# Fuzzing JavaScript Engines with Fuzzilli

Fuzzing JerryScript with Fuzzilli found a type confusion: reassigning a typed array's buffer.constructor to Uint8Array makes the engine cast a typed array to ArrayBuffer, corrupting memory.

- Payout: Research
- Severity: high
- Program: JerryScript
- Write-up by: Doyensec
- Disclosed: 2020-09-08
- Write-up quality: 7/10
- Original: https://blog.doyensec.com/2020/09/09/fuzzilli-jerryscript.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-09-09-fuzzilli-jerryscript-html
- Tags: area:oss domain:oss impact:dos kind:research platform:research sev:high technique:fuzzing technique:source-review vuln:memory-corruption

**Target:** JerryScript JavaScript engine typed array creation (ecma_typedarray_create_object_with_typedarray)
**Root cause:** When constructing a typed array from another typed array, the engine reads the source's buffer and casts it to ArrayBuffer without verifying the actual object type; production builds drop the assert that would catch the mismatch, so a typed array pointer is treated as an ArrayBuffer.
**Steps:**
1. Create a typed array: `var v1 = new Float64Array(6);`
2. Overwrite the buffer's constructor: `v1.buffer.constructor = Uint8Array;`
3. Construct a new typed array from it: `new Float64Array(v1);`
4. Engine calls ecma_arraybuffer_get_buffer on the typed array, casting it to ArrayBuffer, producing a bogus dst_buf_p
5. memcpy in ecma_typedarray_create_object_with_typedarray writes through the corrupted pointer, causing SIGSEGV / memory corruption
**How found:** Integrated Fuzzilli (REPRL + coverage-guided IR mutation) with JerryScript, a target previously fuzzed by Fuzzinator, which uses Grammarinator. Fuzzilli's mutators generate nested callbacks, Prototypes and Proxy objects that mutate object state non-linearly, which surfaced the type confusion; the generated PoC was then manually minimized.
**Exploitation:** Not weaponized; the crash was triaged in gdb showing a corrupted destination pointer in memcpy. Authors note it could likely be escalated from DoS to code execution but did not build an exploit.
**Insight:** Fuzzilli-style IR mutation excels at mutating object state mid-execution (e.g. reassigning `.constructor` on a buffer) so a later engine path sees an unexpected type; when auditing JSE code, look for casts that rely on asserts stripped in release builds.

## Proof of concept (copied exactly from the original report)

**Fuzzilli PoC for JerryScript type confusion**

```
function main() {
var v3 = new Float64Array(6);
var v4 = v3.buffer;
v4.constructor = Uint8Array;
var v5 = new Float64Array(v3);
}
main();
```

**Simplified type confusion PoC**

```
var v1 = new Float64Array(6);
v1.buffer.constructor = Uint8Array;
new Float64Array(v1);
```