Skip to content
Please note that GitHub no longer supports Internet Explorer.

We recommend upgrading to the latest Microsoft Edge, Google Chrome, or Firefox.

Learn more
libFuzzer-based JavaScript fuzzing using Bellard's QuickJS.
C JavaScript Other
Branch: master
Clone or download
Latest commit 24c813b Dec 21, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
quickjs JS class: Capture script output Dec 18, 2019
LICENSE LICENSE Dec 20, 2019
Makefile Rename fuzzer binary to jsfuzzer Dec 18, 2019
README.md Write README.md Dec 18, 2019
harness.cpp
js.cpp Remove debug printf Dec 18, 2019
js.h JS class: Support string input Dec 18, 2019
to_bytecode.cpp Add fuzzer source files Dec 17, 2019

README.md

libfuzzer-js

libFuzzer-based JavaScript fuzzing using Bellard's QuickJS.

Building

You need a recent version of libFuzzer for optimal coverage capturing.

Run this from any path:

svn co https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer Fuzzer
cd Fuzzer
./build.sh
export LIBFUZZER_A_PATH=$(realpath libFuzzer.a)

In this project's root directory, type:

make

Writing fuzzers

Input is supplied through the FuzzerInput variable, which is a Uint8Array.

API

An API suited for embedding in a larger application (e.g. a differential fuzzer) is defined in JS.cpp/h.

Running

./jsfuzzer --js=<javascript file>

Module support

There is currently no support for modules. To use multiple JavaScript files, concatenate all the files you need for now.

E.g.:

cat foo.js bar.js >file.js
./jsfuzzer --js=file.js

Notes

This is a work in progress. Capabilities and internal structure may change without prior notice.

You can’t perform that action at this time.