2 years ago
2 years ago


(Reporter: hchang, Unassigned)


(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)


(Whiteboard: sb+)



2 years ago
Unlike what we already for low level IPC fuzzing, we would like to do fuzzing more IPDL-aware. In other words, we'd like to find vulnerable in the "handler" layer. (The handler is typically like PFooProtocolChild::RecvBarMessage() for PFooProtocol.barMessage)


2 years ago
Whiteboard: sb+

Comment 1

2 years ago

I have been prototyping the ipdl fuzzer in the above branch since the end
of this March. This current baby fuzzer consists of 

1) A hook (window.alert) to trigger fuzzing (only for testing for sure lol)

2) 3 fuzzers (for PHttpChannel/PCameras/PBrowser) are in place. 
   Most of their to-parent messages are covered.

3) Tons of FuzzTraits for those types which are required for those 3 fuzzers.
   Note that those FuzzTraits are only capable of generating random data.
   They are supposed to be able to mutate the given objects.

I don't know the how far this project could go but I would expect at least

1) A client (in whatever form) to trigger/manipulate the fuzzing.
2) More fuzzers (either by hand-wring or codegen)
3) More FuzzTraits
4) Record the fuzzing trace for replay/reproduce purpose.


2 years ago
Assignee: nobody → hchang
See Also: → bug 516716
Blocks: 1320851
Summary: IPDL fuzzing → IPDL protocol fuzzing


2 years ago
Assignee: hchang → nobody
You need to log in before you can comment on or make changes to this bug.