1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
// Copyright 2017 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <stdlib.h>
#include <iostream>
#include "base/memory/raw_ptr.h"
#include "javascript_parser.pb.h" // from out/gen
#include "testing/libfuzzer/fuzzers/javascript_parser_proto_to_string.h"
#include "testing/libfuzzer/libfuzzer_exports.h"
#include "third_party/libprotobuf-mutator/src/src/libfuzzer/libfuzzer_macro.h"
#include "v8/include/libplatform/libplatform.h"
#include "v8/include/v8.h"
// Encapsulates process-wide v8 state, initialized once per fuzzing session.
class Environment {
public:
// Returns the singleton v8 environment.
static Environment& Get() {
// Defining this as a static function variable instead of a global avoids
// LSAN complaining about a leak.
// See also: https://llvm.org/docs/LibFuzzer.html#startup-initialization
static Environment environment;
return environment;
}
v8::Isolate* isolate() { return isolate_; }
private:
Environment() {
platform_ = v8::platform::NewDefaultPlatform();
v8::V8::InitializePlatform(platform_.get());
v8::V8::Initialize();
v8::Isolate::CreateParams create_params;
create_params.array_buffer_allocator =
v8::ArrayBuffer::Allocator::NewDefaultAllocator();
isolate_ = v8::Isolate::New(create_params);
}
std::unique_ptr<v8::Platform> platform_;
raw_ptr<v8::Isolate> isolate_ = nullptr;
};
std::string protobuf_to_string(
const javascript_parser_proto_fuzzer::Source& source_protobuf) {
std::string source;
for (const auto& token : source_protobuf.tokens()) {
source += token_to_string(token, 0) + std::string(" ");
}
return source;
}
extern "C" int
LLVMFuzzerInitialize(int* argc, char*** argv) {
v8::V8::InitializeICUDefaultLocation((*argv)[0]);
v8::V8::InitializeExternalStartupData((*argv)[0]);
v8::V8::SetFlagsFromCommandLine(argc, *argv, true);
return 0;
}
DEFINE_BINARY_PROTO_FUZZER(
const javascript_parser_proto_fuzzer::Source& source_protobuf) {
v8::Isolate* isolate = Environment::Get().isolate();
v8::Isolate::Scope isolate_scope(isolate);
v8::HandleScope handle_scope(isolate);
v8::Local<v8::Context> context = v8::Context::New(isolate);
v8::Context::Scope context_scope(context);
std::string source_string = protobuf_to_string(source_protobuf);
if (getenv("LPM_DUMP_NATIVE_INPUT")) {
std::cout << source_string << std::endl;
std::cout << "module: " << source_protobuf.is_module() << std::endl;
}
v8::Local<v8::String> source_v8_string =
v8::String::NewFromUtf8(isolate, source_string.c_str(),
v8::NewStringType::kNormal)
.ToLocalChecked();
{
v8::TryCatch try_catch(isolate);
if (source_protobuf.is_module()) {
v8::Local<v8::String> name =
v8::String::NewFromUtf8(isolate, "module.js",
v8::NewStringType::kNormal)
.ToLocalChecked();
v8::ScriptOrigin origin(name, 0, 0, false, -1, v8::Local<v8::Value>(),
false, false, true);
v8::ScriptCompiler::Source source(source_v8_string, origin);
v8::MaybeLocal<v8::Module> module =
v8::ScriptCompiler::CompileModule(isolate, &source);
// TODO(marja): Figure out a more elegant way to silence the warning.
module.IsEmpty();
} else {
v8::MaybeLocal<v8::Script> script =
v8::Script::Compile(context, source_v8_string);
// TODO(marja): Figure out a more elegant way to silence the warning.
script.IsEmpty();
}
// TODO(crbug.com/40545334): run the code once we find a way to avoid
// endless loops.
}
}
|
