quickjs/fuzz/fuzz_module_export.c at bytecode-opcode-bounds · uwezkhan/quickjs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
// Copyright 2025 Google LLC
// Fuzz target for QuickJS ES6 module parsing

#include "quickjs.h"
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    if (size < 1) return 0;

    JSRuntime* rt = JS_NewRuntime();
    if (!rt) return 0;

    JSContext* ctx = JS_NewContext(rt);
    if (!ctx) {
        JS_FreeRuntime(rt);
        return 0;
    }

    char* input = malloc(size + 1);
    if (!input) {
        JS_FreeContext(ctx);
        JS_FreeRuntime(rt);
        return 0;
    }
    memcpy(input, data, size);
    input[size] = '\0';

    const char* export_patterns[] = {
        "export default %s;",
        "export const x = %s;",
        "export let x = %s;",
        "export var x = %s;",
        "export function f() { %s }",
        "export class C { %s }",
        "export { %s };",
        "export * from '%s';",
        "export { %s } from 'module';",
        "export { default as x } from '%s';",
    };

    int pattern_idx = data[0] % (sizeof(export_patterns) / sizeof(export_patterns[0]));

    char script[8192];
    snprintf(script, sizeof(script), export_patterns[pattern_idx], input);

    JSValue result = JS_Eval(ctx, script, strlen(script), "<input>",
                               JS_EVAL_TYPE_MODULE | JS_EVAL_FLAG_COMPILE_ONLY);

    if (!JS_IsException(result)) {
        JS_FreeValue(ctx, result);
    } else {
        JS_GetException(ctx);
    }

    JSValue result2 = JS_Eval(ctx, input, size, "<input>", JS_EVAL_FLAG_COMPILE_ONLY);
    if (!JS_IsException(result2)) {
        JS_FreeValue(ctx, result2);
    } else {
        JS_GetException(ctx);
    }

    const char* import_patterns[] = {
        "import '%s';",
        "import x from '%s';",
        "import * as x from '%s';",
        "import { x } from '%s';",
        "import { x as y } from '%s';",
        "import x, { y } from '%s';",
        "import x, * as y from '%s';",
    };

    int import_idx = (data[0] >> 4) % (sizeof(import_patterns) / sizeof(import_patterns[0]));
    char import_script[8192];
    char* sanitized = malloc(size + 1);
    if (sanitized) {
        size_t j = 0;
        for (size_t i = 0; i < size && j < size; i++) {
            if (data[i] != '\'' && data[i] != '"' && data[i] != '\n' && data[i] != '\r') {
                sanitized[j++] = data[i];
            }
        }
        sanitized[j] = '\0';

        snprintf(import_script, sizeof(import_script), import_patterns[import_idx], sanitized);

        JSValue import_result = JS_Eval(ctx, import_script, strlen(import_script), "<input>",
                                         JS_EVAL_TYPE_MODULE | JS_EVAL_FLAG_COMPILE_ONLY);
        if (!JS_IsException(import_result)) {
            JS_FreeValue(ctx, import_result);
        } else {
            JS_GetException(ctx);
        }

        free(sanitized);
    }

    free(input);
    JS_FreeContext(ctx);
    JS_FreeRuntime(rt);

    return 0;
}