Simple fuzzing

[c0ntradicti0n]

Hello there,

I tried out a bunch of things and I have a question about the instrumentation.

taking this as a target:

module.exports.f = (s) => {
    if (s.indexOf( "a very long string") === 0 )  // VERSION A
    //if (s === "a very long string")             // VERSION B
        throw new Error("FOUND: " + s);
}

using this command:

npx \
    jazzer \
        jazzer-next.js \
        corpus_next \
        -i simple \
        --disable_bug_detectors prototype-pollution \
    -- \
        -create_missing_dirs=1 \
        -print_pcs=1  \
        -only_ascii=1 \
        -reload=1 \
        -jobs=10 \
        -fork=1 \
        -reduce_inputs=0 \
        -shrink=0 \
        -use_value_profile=1 \
        -prefer_small=0 \
        -max_len=5000 \
        -len_control=0 \
        -runs=-1 \
        -print_coverage=1 \
        -rss_limit_mb=20000 \
        -cross_over=0 \
        -data_flow_trace=1 \
        -collect_data_flow=1

and this harness:

const {f} = require("./simple")

module.exports.fuzz = async function (data) {
        f(data.toString())
};

the corpus contains one sample: "a string".

The wanted string or expected exception is in version B found very fast, that is nice, but with version A by using "indexOf" it runs forever and there no "interesting" samples are put in the corpus dir.

What is the difference or can I add other instrumentation to make it inspecting this too?

[oetr]

indexOf, among with a few other functions of the String class (e.g. startsWith, endsWith, includes) have to be instrumented in a way that the fuzzer can get register the string comparisons happening under the hood. To accomplish this, the Jazzer.js' instrumentor has to be extended.