Skip to content
Please note that GitHub no longer supports Internet Explorer.

We recommend upgrading to the latest Microsoft Edge, Google Chrome, or Firefox.

Learn more
libFuzzer-based JavaScript fuzzing using Bellard's QuickJS.
C JavaScript Other
Branch: master
Clone or download
Cannot retrieve the latest commit at this time.
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
quickjs
LICENSE
Makefile
README.md
harness.cpp
js.cpp
js.h
to_bytecode.cpp

README.md

libfuzzer-js

libFuzzer-based JavaScript fuzzing using Bellard's QuickJS.

Building

You need a recent version of libFuzzer for optimal coverage capturing.

Run this from any path:

svn co https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer Fuzzer
cd Fuzzer
./build.sh
export LIBFUZZER_A_PATH=$(realpath libFuzzer.a)

In this project's root directory, type:

make

Writing fuzzers

Input is supplied through the FuzzerInput variable, which is a Uint8Array.

API

An API suited for embedding in a larger application (e.g. a differential fuzzer) is defined in JS.cpp/h.

Running

./jsfuzzer --js=<javascript file>

Module support

There is currently no support for modules. To use multiple JavaScript files, concatenate all the files you need for now.

E.g.:

cat foo.js bar.js >file.js
./jsfuzzer --js=file.js

Notes

This is a work in progress. Capabilities and internal structure may change without prior notice.

You can’t perform that action at this time.