boa
boa copied to clipboard
boa-dev
Catching lexer/parser bugs with fuzzed input
The fuzzer would generate tests with fuzzed input and we would check what is the expected behaviour
I uploaded the fuzzer I used here: https://github.com/alexanderkjall/boa-hongg feel free to use it however you want.
I used honggfuzz, as it's a bit better than cargo-fuzz, and have run it overnight so far.
I In addition to the bugs I have reported with it, there is also a SIGSEGV due to running out of stackspace when parsing a very nested expression, but I felt that might be out of scope?
It would be nice to have some automation of fuzzing going on, however, as fuzzers last indefinitely, unsure of whether using CI is applicable... I also found AFL which seems simple enough to use and can use an input to converge on bugs quicker, I’m unsure of whether honggfuzz has the same capabilities, but it might be useful to use AFL if not!
Also, as for automation, Google has OSS-Fuzz which allows for automated fuzzing and has a GH integration, might be worth looking into!
