add test script: test:fuzz

Author: gfx

.gitignore

@@ -11,3 +11,6 @@ isolate-*.log
 
 # flamebearer
 flamegraph.html
+
+# jsfuzz
+corpus/

package.json

@@ -20,9 +20,10 @@
     "test:te": "TEXT_ENCODING=force mocha 'test/**/*.test.ts'",
     "test:dist:purejs": "TS_NODE_PROJECT=tsconfig.test-dist-es5-purejs.json npm run test:purejs -- --reporter=dot",
     "test:cover": "npm run cover:clean && npm-run-all 'test:cover:*' && npm run cover:report",
-    "test:cover:purejs": "npx nyc --no-clean npm run test:purejs",
-    "test:cover:te": "npx nyc --no-clean npm run test:te",
+    "test:cover:purejs": "npm exec nyc --no-clean npm run test:purejs",
+    "test:cover:te": "npm exec nyc --no-clean npm run test:te",
     "test:deno": "deno test test/deno_test.ts",
+    "test:fuzz": "npm exec -- jsfuzz@git+https://gitlab.com/gitlab-org/security-products/analyzers/fuzzers/jsfuzz.git --fuzzTime 5 --rss-limit-mb 256 --no-versifier test/decode.jsfuzz.js corpus",
     "cover:clean": "rimraf .nyc_output coverage/",
     "cover:report": "npx nyc report --reporter=text-summary --reporter=html --reporter=json",
     "test:browser": "karma start --single-run",

test/decode.jsfuzz.js

@@ -0,0 +1,30 @@
+/* eslint-disable */
+const assert = require("assert");
+const { Decoder, encode, DecodeError, DataViewIndexOutOfBoundsError } = require("../dist/index.js");
+
+/**
+ * @param {Buffer} bytes
+ * @returns {void}
+ */
+module.exports.fuzz = function fuzz(bytes) {
+  const decoder = new Decoder();
+  try {
+    decoder.decode(bytes);
+  } catch (e) {
+    if (e instanceof DecodeError) {
+      // ok
+    } else if (e instanceof DataViewIndexOutOfBoundsError) {
+      // ok
+    } else {
+      throw e;
+    }
+  }
+
+  // make sure the decoder instance is not broken
+  const object = {
+    foo: 1,
+    bar: 2,
+    baz: ["one", "two", "three"],
+  };
+  assert.deepStrictEqual(decoder.decode(encode(object)), object);
+}