Bugs found by jsfunfuzz

https://bugzilla.mozilla.org/show_bug.cgi?id=jsfunfuzz

by luu • 11 years ago

35 9 11 years ago

bugzilla.mozilla.org

This is really interesting, and a great approach to testing. I wonder if other JS engines like V8 are using this or something similar?

spork1• 11 years ago

Yes, they are running various internal testing suites in google, check here for example: https://code.google.com/p/chromium/issues/detail?id=360298

amelius• 11 years ago

Indeed interesting. I wonder if there is a tool for generating input in a way that guarantees that all locations in the program are actually covered (in other words, that all reachable code has been reached).

Of course, this is no guarantee that the program actually works, but it would make me sleep better :)

bhouston• 11 years ago

There is a tool like that for compiled binaries. Details on its usage here:

http://lcamtuf.coredump.cx/afl/

http://lcamtuf.blogspot.ca/2014/11/pulling-jpegs-out-of-thin...

SloopJon• 11 years ago

An instrumented fuzzer like AFL purports to do this:

http://lcamtuf.coredump.cx/afl/

This blog post is a fascinating description of its potential:

http://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thi...

I haven't had as much success with it, but it's so interesting that I'll keep trying. I'm also interested in KLEE, which I found in a similar HN story, but it has very specific build requirements:

https://klee.github.io

[Edit: bhouston posted the exact same links minutes before I did. Anyway, cool stuff.]

falcolas• 11 years ago

One type of testing (sorry, not a tool yet) which can help with this is combinatorial testing. Basically, when testing against a set of multiple inputs, create a test which will test every possible combination of input for a pair of inputs.

i.e. for inputs A, B, C, try every combination of A-B, A-C, and B-C

It sounds like a lot, but its not too onerous with the speed of computers we have today. This type of testing will flush out most bugs which will result from a particular combination of inputs, and is deterministic, when compared to fuzz testing.

This is not to detract from fuzz testing, just a note that it is effectively designed to be non-deterministic, which can result in a delay in bug detection.

castell• 11 years ago

For anyone interested it's called fuzz testing: http://en.wikipedia.org/wiki/Fuzz_testing

Bugs found by jsfunfuzz

Related Stories