6 Commits

Author SHA1 Message Date
Renáta Hodován
8166de8ed0
Merge 99882ef128b923262748ef80784fc1c22c3b7519 into 8807fedec55bc4dbdf7b4780d36bfc4b4fd6e5e2 2025-09-24 17:43:38 -04:00
Renata Hodovan
f5788c7b67 Define lre_check_timeout in fuzz_regexp
Since #25aaa77, lre_check_timeout must be defined by the user. The
patch adds this definition to the regexp fuzzer.
2025-04-14 15:56:15 +02:00
Fabrice Bellard
6de88859e7 more bignum cleanup 2025-03-19 11:43:31 +01:00
Renata Hodovan
99882ef128 Ensure that workers in fuzzers can create their own context
Inspired by qjs, a new helper method was added to create the JS
context, that can be reused to create context in workers, too.
2024-07-23 20:04:13 +02:00
Renáta Hodován
d53aafe0f3
Add the missing fuzz_common.c (#292) 2024-05-09 12:36:12 +02:00
Renáta Hodován
01454caf78
OSS-Fuzz targets improvements (#267)
* Move fuzz target sources from the oss-fuzz repository here

* Add support to build libFuzzer targets
* Simplify the fuzz_eval and fuzz_compile targets

The use of JS_NewContext instead of JS_NewContextRaw spares to call
JS_AddIntrinsic<XYZ> functions from the fuzz target, since the public
JS_NewContext API does exactly the same.

* Simplify the fuzz_regexp target

fuzz_regexp doesn't need to be dependant on libquickjs since the
runtime and the context - that were provided by libquickjs - were
only created to call two simple functions implemented in libquickjs
which could be mimicked by the fuzzer.
The removal of runtime and context objects implicated further
simplifications, like the omission of their one-time creation.
Finally, writing the result of the regexp operations into a file
is also superfluous, since it's not used by anybody.

* Recreate and destroy JS runtime and context in fuzz_eval and fuzz_compile targets

Before this patch, the test executions were not independent,
since all the executed tests used the same JavaScript runtime and
context, causing irreproducible failure reports.

* Enable bignumber support in eval and compile targets

Big numbers are used by the input corpus, but the targets were not
able to interpret them since they were not compiled into them.
This change improved the inital coverage of the fuzz_eval target with
21% and the coverage of the fuzz_compile target with 25% when using
the official corpus.

* Ensure std and os modules are available in the fuzz_eval and fuzz_compile targets
* Add fuzzer dictionary with builtin and variable names. Furthermore, added a JS script that collects all the builtin
names from the executing engine. 
* Move common fuzzer code into one place
* Enable to define the LIB_FUZZING_ENGINE variable to ease the oss-fuzz integration
* Add README to fuzzers
2024-05-08 18:19:48 +02:00