/src/quickjs/fuzz/fuzz_compile.c
Line | Count | Source |
1 | | /* Copyright 2020 Google Inc. |
2 | | |
3 | | Licensed under the Apache License, Version 2.0 (the "License"); |
4 | | you may not use this file except in compliance with the License. |
5 | | You may obtain a copy of the License at |
6 | | |
7 | | http://www.apache.org/licenses/LICENSE-2.0 |
8 | | |
9 | | Unless required by applicable law or agreed to in writing, software |
10 | | distributed under the License is distributed on an "AS IS" BASIS, |
11 | | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
12 | | See the License for the specific language governing permissions and |
13 | | limitations under the License. |
14 | | */ |
15 | | |
16 | | #include "quickjs.h" |
17 | | #include "quickjs-libc.h" |
18 | | #include "cutils.h" |
19 | | #include "fuzz/fuzz_common.h" |
20 | | |
21 | | #include <stdint.h> |
22 | | #include <stdio.h> |
23 | | |
24 | | |
25 | 15 | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
26 | 15 | if (size == 0) |
27 | 0 | return 0; |
28 | | |
29 | 15 | JSRuntime *rt = JS_NewRuntime(); |
30 | 15 | JSContext *ctx = JS_NewContext(rt); |
31 | 15 | test_one_input_init(rt, ctx); |
32 | | |
33 | 15 | uint8_t *null_terminated_data = malloc(size + 1); |
34 | 15 | memcpy(null_terminated_data, data, size); |
35 | 15 | null_terminated_data[size] = 0; |
36 | | |
37 | 15 | JSValue obj = JS_Eval(ctx, (const char *)null_terminated_data, size, "<none>", JS_EVAL_FLAG_COMPILE_ONLY | JS_EVAL_TYPE_MODULE); |
38 | 15 | free(null_terminated_data); |
39 | | //TODO target with JS_ParseJSON |
40 | 15 | if (JS_IsException(obj)) { |
41 | 7 | js_std_free_handlers(rt); |
42 | 7 | JS_FreeValue(ctx, obj); |
43 | 7 | JS_FreeContext(ctx); |
44 | 7 | JS_FreeRuntime(rt); |
45 | 7 | return 0; |
46 | 7 | } |
47 | 8 | obj = js_std_await(ctx, obj); |
48 | 8 | size_t bytecode_size; |
49 | 8 | uint8_t* bytecode = JS_WriteObject(ctx, &bytecode_size, obj, JS_WRITE_OBJ_BYTECODE); |
50 | 8 | JS_FreeValue(ctx, obj); |
51 | 8 | if (!bytecode) { |
52 | 0 | js_std_free_handlers(rt); |
53 | 0 | JS_FreeContext(ctx); |
54 | 0 | JS_FreeRuntime(rt); |
55 | 0 | return 0; |
56 | 0 | } |
57 | 8 | obj = JS_ReadObject(ctx, bytecode, bytecode_size, JS_READ_OBJ_BYTECODE); |
58 | 8 | js_free(ctx, bytecode); |
59 | 8 | if (JS_IsException(obj)) { |
60 | 0 | js_std_free_handlers(rt); |
61 | 0 | JS_FreeContext(ctx); |
62 | 0 | JS_FreeRuntime(rt); |
63 | 0 | return 0; |
64 | 0 | } |
65 | 8 | reset_nbinterrupts(); |
66 | | /* this is based on |
67 | | * js_std_eval_binary(ctx, bytecode, bytecode_size, 0); |
68 | | * modified so as not to exit on JS exception |
69 | | */ |
70 | 8 | JSValue val; |
71 | 8 | if (JS_VALUE_GET_TAG(obj) == JS_TAG_MODULE) { |
72 | 8 | if (JS_ResolveModule(ctx, obj) < 0) { |
73 | 0 | JS_FreeValue(ctx, obj); |
74 | 0 | js_std_free_handlers(rt); |
75 | 0 | JS_FreeContext(ctx); |
76 | 0 | JS_FreeRuntime(rt); |
77 | 0 | return 0; |
78 | 0 | } |
79 | 8 | js_module_set_import_meta(ctx, obj, FALSE, TRUE); |
80 | 8 | } |
81 | 8 | val = JS_EvalFunction(ctx, obj); |
82 | 8 | if (JS_IsException(val)) { |
83 | 0 | js_std_dump_error(ctx); |
84 | 8 | } else { |
85 | 8 | js_std_loop(ctx); |
86 | 8 | } |
87 | 8 | JS_FreeValue(ctx, val); |
88 | 8 | js_std_free_handlers(rt); |
89 | 8 | JS_FreeContext(ctx); |
90 | 8 | JS_FreeRuntime(rt); |
91 | | |
92 | 8 | return 0; |
93 | 8 | } |