FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

test: add fuzzer for native/js string conversion · nodejs/node@7dda156 · GitHub

/ node Public

Commit 7dda156

Browse files
AdamKorcz
authored and
marco-ippolito
committed
test: add fuzzer for native/js string conversion
Signed-off-by: Adam Korczynski <adam@adalogics.com> PR-URL: #51120 Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
1 parent 5fb829b commit 7dda156

2 files changed

Lines changed: 180 additions & 0 deletions

File tree

‎node.gyp‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1092,6 +1092,51 @@
10921092
}],
10931093
],
10941094
}, # fuzz_ClientHelloParser.cc
1095+
{ # fuzz_strings
1096+
'target_name': 'fuzz_strings',
1097+
'type': 'executable',
1098+
'dependencies': [
1099+
'<(node_lib_target_name)',
1100+
'deps/googletest/googletest.gyp:gtest_prod',
1101+
'deps/histogram/histogram.gyp:histogram',
1102+
'deps/uvwasi/uvwasi.gyp:uvwasi',
1103+
'deps/ada/ada.gyp:ada',
1104+
],
1105+
'includes': [
1106+
'node.gypi'
1107+
],
1108+
'include_dirs': [
1109+
'src',
1110+
'tools/msvs/genfiles',
1111+
'deps/v8/include',
1112+
'deps/cares/include',
1113+
'deps/uv/include',
1114+
'deps/uvwasi/include',
1115+
'test/cctest',
1116+
],
1117+
'defines': [
1118+
'NODE_ARCH="<(target_arch)"',
1119+
'NODE_PLATFORM="<(OS)"',
1120+
'NODE_WANT_INTERNALS=1',
1121+
],
1122+
'sources': [
1123+
'src/node_snapshot_stub.cc',
1124+
'test/fuzzers/fuzz_strings.cc',
1125+
],
1126+
'conditions': [
1127+
['OS=="linux"', {
1128+
'ldflags': [ '-fsanitize=fuzzer' ]
1129+
}],
1130+
# Ensure that ossfuzz flag has been set and that we are on Linux
1131+
[ 'OS!="linux" or ossfuzz!="true"', {
1132+
'type': 'none',
1133+
}],
1134+
# Avoid excessive LTO
1135+
['enable_lto=="true"', {
1136+
'ldflags': [ '-fno-lto' ],
1137+
}],
1138+
],
1139+
}, # fuzz_strings
10951140
{
10961141
'target_name': 'cctest',
10971142
'type': 'executable',

‎test/fuzzers/fuzz_strings.cc‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
/*
2+
* A fuzzer focused on C string -> Javascript String.
3+
*/
4+
5+
#include <stdlib.h>
6+
#include "js_native_api.h"
7+
#include "js_native_api_v8.h"
8+
#include "node.h"
9+
#include "node_platform.h"
10+
#include "node_internals.h"
11+
#include "node_api_internals.h"
12+
#include "node_url.h"
13+
#include "env-inl.h"
14+
#include "util-inl.h"
15+
#include "v8.h"
16+
#include "libplatform/libplatform.h"
17+
#include "aliased_buffer.h"
18+
#include "fuzz_helper.h"
19+
20+
using node::AliasedBufferBase;
21+
22+
/* General set up */
23+
using ArrayBufferUniquePtr = std::unique_ptr<node::ArrayBufferAllocator,
24+
decltype(&node::FreeArrayBufferAllocator)>;
25+
using TracingAgentUniquePtr = std::unique_ptr<node::tracing::Agent>;
26+
using NodePlatformUniquePtr = std::unique_ptr<node::NodePlatform>;
27+
28+
static TracingAgentUniquePtr tracing_agent;
29+
static NodePlatformUniquePtr platform;
30+
static uv_loop_t current_loop;
31+
static napi_env addon_env;
32+
33+
inline napi_env NewEnv(v8::Local<v8::Context> context,
34+
const std::string& module_filename,
35+
int32_t module_api_version) ;
36+
37+
extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
38+
uv_os_unsetenv("NODE_OPTIONS");
39+
std::vector<std::string> node_argv{ "fuzz_string_conversion" };
40+
std::vector<std::string> exec_argv;
41+
std::vector<std::string> errors;
42+
43+
node::InitializeNodeWithArgs(&node_argv, &exec_argv, &errors);
44+
45+
tracing_agent = std::make_unique<node::tracing::Agent>();
46+
node::tracing::TraceEventHelper::SetAgent(tracing_agent.get());
47+
node::tracing::TracingController* tracing_controller =
48+
tracing_agent->GetTracingController();
49+
CHECK_EQ(0, uv_loop_init(&current_loop));
50+
static constexpr int kV8ThreadPoolSize = 4;
51+
platform.reset(
52+
new node::NodePlatform(kV8ThreadPoolSize, tracing_controller));
53+
v8::V8::InitializePlatform(platform.get());
54+
cppgc::InitializeProcess(platform->GetPageAllocator());
55+
v8::V8::Initialize();
56+
return 0;
57+
}
58+
59+
class FuzzerFixtureHelper {
60+
public:
61+
v8::Isolate* isolate_;
62+
ArrayBufferUniquePtr allocator;
63+
64+
FuzzerFixtureHelper()
65+
: allocator(ArrayBufferUniquePtr(node::CreateArrayBufferAllocator(),
66+
&node::FreeArrayBufferAllocator)) {
67+
isolate_ = NewIsolate(allocator.get(), &current_loop, platform.get());
68+
CHECK_NOT_NULL(isolate_);
69+
isolate_->Enter();
70+
};
71+
72+
void Teardown() {
73+
platform->DrainTasks(isolate_);
74+
isolate_->Exit();
75+
platform->UnregisterIsolate(isolate_);
76+
isolate_->Dispose();
77+
isolate_ = nullptr;
78+
}
79+
};
80+
81+
void EnvTest(v8::Isolate* isolate_, char* env_string, size_t size) {
82+
const v8::HandleScope handle_scope(isolate_);
83+
Argv argv;
84+
85+
node::EnvironmentFlags::Flags flags = node::EnvironmentFlags::kDefaultFlags;
86+
auto isolate = handle_scope.GetIsolate();
87+
v8::Local<v8::Context> context_ = node::NewContext(isolate);
88+
context_->Enter();
89+
90+
node::IsolateData* isolate_data_ = node::CreateIsolateData(isolate, &current_loop,
91+
platform.get());
92+
std::vector<std::string> args(*argv, *argv + 1);
93+
std::vector<std::string> exec_args(*argv, *argv + 1);
94+
node::Environment* environment_ = node::CreateEnvironment(isolate_data_,
95+
context_, args, exec_args, flags);
96+
node::Environment* envi = environment_;
97+
SetProcessExitHandler(envi, [&](node::Environment* env_, int exit_code) {
98+
node::Stop(envi);
99+
});
100+
node::LoadEnvironment(envi, "");
101+
102+
103+
napi_addon_register_func init = [](napi_env env, napi_value exports) {
104+
addon_env = env;
105+
return exports;
106+
};
107+
v8::Local<v8::Object> module_obj = v8::Object::New(isolate);
108+
v8::Local<v8::Object> exports_obj = v8::Object::New(isolate);
109+
napi_module_register_by_symbol(
110+
exports_obj, module_obj, context_, init, NAPI_VERSION);
111+
size_t copied1, copied2;
112+
napi_value output1, output2;
113+
char *buf1 = (char *)malloc(size);
114+
char *buf2 = (char *)malloc(size);
115+
napi_create_string_utf8(addon_env, env_string, size, &output1);
116+
napi_get_value_string_utf8(addon_env, output1, buf1, size, &copied1);
117+
napi_create_string_latin1(addon_env, env_string, size, &output2);
118+
napi_get_value_string_latin1(addon_env, output2, buf2, size, &copied2);
119+
free(buf1);
120+
free(buf2);
121+
122+
// Cleanup!
123+
node::FreeEnvironment(environment_);
124+
node::FreeIsolateData(isolate_data_);
125+
context_->Exit();
126+
}
127+
128+
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data2, size_t size) {
129+
FuzzerFixtureHelper ffh;
130+
std::string s(reinterpret_cast<const char*>(data2), size);
131+
EnvTest(ffh.isolate_, (char*)s.c_str(), size);
132+
ffh.Teardown();
133+
return 0;
134+
}
135+

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL