" + tree_id + "\">" + body + "</BehaviorTree>";
+}
+
+// A model section describing two custom nodes: exercises the
+// <TreeNodesModel> reading path when embedded in a full document.
+const char* kModelSection =
+    "<TreeNodesModel>"
+    "<Action ID=\"CustomAct\" description=\"fuzz action\">"
+    "<input_port name=\"p\" type=\"int\" default=\"3\"/>"
+    "<output_port name=\"q\" type=\"string\"/>"
+    "</Action>"
+    "<Condition ID=\"CustomCond\" description=\"fuzz condition\">"
+    "<input_port name=\"c\" type=\"bool\"/>"
+    "</Condition>"
+    "</TreeNodesModel>";
+
+}  // namespace
+
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+  if(size < 8)
+  {
+    return 0;
+  }
+  FuzzedDataProvider fdp(data, size);
+
+  BT::BehaviorTreeFactory factory;
+  factory.registerScriptingEnum("MODE_A", 1);
+
+  try
+  {
+    switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 3))
+    {
+      case 0:
+      {
+        // raw fuzz bytes into the parser: error and recovery paths
+        const std::string raw = fdp.ConsumeRandomLengthString(size);
+        const std::unordered_map<std::string, BT::NodeType> no_nodes;
+        BT::VerifyXML(raw, no_nodes);
+        factory.registerBehaviorTreeFromText(raw);
+        return 0;
+      }
+      case 1:
+      {
+        // single valid tree: export -> re-import -> export
+        const std::string xml =
+            "<root BTCPP_format=\"4\">" + wrapTree("MainTree", genNode(fdp, 0)) +
+            "</root>";
+        factory.registerBehaviorTreeFromText(xml);
+        auto blackboard = BT::Blackboard::create();
+        auto tree = factory.createTree("MainTree", blackboard);
+        const bool add_metadata = fdp.ConsumeBool();
+        const bool add_builtin_models = fdp.ConsumeBool();
+        const std::string exported =
+            BT::WriteTreeToXML(tree, add_metadata, add_builtin_models);
+        BT::BehaviorTreeFactory factory2;
+        factory2.registerScriptingEnum("MODE_A", 1);
+        factory2.registerBehaviorTreeFromText(exported);
+        auto tree2 = factory2.createTree("MainTree", BT::Blackboard::create());
+        (void)BT::WriteTreeToXML(tree2, add_metadata, add_builtin_models);
+        break;
+      }
+      case 2:
+      {
+        // two trees with a SubTree reference, then the model + XSD writers
+        const std::string xml =
+            "<root BTCPP_format=\"4\">" +
+            wrapTree("MainTree",
+                     "<Sequence><SubTree ID=\"Aux\"/>" + genNode(fdp, 0) +
+                         "</Sequence>") +
+            wrapTree("Aux", genLeaf(fdp)) + "</root>";
+        factory.registerBehaviorTreeFromText(xml);
+        auto blackboard = BT::Blackboard::create();
+        auto tree = factory.createTree("MainTree", blackboard);
+        const std::string exported = BT::WriteTreeToXML(tree, true, true);
+        BT::BehaviorTreeFactory factory2;
+        factory2.registerBehaviorTreeFromText(exported);
+        const std::string model = BT::writeTreeNodesModelXML(factory, true);
+        BT::VerifyXML(model, {});
+        (void)BT::writeTreeXSD(factory);
+        break;
+      }
+      default:
+      {
+        // document that also embeds a <TreeNodesModel> section
+        const std::string xml = "<root BTCPP_format=\"4\">" +
+                                wrapTree("MainTree", genNode(fdp, 0)) +
+                                kModelSection + "</root>";
+        factory.registerBehaviorTreeFromText(xml);
+        auto blackboard = BT::Blackboard::create();
+        auto tree = factory.createTree("MainTree", blackboard);
+        (void)BT::WriteTreeToXML(tree, fdp.ConsumeBool(), true);
+        const std::string model = BT::writeTreeNodesModelXML(factory, false);
+        BT::BehaviorTreeFactory factory2;
+        factory2.registerBehaviorTreeFromText(model);
+        break;
+      }
+    }
+  }
+  catch(const std::exception&)
+  {
+    // malformed input and unknown-node errors are expected here
+  }
+
+  return 0;
+}
+
diff --git a/fuzzing/corpus/bt_xml_roundtrip_fuzzer/raw-malformed-xml b/fuzzing/corpus/bt_xml_roundtrip_fuzzer/raw-malformed-xml
new file mode 100644
index 0000000000000000000000000000000000000000..c0b59b00616020f39ac831ff60b263457f07a25a
GIT binary patch
literal 56
zcmcC1%Fi#cvvEqzNG!|DFA6D2O;zx8u~qU-%*+FEl<aJRQwvK|^O95TY~1qm6_OH*
IY?TZd053oiv;Y7A

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_xml_roundtrip_fuzzer/raw-model-doc b/fuzzing/corpus/bt_xml_roundtrip_fuzzer/raw-model-doc
new file mode 100644
index 0000000000000000000000000000000000000000..325eebcb4f06ba5e91e7aa85f5f126a7a93aeb41
GIT binary patch
literal 153
zcmcC1%Fi!Ra0+n_2#8P1FUn0Uu~jlrva<;(N=^04Pf0EI1rj-SHqQBZDVZgi`FRSS
zF1AX}rNt%rxgaqm1)!SbqRax2oUKwaP-|vhL1{^RL4Hw*LSABSDo9YFq_P0WNXpO8
VQPQ`w(TAG`WTV@p4|0(m0|56dH1Gfb

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_xml_roundtrip_fuzzer/raw-valid-xml b/fuzzing/corpus/bt_xml_roundtrip_fuzzer/raw-valid-xml
new file mode 100644
index 0000000000000000000000000000000000000000..c7b3891c5d46fe77760c3738c8ba8ad604c76e76
GIT binary patch
literal 388
zcmZvY!A`?442F3WD=$!(khnCJ=nxWzp^1%i6;e-&mc}7*iu(3A<-mlvSavM`|M#a&
zL=63LyWbBdN|Rx&?p4?Jcs8@6bWDiw@}$+yxKIb#9q_YYuqd5PE;3jeQLEV`&~T@k
zu6;vJ%X?tw55-!{`BXfFG7W|qr^s2WO%+<tw-iRlj>45r2e(z{(SMmGKO5&uLYbTY
zgewsD-q_0rnKS|wj)jK{E-TYU!EAgHz=tZ?{L(kqA-lGwdzB=4C&i1oU7>3DZOKfN
rJSdR;N-exvjS|9z>J}+61T%?ERKQD=#syv-e}u&PuR~Kmzq|PckI;t%

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_xml_roundtrip_fuzzer/roundtrip-model-section b/fuzzing/corpus/bt_xml_roundtrip_fuzzer/roundtrip-model-section
new file mode 100644
index 0000000000000000000000000000000000000000..27644f80650baec01f76cee80b3f3e7a1d8af140
GIT binary patch
literal 14
QcmZ>CgaAfH1_nlE02Oiq4*&oF

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_xml_roundtrip_fuzzer/roundtrip-single-tree b/fuzzing/corpus/bt_xml_roundtrip_fuzzer/roundtrip-single-tree
new file mode 100644
index 0000000000000000000000000000000000000000..9c1594cff3417a0f85a4d667810559394c8fa7a3
GIT binary patch
literal 16
ScmZ>CgaAfH1_lO3CPn}mivkY-

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_xml_roundtrip_fuzzer/roundtrip-subtree-model b/fuzzing/corpus/bt_xml_roundtrip_fuzzer/roundtrip-subtree-model
new file mode 100644
index 0000000000000000000000000000000000000000..983a7f27fd486ab8b6cc035ebe82eb15f1851e4a
GIT binary patch
literal 15
QcmZ>Cga8I0U}Rzf02g!u4gdfE

literal 0
HcmV?d00001

diff --git a/fuzzing/dictionaries/bt_xml_roundtrip_fuzzer.dict b/fuzzing/dictionaries/bt_xml_roundtrip_fuzzer.dict
new file mode 100644
index 000000000..bcc24d559
--- /dev/null
+++ b/fuzzing/dictionaries/bt_xml_roundtrip_fuzzer.dict
@@ -0,0 +1,36 @@
+# Dictionary for bt_xml_roundtrip_fuzzer: export/serialization tokens.
+"<root BTCPP_format=\"4\">"
+"<BehaviorTree ID=\"MainTree\">"
+"</BehaviorTree>"
+"<SubTree ID=\"Aux\"/>"
+"<TreeNodesModel>"
+"</TreeNodesModel>"
+"<Action ID=\""
+"<Condition ID=\""
+"<Control ID=\""
+"<Decorator ID=\""
+"<SubTree ID=\""
+"description=\""
+"<input_port name=\"p\" type=\"int\" default=\"3\"/>"
+"<output_port name=\"q\" type=\"string\"/>"
+"BTCPP_format="
+"ID="
+"name="
+"_uid=\""
+"_fullPath=\""
+"<Sequence>"
+"<Fallback>"
+"<Parallel success_count=\"1\" failure_count=\"1\">"
+"<Timeout msec=\"10\">"
+"<Repeat num_cycles=\"2\">"
+"<Precondition if=\"var > 0\" else=\"FAILURE\">"
+"<Script code=\"var = var + 1\"/>"
+"<ScriptCondition code=\"var > 0\"/>"
+"<SetBlackboard output_key=\"var2\" value=\"{var}\"/>"
+"<AlwaysSuccess/>"
+"<AlwaysFailure/>"
+"SUCCESS"
+"FAILURE"
+"SKIPPED"
+"{var}"
+"var"

From d2bec9d28b905ee39587e29322122a3643e4b97b Mon Sep 17 00:00:00 2001
From: Arthur Chan <arthur.chan@adalogics.com>
Date: Tue, 3 Nov 2026 09:53:34 +0000
Subject: [PATCH 2/2] Fix formatting

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
---
 fuzzing/bt_xml_roundtrip_fuzzer.cpp | 71 ++++++++++++-----------------
 1 file changed, 29 insertions(+), 42 deletions(-)

diff --git a/fuzzing/bt_xml_roundtrip_fuzzer.cpp b/fuzzing/bt_xml_roundtrip_fuzzer.cpp
index c37bce5d1..20a539aee 100644
--- a/fuzzing/bt_xml_roundtrip_fuzzer.cpp
+++ b/fuzzing/bt_xml_roundtrip_fuzzer.cpp
@@ -25,24 +25,23 @@
 // XML attribute escaping/unescaping mismatches, logic divergence between
 // export and re-import (lost or duplicated attributes/ports).
 
-#include "behaviortree_cpp/bt_factory.h"
 #include "behaviortree_cpp/blackboard.h"
+#include "behaviortree_cpp/bt_factory.h"
 #include "behaviortree_cpp/xml_parsing.h"
 
-#include <fuzzer/FuzzedDataProvider.h>
-
 #include <cstdint>
 #include <string>
 #include <unordered_map>
 
+#include <fuzzer/FuzzedDataProvider.h>
+
 namespace
 {
 
 constexpr int kMaxDepth = 3;
 
-const char* kConditionScripts[] = {
-  "var > 0", "var < 5", "flag", "!flag", "str == 'abc'", "var == MODE_A"
-};
+const char* kConditionScripts[] = { "var > 0", "var < 5",      "flag",
+                                    "!flag",   "str == 'abc'", "var == MODE_A" };
 const char* kLiterals[] = { "1", "2", "true", "false", "1.5", "hello", "{var}" };
 const char* kStatuses[] = { "SUCCESS", "FAILURE", "SKIPPED" };
 
@@ -165,22 +164,19 @@ std::string genControl(FuzzedDataProvider& fdp, int depth)
       return "<ReactiveSequence>" + genChildrenBody(fdp, depth, n) +
              "</ReactiveSequence>";
     case 2:
-      return "<AsyncSequence>" + genChildrenBody(fdp, depth, n) +
-             "</AsyncSequence>";
+      return "<AsyncSequence>" + genChildrenBody(fdp, depth, n) + "</AsyncSequence>";
     case 3:
       return "<Fallback>" + genChildrenBody(fdp, depth, n) + "</Fallback>";
     case 4:
       return "<ReactiveFallback>" + genChildrenBody(fdp, depth, n) +
              "</ReactiveFallback>";
     case 5:
-      return "<AsyncFallback>" + genChildrenBody(fdp, depth, n) +
-             "</AsyncFallback>";
-    case 6:
-    {
+      return "<AsyncFallback>" + genChildrenBody(fdp, depth, n) + "</AsyncFallback>";
+    case 6: {
       const size_t children = fdp.ConsumeIntegralInRange<size_t>(1, 3);
       return "<Parallel success_count=\"1\" failure_count=\"" +
-             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) +
-             "\">" + genChildrenBody(fdp, depth, children) + "</Parallel>";
+             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) + "\">" +
+             genChildrenBody(fdp, depth, children) + "</Parallel>";
     }
     case 7:
       return "<ParallelAll failure_count=\"1\">" + genChildrenBody(fdp, depth, n) +
@@ -204,20 +200,18 @@ std::string wrapTree(const std::string& tree_id, const std::string& body)
 
 // A model section describing two custom nodes: exercises the
 // <TreeNodesModel> reading path when embedded in a full document.
-const char* kModelSection =
-    "<TreeNodesModel>"
-    "<Action ID=\"CustomAct\" description=\"fuzz action\">"
-    "<input_port name=\"p\" type=\"int\" default=\"3\"/>"
-    "<output_port name=\"q\" type=\"string\"/>"
-    "</Action>"
-    "<Condition ID=\"CustomCond\" description=\"fuzz condition\">"
-    "<input_port name=\"c\" type=\"bool\"/>"
-    "</Condition>"
-    "</TreeNodesModel>";
+const char* kModelSection = "<TreeNodesModel>"
+                            "<Action ID=\"CustomAct\" description=\"fuzz action\">"
+                            "<input_port name=\"p\" type=\"int\" default=\"3\"/>"
+                            "<output_port name=\"q\" type=\"string\"/>"
+                            "</Action>"
+                            "<Condition ID=\"CustomCond\" description=\"fuzz condition\">"
+                            "<input_port name=\"c\" type=\"bool\"/>"
+                            "</Condition>"
+                            "</TreeNodesModel>";
 
 }  // namespace
 
-
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
   if(size < 8)
@@ -233,8 +227,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
   {
     switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 3))
     {
-      case 0:
-      {
+      case 0: {
         // raw fuzz bytes into the parser: error and recovery paths
         const std::string raw = fdp.ConsumeRandomLengthString(size);
         const std::unordered_map<std::string, BT::NodeType> no_nodes;
@@ -242,12 +235,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
         factory.registerBehaviorTreeFromText(raw);
         return 0;
       }
-      case 1:
-      {
+      case 1: {
         // single valid tree: export -> re-import -> export
-        const std::string xml =
-            "<root BTCPP_format=\"4\">" + wrapTree("MainTree", genNode(fdp, 0)) +
-            "</root>";
+        const std::string xml = "<root BTCPP_format=\"4\">" +
+                                wrapTree("MainTree", genNode(fdp, 0)) + "</root>";
         factory.registerBehaviorTreeFromText(xml);
         auto blackboard = BT::Blackboard::create();
         auto tree = factory.createTree("MainTree", blackboard);
@@ -262,14 +253,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
         (void)BT::WriteTreeToXML(tree2, add_metadata, add_builtin_models);
         break;
       }
-      case 2:
-      {
+      case 2: {
         // two trees with a SubTree reference, then the model + XSD writers
         const std::string xml =
             "<root BTCPP_format=\"4\">" +
-            wrapTree("MainTree",
-                     "<Sequence><SubTree ID=\"Aux\"/>" + genNode(fdp, 0) +
-                         "</Sequence>") +
+            wrapTree("MainTree", "<Sequence><SubTree ID=\"Aux\"/>" + genNode(fdp, 0) +
+                                     "</Sequence>") +
             wrapTree("Aux", genLeaf(fdp)) + "</root>";
         factory.registerBehaviorTreeFromText(xml);
         auto blackboard = BT::Blackboard::create();
@@ -282,12 +271,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
         (void)BT::writeTreeXSD(factory);
         break;
       }
-      default:
-      {
+      default: {
         // document that also embeds a <TreeNodesModel> section
         const std::string xml = "<root BTCPP_format=\"4\">" +
-                                wrapTree("MainTree", genNode(fdp, 0)) +
-                                kModelSection + "</root>";
+                                wrapTree("MainTree", genNode(fdp, 0)) + kModelSection +
+                                "</root>";
         factory.registerBehaviorTreeFromText(xml);
         auto blackboard = BT::Blackboard::create();
         auto tree = factory.createTree("MainTree", blackboard);
@@ -306,4 +294,3 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 
   return 0;
 }
-