RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 16:27:43 +00:00
Code Issues Activity Actions

Fuzzers: Skip trying to parse invalid UTF-8 in LibJS Fuzzers

Browse source 
Invalid UTF-8 crashes JS::Script::Parse.
This commit is contained in:
Andrew Kaster 2023-03-17 12:59:56 -06:00 • committed by Andreas Kling
parent f7d2392b6c
commit cabc99e953
2 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Meta/Lagom/Fuzzers/FuzzJs.cpp
View file

@ -15,6 +15,9 @@
extern "C" int LLVMFuzzerTestOneInput(uint8_t const* data, size_t size) extern "C" int LLVMFuzzerTestOneInput(uint8_t const* data, size_t size)
{ {
auto js = StringView(static_cast<unsigned char const*>(data), size); auto js = StringView(static_cast<unsigned char const*>(data), size);
// FIXME: https://github.com/SerenityOS/serenity/issues/17899
if (!Utf8View(js).validate())
return 0;
auto vm = MUST(JS::VM::create()); auto vm = MUST(JS::VM::create());
auto interpreter = JS::Interpreter::create<JS::GlobalObject>(*vm); auto interpreter = JS::Interpreter::create<JS::GlobalObject>(*vm);
auto parse_result = JS::Script::parse(js, interpreter->realm()); auto parse_result = JS::Script::parse(js, interpreter->realm());

14
Meta/Lagom/Fuzzers/FuzzilliJs.cpp
View file

@ -210,16 +210,20 @@ int main(int, char**)
auto js = StringView(static_cast<unsigned char const*>(data_buffer.data()), script_size); auto js = StringView(static_cast<unsigned char const*>(data_buffer.data()), script_size);
auto parse_result = JS::Script::parse(js, interpreter->realm()); // FIXME: https://github.com/SerenityOS/serenity/issues/17899
if (parse_result.is_error()) { if (!UTF8View(js).validate()) {
result = 1; result = 1;
} else { } else {
auto completion = interpreter->run(parse_result.value()); auto parse_result = JS::Script::parse(js, interpreter->realm());
if (completion.is_error()) { if (parse_result.is_error()) {
result = 1; result = 1;
} else {
auto completion = interpreter->run(parse_result.value());
if (completion.is_error()) {
result = 1;
}
} }
} }
fflush(stdout); fflush(stdout);
fflush(stderr); fflush(stderr);