542819 - Fuzz NPAPI

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Plug-ins, enhancement)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I'd like to randomly trigger

 (1) Crashes
 (2) Bad parameters (e.g. malformed UTF8 strings or HTTP requests to invalid 
URIs)
 (3) NPAPI calls designed to race with parent-side calls (e.g. making frequent NPAPI calls off plugin-side events)
 (3) Error returns
 (4) Deletion of NP* objects

in that order of importance.  (Anything else?)

It might be somewhat hard to write by hand an "nptestfuzz.so"-type plugin to randomly generate sequences of NPAPI calls, and IPDL might be better suited to generating this kind of tester.  So I think an easier first approximation is to annotate "interesting" sites in the test plugin with RANDOMLY_CRASH(), RANDOMLY_RETURN_ERROR(), RANDOMLY_MAKE_BAD_REQUEST(), etc.  Those random events should be triggered off a PRNG that reports its seed, so that they're (more) reproducible.

For v0 of such a tool, random crashes would satisfy me.

Thoughts?

Comment 1

[Benjamin Smedberg]

"Deletion of NP* objects" means what?

This sounds like a really hard task to do fully, given that the NPAPI doesn't really specify what values are legal and illegal and how they relate together... you'd almost have to build a modelling language for it... hence IPDL! Although if you limited the domain somewhat I bet you could trigger certain well known *sequences* of events (stream loading, scriptable-object handling, plus crashes) pretty easily.

Comment 2

[Benjamin Smedberg]

Resolving old bugs which are likely not relevant any more, since NPAPI plugins are deprecated.