mirror of
https://github.com/DoneJS-Runtime/quickjs-done-nextgen.git
synced 2025-01-09 17:43:15 +00:00
a1d1bce0b7
Check inside the deserializer that const atoms are indeed const, don't
trust the input. The serializer only writes type 0 records for const
atoms but the byte stream may have been corrupted or manipulated.
Overlooked during review of c25aad7 ("Add ability to (de)serialize
symbols")
Found with libfuzzer and it found it _really_ fast. Great tool.
23 lines
555 B
C
23 lines
555 B
C
// clang -g -O1 -fsanitize=fuzzer -o fuzz fuzz.c
|
|
#include "quickjs.h"
|
|
#include "quickjs.c"
|
|
#include "cutils.c"
|
|
#include "libbf.c"
|
|
#include "libregexp.c"
|
|
#include "libunicode.c"
|
|
#include <stdlib.h>
|
|
|
|
int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
|
|
{
|
|
JSRuntime *rt = JS_NewRuntime();
|
|
if (!rt)
|
|
exit(1);
|
|
JSContext *ctx = JS_NewContext(rt);
|
|
if (!ctx)
|
|
exit(1);
|
|
JSValueConst val = JS_ReadObject(ctx, buf, len, /*flags*/0);
|
|
JS_FreeValue(ctx, val);
|
|
JS_FreeContext(ctx);
|
|
JS_FreeRuntime(rt);
|
|
return 0;
|
|
}
|