Merge pull request #17337 from manunio/initial-fuzzing-support

fuzz: initial integration

package.json

@@ -8,6 +8,7 @@
     "@fluent/bundle": "^0.18.0",
     "@fluent/dom": "^0.9.0",
     "@javascript-obfuscator/escodegen": "2.3.0",
+    "@jazzer.js/core": "^2.1.0",
     "acorn": "^8.11.2",
     "autoprefixer": "^10.4.16",
     "babel-loader": "^9.1.3",

test/fuzz/.eslintrc

@@ -0,0 +1,9 @@
+{
+  "extends": [
+    "../.eslintrc"
+  ],
+
+  "rules": {
+    "import/no-unresolved": ["error", { "ignore": [".*/build/image_decoders/.*"] }],
+  },
+}

test/fuzz/README.md

@@ -0,0 +1,42 @@
+# Fuzz Testing
+
+Fuzz testing is:
+
+> An automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a program.
+
+We use coverage guided fuzz testing to automatically discover bugs in PDF.js.
+
+This `fuzz/` directory contains the configuration and the fuzz tests for PDF.js.
+To generate and run fuzz tests, we use the [Jazzer.js](https://github.com/CodeIntelligenceTesting/jazzer.js/) library.
+
+## Running a fuzzer
+
+This directory contains fuzzers like for example `jpeg_image.fuzz`. You can run it with:
+
+Generate image decoders:
+```sh
+$ gulp image_decoders
+```
+
+Run fuzz target:
+```sh
+$ npx jazzer fuzz/jpeg_image.fuzz --sync
+```
+
+You should see output that looks something like this:
+
+```
+#2      INITED exec/s: 0 rss: 128Mb
+#65536  pulse  corp: 1/1b lim: 652 exec/s: 32768 rss: 140Mb
+#131072 pulse  corp: 1/1b lim: 1300 exec/s: 32768 rss: 140Mb
+#262144 pulse  corp: 1/1b lim: 2611 exec/s: 32768 rss: 140Mb
+#524288 pulse  corp: 1/1b lim: 4096 exec/s: 30840 rss: 140Mb
+#1048576        pulse  corp: 1/1b lim: 4096 exec/s: 29959 rss: 140Mb
+#2097152        pulse  corp: 1/1b lim: 4096 exec/s: 29537 rss: 140Mb
+```
+
+It will continue to generate random inputs forever, until it finds a
+bug or is terminated. The testcases for bugs it finds can be seen in
+the form of `crash-*` or `timeout-*` at the place from where command is run.
+You can rerun the fuzzer on a single input by passing it on the
+command line `npx jazzer fuzz/jpeg_image.fuzz /path/to/testcase`.

test/fuzz/jbig2_image.fuzz.js

@@ -0,0 +1,22 @@
+import { Jbig2Image } from "../../build/image_decoders/pdf.image_decoders.mjs";
+
+const ignored = ["Cannot read properties", "JBIG2 error"];
+
+function ignoredError(error) {
+  return ignored.some(message => error.message.includes(message));
+}
+
+/**
+ * @param {Buffer} data
+ */
+function fuzz(data) {
+  try {
+    new Jbig2Image().parse(new Uint8Array(data));
+  } catch (error) {
+    if (error.message && !ignoredError(error)) {
+      throw error;
+    }
+  }
+}
+
+export { fuzz };

test/fuzz/jpeg_image.fuzz.js

@@ -0,0 +1,22 @@
+import { JpegImage } from "../../build/image_decoders/pdf.image_decoders.mjs";
+
+const ignored = ["Cannot read properties", "JPEG error"];
+
+function ignoredError(error) {
+  return ignored.some(message => error.message.includes(message));
+}
+
+/**
+ * @param {Buffer} data
+ */
+function fuzz(data) {
+  try {
+    new JpegImage().parse(new Uint8Array(data));
+  } catch (error) {
+    if (error.message && !ignoredError(error)) {
+      throw error;
+    }
+  }
+}
+
+export { fuzz };

test/fuzz/jpx_image.fuzz.js

@@ -0,0 +1,22 @@
+import { JpxImage } from "../../build/image_decoders/pdf.image_decoders.mjs";
+
+const ignored = ["Cannot read properties", "JPX error"];
+
+function ignoredError(error) {
+  return ignored.some(message => error.message.includes(message));
+}
+
+/**
+ * @param {Buffer} data
+ */
+function fuzz(data) {
+  try {
+    new JpxImage().parse(new Uint8Array(data));
+  } catch (error) {
+    if (error.message && !ignoredError(error)) {
+      throw error;
+    }
+  }
+}
+
+export { fuzz };