tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

jsrtfuzzing-example.js (1655B)


      1 /* -*- Mode: javascript; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
      2 /* This Source Code Form is subject to the terms of the Mozilla Public
      3 * License, v. 2.0. If a copy of the MPL was not distributed with this
      4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
      5 
      6 // This global will hold the current fuzzing buffer for each iteration.
      7 var fuzzBuf;
      8 
      9 function JSFuzzIterate() {
     10  // This function is called per iteration. You must ensure that:
     11  //
     12  //   1) Each of your actions/decisions is only based on fuzzBuf,
     13  //      in particular not on Math.random(), Date/Time or other
     14  //      external inputs.
     15  //
     16  //   2) Your actions should be deterministic. The same fuzzBuf
     17  //      should always lead to the same set of actions/decisions.
     18  //
     19  //   3) You can modify the global where needed, but ensure that
     20  //      each iteration is isolated from one another by cleaning
     21  //      any modifications to the global after each iteration.
     22  //      In particular, iterations must not depend on or influence
     23  //      each other in any way (see also 1)).
     24  //
     25  //   4) You must catch all exceptions.
     26 
     27  try {
     28    // This is a very simple UTF-16 string conversion for example purposes only.
     29    let input = String.fromCharCode.apply(
     30      null,
     31      new Uint16Array(fuzzBuf.buffer)
     32    );
     33 
     34    // Pass the input through the JSON code as an example. Note that this
     35    // particular example could probably be implemented more efficiently
     36    // directly in fuzz-tests on a C++ level. This is purely for demonstration
     37    // purposes.
     38    print(JSON.stringify(JSON.parse(input)));
     39  } catch (exc) {
     40    print(exc);
     41  }
     42 }