| 613 | #endif |
| 614 | |
| 615 | int fuzz_oss(const uint8_t *Data, size_t script_size) |
| 616 | { |
| 617 | xsCreation _creation = { |
| 618 | 1 * 1024 * 1024, /* initialChunkSize */ |
| 619 | 1 * 1024 * 1024, /* incrementalChunkSize */ |
| 620 | 32768, /* initialHeapCount */ |
| 621 | 32768, /* incrementalHeapCount */ |
| 622 | 64 * 1024, /* stackCount */ |
| 623 | 1024, /* initialKeyCount */ |
| 624 | 1024, /* incrementalKeyCount */ |
| 625 | 1993, /* nameModulo */ |
| 626 | 127, /* symbolModulo */ |
| 627 | 64 * 1024, /* parserBufferSize */ |
| 628 | 1993, /* parserTableModulo */ |
| 629 | }; |
| 630 | size_t buffer_size = script_size + script_size + script_size + 1; // (massively) over-allocate to have space if UTF-8 encoding expands (1 byte invalid byte becomes a 3-byte UTF-8 sequence) |
| 631 | char* buffer = (char *)malloc(buffer_size); |
| 632 | memcpy(buffer, Data, script_size); |
| 633 | |
| 634 | buffer[script_size] = 0; // required when debugger active |
| 635 | |
| 636 | xsCreation* creation = &_creation; |
| 637 | xsMachine* machine; |
| 638 | machine = xsCreateMachine(creation, "xst_fuzz_oss", NULL); |
| 639 | |
| 640 | xsBeginMetering(machine, xsWithinComputeLimit, 65536); |
| 641 | { |
| 642 | xsBeginHost(machine); |
| 643 | { |
| 644 | xsTry { |
| 645 | xsVars(2); |
| 646 | modInstallTextDecoder(the); |
| 647 | xsResult = xsArrayBuffer(buffer, script_size); |
| 648 | xsVar(0) = xsNew0(xsGlobal, xsID("TextDecoder")); |
| 649 | xsResult = xsCall1(xsVar(0), xsID("decode"), xsResult); |
| 650 | #ifdef OSSFUZZ_JSONPARSE |
| 651 | xsVar(0) = xsGet(xsGlobal, xsID("JSON")); |
| 652 | xsResult = xsCall1(xsVar(0), xsID("parse"), xsResult); |
| 653 | #else |
| 654 | xsToStringBuffer(xsResult, buffer, buffer_size); |
| 655 | |
| 656 | // hardened javascript |
| 657 | xsResult = xsNewHostFunction(fx_harden, 1); |
| 658 | xsDefine(xsGlobal, xsID("harden"), xsResult, xsDontEnum); |
| 659 | xsResult = xsNewHostFunction(fx_lockdown, 0); |
| 660 | xsDefine(xsGlobal, xsID("lockdown"), xsResult, xsDontEnum); |
| 661 | xsResult = xsNewHostFunction(fx_petrify, 1); |
| 662 | xsDefine(xsGlobal, xsID("petrify"), xsResult, xsDontEnum); |
| 663 | xsResult = xsNewHostFunction(fx_mutabilities, 1); |
| 664 | xsDefine(xsGlobal, xsID("mutabilities"), xsResult, xsDontEnum); |
| 665 | |
| 666 | xsResult = xsNewHostFunction(fx_fuzz_gc, 0); |
| 667 | xsSet(xsGlobal, xsID("gc"), xsResult); |
| 668 | xsResult = xsNewHostFunction(fx_print, 1); |
| 669 | xsSet(xsGlobal, xsID("print"), xsResult); |
| 670 | |
| 671 | // test262 stubs |
| 672 | xsVar(0) = xsNewHostFunction(fx_nop, 1); |
no test coverage detected