diff --git a/test/fuzzer/wasm-fuzzer-common.cc b/test/fuzzer/wasm-fuzzer-common.cc index c2b8420e85..3aab4e0c1d 100644 --- a/test/fuzzer/wasm-fuzzer-common.cc +++ b/test/fuzzer/wasm-fuzzer-common.cc @@ -251,6 +251,11 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes, int WasmExecutionFuzzer::FuzzWasmModule(Vector data, bool require_valid) { + // Strictly enforce the input size limit. Note that setting "max_len" on the + // fuzzer target is not enough, since different fuzzers are used and not all + // respect that limit. + if (data.size() > max_input_size()) return 0; + v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get(); v8::Isolate* isolate = support->GetIsolate(); i::Isolate* i_isolate = reinterpret_cast(isolate); diff --git a/test/fuzzer/wasm-fuzzer-common.h b/test/fuzzer/wasm-fuzzer-common.h index 17bc70e91c..c1384fd1d2 100644 --- a/test/fuzzer/wasm-fuzzer-common.h +++ b/test/fuzzer/wasm-fuzzer-common.h @@ -34,6 +34,8 @@ class WasmExecutionFuzzer { virtual ~WasmExecutionFuzzer() = default; int FuzzWasmModule(Vector data, bool require_valid = false); + virtual size_t max_input_size() const { return 512; } + protected: virtual bool GenerateModule( Isolate* isolate, Zone* zone, Vector data,