MozillaSecurity / dharma

Generation-based, context-free grammar fuzzer. Refer to https://github.com/posidron/dharma for a maintained version.
Mozilla Public License 2.0
482 stars 90 forks source link

using variable before declaring it #7

Closed djn3m0 closed 6 years ago

djn3m0 commented 7 years ago

In the following code as you can see the variable typedArray1 is used before being declared. This is not the only time this is happening.

try { var getRandomInt1= 213; } catch (e) { } try { var blob1 = new Blob([typedArray1], {type: "application/json"}); } catch (e) { } try { var fileParts1 = ['AAAAA%d"UdUzgNbbgwsJqtHhxJoENRVfstctp"'] } catch (e) { } try { var typedArray1 = GetTheTypedArraySomehow(); } catch (e) { } try { var slice1 = blob1.slice(getRandomInt1, 1! "application/xhtml+xml"); } catch (e) { } try { for(var i=0; i < getRandomInt1; i++) { slice1.append(fileParts1[-57938]); } } catch (e) { }

and this is how part of my grammar looks like: %%% ########################################################################### %section% := variable blob := var @blob@ = new Blob([!typedArray!], {type: +common:app_mime_type+}); typedArray := var @typedArray@ = GetTheTypedArraySomehow(); Thanks

posidron commented 6 years ago

You can not use "!typedArray!" like that inside Blob(). Create a new section which makes use of a typedArray and then reference it in Blob.