Patch fuzzing is a technique aimed at identifying vulnerabilities that arise from newly patched code. While researchers have made efforts to apply patch fuzzing to testing JavaScript (JS) engines with considerable success, these efforts have been limited to using ordinary test cases or publicly available vulnerability PoCs (Proof of Concepts) as seeds, and the sustainability of these approaches is hindered by the challenges associated with automating the PoC collection. To address these limitations, we propose an end-to-end sustainable approach for JS engine patch fuzzing, named PatchFuzz. It automates the collection of PoCs of a broader range of historical vulnerabilities and leverages both the PoCs and their corresponding patches to uncover new vulnerabilities more effectively. PatchFuzz starts by recognizing git commits which intend to fix security bugs. Subsequently, it extracts and processes PoCs from these commits to form the seeds for fuzzing, while utilizing code revisions to focus limited fuzzing resources on the more vulnerable code areas through selective instrumentation. The mutation strategy of PatchFuzz is also optimized to maximize the potential of the PoCs. Experimental results demonstrate the effectiveness of PatchFuzz. Notably, 54 bugs across six popular JS engines have been exposed and a total of $62,500 bounties has been received. PatchFuzz effectively enables sustainable and automated patch fuzzing for JavaScript engines by leveraging historical PoCs and selective instrumentation to focus on vulnerable code regions.

This paper proposes an AC-coupled two-step incremental ∆Σ analog-to-digital converter (ADC) neural recording analog front end (AFE). Compared to other neural recording AFEs, it achieves rail-to-rail electrode DC offset (EDO) rejection, low noise, small area, and ultra-low power consumption. Considering the weak amplitude of neural signals, a transconductance-capacitance (Gm-C) integrator combined with current reuse is employed. In addition, the two-step quantization design of the AFE also offers the benefits of low power consumption and compact size. Fabricated in a 180-nm CMOS process, the AFE consumes 6 µW, with an area of 0.02 mm2. Within a bandwidth of 1-10 kHz, the input reference noise is 6.02 µVrms, where the local field potentials (LFP, 1 Hz-1 kHz) noise is 5 µVrms and the action potential (AP, 300 Hz-10 kHz) noise is 3.86 µVrms. The maximum input range of AFE is approximately 21mVpp, and it can achieve a maximum effective number of bits (ENOB) of about 9.5 bits.

With the widespread adoption of the JavaScript language, JavaScript engines have become a primary target for attackers, leading to numerous security threats. To expose potential security vulnerabilities and bugs in JavaScript engines, various fuzzing approaches have been proposed, among which mutation based on Abstract Syntax Tree (i.e., subtree crossover) have emerged as one of the most popular approaches due to the strong bug-detection capability. Various heuristics are introduced to enhance the bug-detection capability of the existing approaches. However, there is no empirical evidence on how each heuristic contributes to the bug detection capability of the fuzzer. In this work, we present the first empirical study on heuristics employed by mutation-based JavaScript engines fuzzing techniques. Specifically, we first review and classify the heuristics adopted in existing approaches. Then, we design a comprehensive empirical study to investigate how individual heuristics and their combinations contribute to the fuzzing process (in terms of quantity of unique crashes, coverage improvement, and test case error rate in fuzzing). Finally, based on our experimental results, we propose a novel fuzzer, named EASTer, which employs an optimal combination of heuristics. Evaluation results show that, on all major JavaScript engine benchmarks, EASTer detects an average of 1.51 × more unique crashes and achieves an average branch coverage of 1.02 ×, 18.2% lower test case error rate compared to the baseline method.