googleprojectzero / googleprojectzero/Jackalope

Question on Grammar-based mutation

Open
#34 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.4k
Forks
157
PR merge metrics
No merged PRs in 30d

Description

  1. If there are seeds in input folder in the beginning, it failed to run with this message:
    FATAL("Incorrectly encoded grammar sample");
    I found it is generated becase of if sentence as below:
    bool GrammarFuzzer::OutputFilter(Sample* original_sample, Sample* output_sample, ThreadContext* tc) {
    uint64_t string_size = ((uint64_t)original_sample->bytes);
    if (original_sample->size < (string_size + sizeof(string_size))) {
    FATAL("Incorrectly encoded grammar sample");
    }
    I dont understant exact meaning of "if (original_sample->size < (string_size + sizeof(string_size)))": why do you put this comparison here?

  2. I began to run javascript fuzzer with empty files in input folder. it continues to generate samples in sample folder, but most (almost everything) is grammar/syntantically incorrect. so it could not pass the parsing process at all. Do you have any idea to solve this problem? In the Domato fuzzer, you put trycatch phrases for every sentence. Is any easy way to put trycatch phrases for sentence? or do you have other options to solve it?

Thank you for reading my issue.
Best.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with GrammarFuzzer::OutputFilter and reproduce both cases described: initial seeds in the input folder and an empty input folder for the JavaScript fuzzer. Read the surrounding sample encoding and parsing flow, then verify that startup handles existing seeds and generated samples are accepted or that their failure is clearly reported.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, javascript
Domain
testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.