0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Fuzzers: Skip trying to parse invalid UTF-8 in LibJS Fuzzers

Browse source 
Invalid UTF-8 crashes JS::Script::Parse.
This commit is contained in:
Andrew Kaster 2023-03-17 12:59:56 -06:00 • committed by Andreas Kling
parent f7d2392b6c
commit cabc99e953
Notes: sideshowbarker 2024-07-17 08:35:21 +09:00
2 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Meta/Lagom/Fuzzers/FuzzJs.cpp
View file

@ -15,6 +15,9 @@
extern "C" int LLVMFuzzerTestOneInput(uint8_t const* data, size_t size)
{
auto js = StringView(static_cast<unsigned char const*>(data), size);
// FIXME: https://github.com/SerenityOS/serenity/issues/17899
if (!Utf8View(js).validate())
return 0;
auto vm = MUST(JS::VM::create());
auto interpreter = JS::Interpreter::create<JS::GlobalObject>(*vm);
auto parse_result = JS::Script::parse(js, interpreter->realm());

14
Meta/Lagom/Fuzzers/FuzzilliJs.cpp
View file

@ -210,16 +210,20 @@ int main(int, char**)
auto js = StringView(static_cast<unsigned char const*>(data_buffer.data()), script_size);
auto parse_result = JS::Script::parse(js, interpreter->realm());
if (parse_result.is_error()) {
// FIXME: https://github.com/SerenityOS/serenity/issues/17899
if (!UTF8View(js).validate()) {
result = 1;
} else {
auto completion = interpreter->run(parse_result.value());
if (completion.is_error()) {
auto parse_result = JS::Script::parse(js, interpreter->realm());
if (parse_result.is_error()) {
result = 1;
} else {
auto completion = interpreter->run(parse_result.value());
if (completion.is_error()) {
result = 1;
}
}
}
fflush(stdout);
fflush(stderr);