googleprojectzero / domato

DOM fuzzer
https://googleprojectzero.blogspot.ch/2017/09/the-great-dom-fuzz-off-of-2017.html
Apache License 2.0
1.69k stars 278 forks source link

I think there may be something wrong .. #19

Closed mutepigz closed 5 years ago

mutepigz commented 5 years ago

In grammar.py, line 524:

        for v in new_vars:
            if v['type'] not in _NONINTERESTING_TYPES:
                self._add_variable(v['name'], v['type'], context)
                additional_lines.append("if (!" + v['name'] + ") { " + v['name'] + " = GetVariable(fuzzervars, '" + v['type'] + "'); } else { " + self._get_variable_setters(v['name'], v['type']) + " }")

after run generate.py,these code will generate something like:

try { if (!fuzzvar00001) { fuzzvar00001 = GetVariable(fuzzervars, 'element'); } else { SetVariable(fuzzvar00001, 'element');  } } catch(e) {}

=>

fuzzervars = {}
function GetVariable(fuzzervars, var_type) { if(fuzzervars[var_type]) { return fuzzervars[var_type]; } else { return null; }}
function SetVariable(fuzzervars, var_name, var_type) { fuzzervars[var_type] = var_name; }

I guess something wrong in SetVariable, and it should be :

SetVariable(fuzzervars, fuzzvar00001, 'element')

please check it, thanx

ifratric commented 5 years ago

Argh, I think you are right. Thanks for reporting! This probably happened when I switch from global fuzzervars object to per-function.

I just pushed a fix.

mutepigz commented 5 years ago

thanx :)