newFactories() {
26 | return Stream.of(
27 | new LocalDateMutatorFactory(),
28 | new LocalDateTimeMutatorFactory(),
29 | new LocalTimeMutatorFactory(),
30 | new ZonedDateTimeMutatorFactory());
31 | }
32 | }
33 |
--------------------------------------------------------------------------------
/src/main/java/com/code_intelligence/jazzer/mutation/support/BUILD.bazel:
--------------------------------------------------------------------------------
1 | java_library(
2 | name = "support",
3 | srcs = glob(["*.java"]),
4 | visibility = [
5 | "//src/main/java/com/code_intelligence/jazzer/mutation:__subpackages__",
6 | "//src/test/java/com/code_intelligence/jazzer/mutation:__subpackages__",
7 | ],
8 | deps = [
9 | "//src/main/java/com/code_intelligence/jazzer/mutation/annotation",
10 | "//src/main/java/com/code_intelligence/jazzer/mutation/utils",
11 | "//src/main/java/com/code_intelligence/jazzer/utils:log",
12 | ],
13 | )
14 |
--------------------------------------------------------------------------------
/src/main/java/com/code_intelligence/jazzer/mutation/support/ExceptionSupport.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.mutation.support;
18 |
19 | public final class ExceptionSupport {
20 | /**
21 | * Allows throwing any {@link Throwable} unchanged as if it were an unchecked exception.
22 | *
23 | * Example: {@code throw asUnchecked(new IOException())}
24 | */
25 | @SuppressWarnings("unchecked")
26 | public static T asUnchecked(Throwable t) throws T {
27 | throw (T) t;
28 | }
29 |
30 | private ExceptionSupport() {}
31 | }
32 |
--------------------------------------------------------------------------------
/src/main/java/com/code_intelligence/jazzer/mutation/utils/BUILD.bazel:
--------------------------------------------------------------------------------
1 | java_library(
2 | name = "utils",
3 | srcs = glob(["*.java"]),
4 | visibility = [
5 | "//selffuzz/src/test/java/com/code_intelligence/selffuzz/mutation/mutator/lang:__pkg__",
6 | "//src/main/java/com/code_intelligence/jazzer/mutation:__pkg__",
7 | "//src/main/java/com/code_intelligence/jazzer/mutation:__subpackages__",
8 | "//src/test/java/com/code_intelligence/jazzer/mutation:__pkg__",
9 | "//src/test/java/com/code_intelligence/jazzer/mutation:__subpackages__",
10 | ],
11 | )
12 |
--------------------------------------------------------------------------------
/src/main/java/com/code_intelligence/jazzer/mutation/utils/ValidateContainerDimensions.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.mutation.utils;
18 |
19 | import static java.lang.annotation.ElementType.ANNOTATION_TYPE;
20 | import static java.lang.annotation.RetentionPolicy.RUNTIME;
21 |
22 | import java.lang.annotation.Retention;
23 | import java.lang.annotation.Target;
24 |
25 | /**
26 | * Meta-annotation intended to be used internally by Jazzer for container annotations with min and
27 | * max fields. Annotations annotated with @ValidateContainerDimensions will be validated to ensure
28 | * that min and max are both {@code >= 0}, and that {@code min <= max}.
29 | */
30 | @Target(ANNOTATION_TYPE)
31 | @Retention(RUNTIME)
32 | public @interface ValidateContainerDimensions {}
33 |
--------------------------------------------------------------------------------
/src/main/java/com/code_intelligence/jazzer/mutation/utils/ValidateMinMax.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.mutation.utils;
18 |
19 | import static java.lang.annotation.ElementType.ANNOTATION_TYPE;
20 | import static java.lang.annotation.RetentionPolicy.RUNTIME;
21 |
22 | import java.lang.annotation.Retention;
23 | import java.lang.annotation.Target;
24 |
25 | /**
26 | * Meta-annotation intended to be used internally by Jazzer for annotations that have min and max
27 | * fields. For all such annotations, Jazzer will assert that {@code min <= max}.
28 | */
29 | @Target(ANNOTATION_TYPE)
30 | @Retention(RUNTIME)
31 | public @interface ValidateMinMax {}
32 |
--------------------------------------------------------------------------------
/src/main/java/com/code_intelligence/jazzer/replay/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("@rules_jni//jni:defs.bzl", "java_jni_library")
2 |
3 | java_jni_library(
4 | name = "replay",
5 | srcs = ["Replayer.java"],
6 | deps = [
7 | "//src/main/java/com/code_intelligence/jazzer/api",
8 | "//src/main/java/com/code_intelligence/jazzer/driver:fuzzed_data_provider_impl",
9 | ],
10 | )
11 |
12 | java_binary(
13 | name = "Replayer",
14 | visibility = ["//visibility:public"],
15 | runtime_deps = [":replay"],
16 | )
17 |
--------------------------------------------------------------------------------
/src/main/java/com/code_intelligence/jazzer/runtime/Constants.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.runtime;
18 |
19 | public final class Constants {
20 | public static final boolean IS_ANDROID = System.getProperty("java.vm.vendor").contains("Android");
21 | }
22 |
--------------------------------------------------------------------------------
/src/main/java/com/code_intelligence/jazzer/runtime/bootstrap_shade_rules:
--------------------------------------------------------------------------------
1 | rule com.github.fmeum.rules_jni.** com.code_intelligence.jazzer.bootstrap.@0
2 | rule kotlin.** com.code_intelligence.jazzer.bootstrap.@0
3 | rule net.sf.jsqlparser.** com.code_intelligence.jazzer.bootstrap.@0
4 | rule org.objectweb.asm.** com.code_intelligence.jazzer.bootstrap.@0
5 |
--------------------------------------------------------------------------------
/src/main/java/com/code_intelligence/jazzer/runtime/verify_shading.sh:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env sh
2 | #
3 | # Copyright 2024 Code Intelligence GmbH
4 | #
5 | # Licensed under the Apache License, Version 2.0 (the "License");
6 | # you may not use this file except in compliance with the License.
7 | # You may obtain a copy of the License at
8 | #
9 | # http://www.apache.org/licenses/LICENSE-2.0
10 | #
11 | # Unless required by applicable law or agreed to in writing, software
12 | # distributed under the License is distributed on an "AS IS" BASIS,
13 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 | # See the License for the specific language governing permissions and
15 | # limitations under the License.
16 | #
17 |
18 | [ -f "$1" ] || exit 1
19 | JAR="$2/bin/jar"
20 | [ -e "$JAR" ] || exit 1
21 | # List all files in the jar and exclude an allowed list of files.
22 | # Since grep fails if there is no match, ! ... | grep ... fails if there is a
23 | # match.
24 | ! "$JAR" tf "$1" | \
25 | grep -v \
26 | -e '^com/$' \
27 | -e '^com/code_intelligence/$' \
28 | -e '^com/code_intelligence/jazzer/' \
29 | -e '^jaz/' \
30 | -e '^META-INF/$' \
31 | -e '^META-INF/MANIFEST.MF$'
32 |
--------------------------------------------------------------------------------
/src/main/java/jaz/BUILD.bazel:
--------------------------------------------------------------------------------
1 | filegroup(
2 | name = "jaz",
3 | srcs = [
4 | "Ter.java",
5 | "Zer.java",
6 | ],
7 | visibility = ["//src/main/java/com/code_intelligence/jazzer/api:__pkg__"],
8 | )
9 |
--------------------------------------------------------------------------------
/src/main/java/jaz/Ter.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package jaz;
18 |
19 | /**
20 | * A safe to use companion of {@link jaz.Zer} that is used to produce serializable instances of it
21 | * with only light patching.
22 | */
23 | @SuppressWarnings("unused")
24 | public class Ter implements java.io.Serializable {
25 | static final long serialVersionUID = 42L;
26 |
27 | public static final byte REFLECTIVE_CALL_SANITIZER_ID = 0;
28 | public static final byte DESERIALIZATION_SANITIZER_ID = 1;
29 | public static final byte EXPRESSION_LANGUAGE_SANITIZER_ID = 2;
30 |
31 | private byte sanitizer = REFLECTIVE_CALL_SANITIZER_ID;
32 |
33 | public Ter() {}
34 |
35 | public Ter(byte sanitizer) {
36 | this.sanitizer = sanitizer;
37 | }
38 | }
39 |
--------------------------------------------------------------------------------
/src/main/native/com/code_intelligence/jazzer/android/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("//bazel:compat.bzl", "ANDROID_ONLY")
2 | load("@rules_jni//jni:defs.bzl", "cc_jni_library")
3 | load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
4 |
5 | copy_file(
6 | name = "jvmti_h_encoded",
7 | src = "@android_jvmti//file",
8 | out = "jvmti.encoded",
9 | is_executable = False,
10 | tags = ["manual"],
11 | target_compatible_with = ANDROID_ONLY,
12 | )
13 |
14 | genrule(
15 | name = "jvmti_h",
16 | srcs = [
17 | "jvmti.encoded",
18 | ],
19 | outs = ["jvmti.h"],
20 | cmd = "cat $< | base64 --decode > $(OUTS)",
21 | tags = ["manual"],
22 | target_compatible_with = ANDROID_ONLY,
23 | )
24 |
25 | cc_jni_library(
26 | name = "android_native_agent",
27 | srcs = [
28 | "dex_file_manager.cpp",
29 | "dex_file_manager.h",
30 | "jazzer_jvmti_allocator.h",
31 | "native_agent.cpp",
32 | ":jvmti_h",
33 | ],
34 | includes = [
35 | ".",
36 | ],
37 | linkopts = [
38 | "-lz",
39 | ],
40 | tags = ["manual"],
41 | target_compatible_with = ANDROID_ONLY,
42 | visibility = ["//visibility:public"],
43 | deps = [
44 | "@abseil-cpp//absl/strings",
45 | "@jazzer_slicer",
46 | ],
47 | )
48 |
--------------------------------------------------------------------------------
/src/main/native/com/code_intelligence/jazzer/driver/fuzz_target_runner.h:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Code Intelligence GmbH
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #pragma once
16 |
17 | namespace jazzer {
18 | /*
19 | * Print the stack traces of all active JVM threads.
20 | *
21 | * This function can be called from any thread.
22 | */
23 | void DumpJvmStackTraces();
24 | } // namespace jazzer
25 |
--------------------------------------------------------------------------------
/src/main/native/com/code_intelligence/jazzer/driver/mutator.cpp:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Code Intelligence GmbH
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #include
16 | #include
17 |
18 | #include "com_code_intelligence_jazzer_runtime_Mutator.h"
19 |
20 | extern "C" size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize);
21 |
22 | [[maybe_unused]] jint
23 | Java_com_code_1intelligence_jazzer_runtime_Mutator_defaultMutateNative(
24 | JNIEnv *env, jclass, jbyteArray jni_data, jint size) {
25 | jint maxSize = env->GetArrayLength(jni_data);
26 | uint8_t *data =
27 | static_cast(env->GetPrimitiveArrayCritical(jni_data, nullptr));
28 | jint res = LLVMFuzzerMutate(data, size, maxSize);
29 | env->ReleasePrimitiveArrayCritical(jni_data, data, 0);
30 | return res;
31 | }
32 |
--------------------------------------------------------------------------------
/src/main/native/com/code_intelligence/jazzer/driver/sanitizer_symbols.cpp:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Code Intelligence GmbH
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | // Suppress libFuzzer warnings about missing sanitizer methods in non-sanitizer
16 | // builds.
17 | extern "C" [[maybe_unused]] int __sanitizer_acquire_crash_state() { return 1; }
18 |
19 | namespace jazzer {
20 | void DumpJvmStackTraces();
21 | }
22 |
23 | // Dump a JVM stack trace on timeouts.
24 | extern "C" [[maybe_unused]] void __sanitizer_print_stack_trace() {
25 | jazzer::DumpJvmStackTraces();
26 | }
27 |
--------------------------------------------------------------------------------
/src/main/resources/BUILD.bazel:
--------------------------------------------------------------------------------
1 | filegroup(
2 | name = "jazzer_test_engine_service",
3 | srcs = ["META-INF/services/org.junit.platform.engine.TestEngine"],
4 | visibility = ["//visibility:public"],
5 | )
6 |
--------------------------------------------------------------------------------
/src/main/resources/META-INF/services/org.junit.platform.engine.TestEngine:
--------------------------------------------------------------------------------
1 | com.code_intelligence.jazzer.junit.JazzerTestEngine
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("@contrib_rules_jvm//java:defs.bzl", "JUNIT5_DEPS", "java_junit5_test")
2 |
3 | java_junit5_test(
4 | name = "JazzerTest",
5 | size = "small",
6 | srcs = glob(["JazzerTest.java"]),
7 | deps = JUNIT5_DEPS + [
8 | # keep sorted
9 | "//src/main/java/com/code_intelligence/jazzer:jazzer_lib",
10 | "@maven//:com_google_truth_truth",
11 | "@maven//:org_junit_jupiter_junit_jupiter_api",
12 | ],
13 | )
14 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/api/BUILD.bazel:
--------------------------------------------------------------------------------
1 | java_test(
2 | name = "AutofuzzTest",
3 | size = "small",
4 | srcs = [
5 | "AutofuzzTest.java",
6 | ],
7 | env = {
8 | # Also consider implementing classes from com.code_intelligence.jazzer.*.
9 | "JAZZER_AUTOFUZZ_TESTING": "1",
10 | },
11 | test_class = "com.code_intelligence.jazzer.api.AutofuzzTest",
12 | runtime_deps = [
13 | "//src/main/java/com/code_intelligence/jazzer/autofuzz",
14 | # Needed for JazzerInternal.
15 | "//src/main/java/com/code_intelligence/jazzer/runtime",
16 | ],
17 | deps = [
18 | "//src/main/java/com/code_intelligence/jazzer/api",
19 | "//src/main/native/com/code_intelligence/jazzer/driver:jazzer_driver",
20 | "@maven//:junit_junit",
21 | ],
22 | )
23 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/autofuzz/testdata/BUILD.bazel:
--------------------------------------------------------------------------------
1 | java_library(
2 | name = "test_data",
3 | srcs = glob(["*.java"]),
4 | visibility = ["//visibility:public"],
5 | )
6 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/instrumentor/AfterHooksTargetContract.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.instrumentor;
18 |
19 | /**
20 | * Helper interface used to call methods on instances of AfterHooksTarget classes loaded via
21 | * different class loaders.
22 | */
23 | public interface AfterHooksTargetContract extends DynamicTestContract {
24 | void registerHasFunc1BeenCalled();
25 |
26 | void verifyFirstSecret(String secret);
27 |
28 | void verifySecondSecret(String secret);
29 |
30 | void verifyThirdSecret(String secret);
31 | }
32 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/instrumentor/BeforeHooksTargetContract.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.instrumentor;
18 |
19 | /**
20 | * Helper interface used to call methods on instances of BeforeHooksTarget classes loaded via
21 | * different class loaders.
22 | */
23 | public interface BeforeHooksTargetContract extends DynamicTestContract {
24 | void func1();
25 |
26 | void setFuncWithArgsCalled(Boolean val);
27 | }
28 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/instrumentor/DynamicTestContract.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.instrumentor;
18 |
19 | import java.util.Map;
20 |
21 | public interface DynamicTestContract {
22 | Map selfCheck();
23 | }
24 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/instrumentor/ReplaceHooksInit.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.instrumentor;
18 |
19 | public class ReplaceHooksInit {
20 | public boolean initialized;
21 |
22 | public ReplaceHooksInit() {}
23 |
24 | @SuppressWarnings("unused")
25 | public ReplaceHooksInit(boolean initialized, String ignored) {
26 | this.initialized = initialized;
27 | }
28 | }
29 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/instrumentor/ReplaceHooksTargetContract.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.instrumentor;
18 |
19 | /**
20 | * Helper interface used to call methods on instances of ReplaceHooksTarget classes loaded via
21 | * different class loaders.
22 | */
23 | public interface ReplaceHooksTargetContract extends DynamicTestContract {
24 | void pass(String test);
25 | }
26 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/junit/FuzzerDictionaryTest.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.code_intelligence.jazzer.junit;
18 |
19 | import static com.code_intelligence.jazzer.junit.FuzzerDictionary.escapeForDictionary;
20 | import static com.google.common.truth.Truth.assertThat;
21 |
22 | import org.junit.jupiter.api.Test;
23 |
24 | class FuzzerDictionaryTest {
25 | @Test
26 | void testEscapeForDictionary() {
27 | assertThat(escapeForDictionary("foo")).isEqualTo("\"foo\"");
28 | assertThat(escapeForDictionary("f\"o\\o\tbar")).isEqualTo("\"f\\\"o\\\\o\tbar\"");
29 | assertThat(escapeForDictionary("\u0012\u001A")).isEqualTo("\"\\x12\\x1A\"");
30 | assertThat(escapeForDictionary("✂\uD83D\uDCCB"))
31 | .isEqualTo("\"\\xE2\\x9C\\x82\\xF0\\x9F\\x93\\x8B\"");
32 | }
33 | }
34 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/junit/test_resources_root/com/example/CorpusDirectoryFuzzTestInputs/corpusDirectoryFuzz/seed:
--------------------------------------------------------------------------------
1 | seed
2 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/junit/test_resources_root/com/example/DirectoryInputsFuzzTestInputs/inputsFuzz/seed:
--------------------------------------------------------------------------------
1 | directory
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/junit/test_resources_root/com/example/DirectoryInputsFuzzTestInputs/nested_dir/seed:
--------------------------------------------------------------------------------
1 | directory
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/mutation/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("@contrib_rules_jvm//java:defs.bzl", "java_test_suite")
2 |
3 | java_test_suite(
4 | name = "MutationTests",
5 | size = "small",
6 | srcs = glob(["*Test.java"]),
7 | runner = "junit5",
8 | deps = [
9 | "//src/main/java/com/code_intelligence/jazzer/mutation",
10 | "//src/main/java/com/code_intelligence/jazzer/mutation/annotation",
11 | "//src/main/java/com/code_intelligence/jazzer/mutation/api",
12 | "//src/main/java/com/code_intelligence/jazzer/mutation/mutator",
13 | "//src/test/java/com/code_intelligence/jazzer/mutation/support:test_support",
14 | ],
15 | )
16 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/mutation/combinator/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("@contrib_rules_jvm//java:defs.bzl", "java_test_suite")
2 |
3 | java_test_suite(
4 | name = "CompositeTests",
5 | size = "small",
6 | srcs = glob(["*.java"]),
7 | runner = "junit5",
8 | deps = [
9 | "//src/main/java/com/code_intelligence/jazzer/mutation/api",
10 | "//src/main/java/com/code_intelligence/jazzer/mutation/combinator",
11 | "//src/main/java/com/code_intelligence/jazzer/mutation/support",
12 | "//src/test/java/com/code_intelligence/jazzer/mutation/support:test_support",
13 | ],
14 | )
15 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/mutation/engine/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("@contrib_rules_jvm//java:defs.bzl", "java_junit5_test", "java_test_suite")
2 |
3 | java_test_suite(
4 | name = "EngineTests",
5 | size = "small",
6 | srcs = [
7 | "SeededPseudoRandomTest.java",
8 | ],
9 | runner = "junit5",
10 | deps = [
11 | "//src/main/java/com/code_intelligence/jazzer/mutation/engine",
12 | "//src/main/java/com/code_intelligence/jazzer/mutation/support",
13 | "//src/test/java/com/code_intelligence/jazzer/mutation/support:test_support",
14 | ],
15 | )
16 |
17 | java_junit5_test(
18 | name = "ChainedMutatorFactoryTest",
19 | srcs = ["ChainedMutatorFactoryTest.java"],
20 | test_class = "com.code_intelligence.jazzer.mutation.engine.ChainedMutatorFactoryTest",
21 | deps = [
22 | "//src/main/java/com/code_intelligence/jazzer/mutation/annotation",
23 | "//src/main/java/com/code_intelligence/jazzer/mutation/api",
24 | "//src/main/java/com/code_intelligence/jazzer/mutation/engine",
25 | "//src/main/java/com/code_intelligence/jazzer/mutation/mutator",
26 | "//src/main/java/com/code_intelligence/jazzer/mutation/support",
27 | "//src/test/java/com/code_intelligence/jazzer/mutation/support:test_support",
28 | "//src/test/java/com/code_intelligence/jazzer/utils:test_utils",
29 | ],
30 | )
31 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/mutation/mutator/collection/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("@contrib_rules_jvm//java:defs.bzl", "java_test_suite")
2 |
3 | java_test_suite(
4 | name = "CollectionTests",
5 | size = "small",
6 | srcs = glob(["*.java"]),
7 | env = {"JAZZER_MOCK_LIBFUZZER_MUTATOR": "true"},
8 | runner = "junit5",
9 | deps = [
10 | "//src/main/java/com/code_intelligence/jazzer/mutation/annotation",
11 | "//src/main/java/com/code_intelligence/jazzer/mutation/api",
12 | "//src/main/java/com/code_intelligence/jazzer/mutation/engine",
13 | "//src/main/java/com/code_intelligence/jazzer/mutation/mutator/collection",
14 | "//src/main/java/com/code_intelligence/jazzer/mutation/mutator/lang",
15 | "//src/main/java/com/code_intelligence/jazzer/mutation/support",
16 | "//src/main/java/com/code_intelligence/jazzer/mutation/utils",
17 | "//src/test/java/com/code_intelligence/jazzer/mutation/support:test_support",
18 | ],
19 | )
20 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/mutation/mutator/lang/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("@contrib_rules_jvm//java:defs.bzl", "java_test_suite")
2 |
3 | java_test_suite(
4 | name = "PrimitiveTests",
5 | size = "small",
6 | srcs = glob(["*.java"]),
7 | env = {"JAZZER_MOCK_LIBFUZZER_MUTATOR": "true"},
8 | runner = "junit5",
9 | deps = [
10 | "//src/main/java/com/code_intelligence/jazzer/mutation/annotation",
11 | "//src/main/java/com/code_intelligence/jazzer/mutation/api",
12 | "//src/main/java/com/code_intelligence/jazzer/mutation/engine",
13 | "//src/main/java/com/code_intelligence/jazzer/mutation/mutator/lang",
14 | "//src/main/java/com/code_intelligence/jazzer/mutation/mutator/libfuzzer:libfuzzermutate",
15 | "//src/main/java/com/code_intelligence/jazzer/mutation/support",
16 | "//src/test/java/com/code_intelligence/jazzer/mutation/support:test_support",
17 | "@protobuf//java/core",
18 | ],
19 | )
20 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/mutation/mutator/time/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("@contrib_rules_jvm//java:defs.bzl", "java_test_suite")
2 |
3 | java_test_suite(
4 | name = "TimeTests",
5 | size = "small",
6 | srcs = glob(["*.java"]),
7 | env = {"JAZZER_MOCK_LIBFUZZER_MUTATOR": "true"},
8 | runner = "junit5",
9 | deps = [
10 | "//src/main/java/com/code_intelligence/jazzer/mutation/annotation",
11 | "//src/main/java/com/code_intelligence/jazzer/mutation/api",
12 | "//src/main/java/com/code_intelligence/jazzer/mutation/engine",
13 | "//src/main/java/com/code_intelligence/jazzer/mutation/mutator/lang",
14 | "//src/main/java/com/code_intelligence/jazzer/mutation/mutator/libfuzzer:libfuzzermutate",
15 | "//src/main/java/com/code_intelligence/jazzer/mutation/mutator/time",
16 | "//src/main/java/com/code_intelligence/jazzer/mutation/support",
17 | "//src/test/java/com/code_intelligence/jazzer/mutation/support:test_support",
18 | "@protobuf//java/core",
19 | ],
20 | )
21 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/runtime/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("//bazel:compat.bzl", "SKIP_ON_WINDOWS")
2 |
3 | java_test(
4 | name = "TraceCmpHooksTest",
5 | srcs = [
6 | "TraceCmpHooksTest.java",
7 | ],
8 | target_compatible_with = SKIP_ON_WINDOWS,
9 | deps = [
10 | "//src/main/java/com/code_intelligence/jazzer/runtime",
11 | "//src/main/native/com/code_intelligence/jazzer/driver:jazzer_driver",
12 | "@maven//:junit_junit",
13 | ],
14 | )
15 |
--------------------------------------------------------------------------------
/src/test/java/com/code_intelligence/jazzer/utils/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("//bazel:compat.bzl", "SKIP_ON_WINDOWS")
2 |
3 | java_library(
4 | name = "test_utils",
5 | srcs = ["CapturedOutput.java"],
6 | visibility = ["//visibility:public"],
7 | deps = [
8 | "//src/main/java/com/code_intelligence/jazzer/utils:log",
9 | ],
10 | )
11 |
--------------------------------------------------------------------------------
/tests/src/test/cc/complex_proto_fuzzer.cc:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Code Intelligence GmbH
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #include "src/libfuzzer/libfuzzer_macro.h"
16 | #include "src/test/java/com/code_intelligence/jazzer/mutation/mutator/proto/proto2.pb.h"
17 |
18 | DEFINE_PROTO_FUZZER(const com::code_intelligence::jazzer::protobuf::TestProtobuf& proto) {
19 | if (proto.i32() == 1234 && proto.str() == "abcd") {
20 | abort();
21 | }
22 | }
23 |
--------------------------------------------------------------------------------
/tests/src/test/data/crash_resistant_coverage_test/crashing_seeds/crash:
--------------------------------------------------------------------------------
1 | aaa
--------------------------------------------------------------------------------
/tests/src/test/data/crash_resistant_coverage_test/crashing_seeds/empty_input:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/CodeIntelligenceTesting/jazzer/efbc6354e412ce221ad3b18a6fdd32bf12241825/tests/src/test/data/crash_resistant_coverage_test/crashing_seeds/empty_input
--------------------------------------------------------------------------------
/tests/src/test/data/crash_resistant_coverage_test/new_coverage_seeds/new_coverage:
--------------------------------------------------------------------------------
1 | aaaaaaaaaaaaaaaaa
--------------------------------------------------------------------------------
/tests/src/test/data/fuzz_test_lister_test/org/example/FuzzTests.class:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/CodeIntelligenceTesting/jazzer/efbc6354e412ce221ad3b18a6fdd32bf12241825/tests/src/test/data/fuzz_test_lister_test/org/example/FuzzTests.class
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/AutofuzzAssertionErrorTarget.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | public class AutofuzzAssertionErrorTarget {
20 | public static void autofuzz(byte[] b) {
21 | assert b == null || b.length <= 5 || b[3] != 7;
22 | }
23 | }
24 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/AutofuzzCrashingSetterTarget.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | public class AutofuzzCrashingSetterTarget extends Thread {
20 | public void start(final byte[] out) {}
21 | }
22 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/AutofuzzIgnoreTarget.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | public class AutofuzzIgnoreTarget {
20 | @SuppressWarnings("unused")
21 | public void doStuff(String data) {
22 | if (data.isEmpty()) {
23 | throw new NullPointerException();
24 | }
25 | if (data.length() < 10) {
26 | throw new IllegalArgumentException();
27 | }
28 | throw new RuntimeException();
29 | }
30 | }
31 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/AutofuzzInnerClassTarget.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
20 |
21 | @SuppressWarnings("unused")
22 | public class AutofuzzInnerClassTarget {
23 | public static class Middle {
24 | public static class Inner {
25 | public void test(int a, int b) {
26 | if (a == b) {
27 | throw new FuzzerSecurityIssueLow("Finished Autofuzz Target");
28 | }
29 | }
30 | }
31 | }
32 | }
33 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/BytesMemoryLeakFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | public class BytesMemoryLeakFuzzer {
20 | public static void fuzzerTestOneInput(byte[] data) {}
21 | }
22 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/CrashResistantCoverageTarget.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import java.time.Instant;
20 |
21 | public class CrashResistantCoverageTarget {
22 | public static void fuzzerTestOneInput(byte[] data) {
23 | if (data.length < 10) {
24 | // Crash immediately on the empty and the first seed input so that we can verify that the
25 | // crash-resistant merge strategy actually works.
26 | throw new IllegalStateException("Crash");
27 | }
28 | if (data.length < 100) {
29 | someFunction();
30 | }
31 | }
32 |
33 | public static void someFunction() {
34 | // A non-trivial condition that always evaluates to true.
35 | if (Instant.now().getNano() >= 0) {
36 | System.out.println("Hello, world!");
37 | }
38 | }
39 | }
40 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/InitializationErrorTest.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.junit.FuzzTest;
20 |
21 | public class InitializationErrorTest {
22 |
23 | static {
24 | sneakyThrow();
25 | }
26 |
27 | private static void sneakyThrow() {
28 | throw new IllegalArgumentException("Sneaky throw in static initializer");
29 | }
30 |
31 | @FuzzTest
32 | public void fuzz(String ignored) {
33 | throw new IllegalStateException("This method should not be executed");
34 | }
35 | }
36 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/InvalidMutatorTest.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.junit.FuzzTest;
20 | import com.code_intelligence.jazzer.mutation.annotation.UrlSegment;
21 |
22 | public class InvalidMutatorTest {
23 |
24 | @FuzzTest
25 | public void invalidParameter(System ignored) {
26 | throw new IllegalStateException("This method should not be executed");
27 | }
28 |
29 | @FuzzTest
30 | public void invalidAnnotation(@UrlSegment Integer ignored) {
31 | throw new IllegalStateException("This method should not be executed");
32 | }
33 | }
34 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/JUnitAssertFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import static org.junit.jupiter.api.Assertions.assertNotEquals;
20 |
21 | import com.code_intelligence.jazzer.api.FuzzedDataProvider;
22 |
23 | public class JUnitAssertFuzzer {
24 | public static void fuzzerTestOneInput(FuzzedDataProvider data) {
25 | assertNotEquals("JUnit rocks!", data.consumeRemainingAsString());
26 | }
27 | }
28 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/JUnitReproducerTest.seed:
--------------------------------------------------------------------------------
1 | Hello, Jazzer!
2 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/JUnitSsrfAllowConnectionsBeforeFuzzingFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzedDataProvider;
20 | import com.code_intelligence.jazzer.junit.FuzzTest;
21 | import java.io.IOException;
22 | import java.net.Socket;
23 | import org.junit.jupiter.api.BeforeAll;
24 |
25 | public class JUnitSsrfAllowConnectionsBeforeFuzzingFuzzer {
26 | // Before the fuzzer is started, we allow network connections.
27 | @BeforeAll
28 | static void connect() {
29 | try (Socket s = new Socket("localhost", 62351)) {
30 | s.getInetAddress();
31 | } catch (IOException ignored) {
32 | }
33 | }
34 |
35 | @FuzzTest
36 | void fuzzTest(FuzzedDataProvider data) throws Exception {}
37 | }
38 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/JUnitSsrfAllowListFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.BugDetectors;
20 | import com.code_intelligence.jazzer.api.FuzzedDataProvider;
21 | import com.code_intelligence.jazzer.junit.FuzzTest;
22 | import java.net.ConnectException;
23 | import java.net.Socket;
24 |
25 | public class JUnitSsrfAllowListFuzzer {
26 |
27 | @FuzzTest
28 | void fuzzTest(FuzzedDataProvider data) throws Exception {
29 | BugDetectors.allowNetworkConnections(
30 | (host, port) -> host.equals("localhost") && port.equals(62351));
31 | try (Socket s = new Socket("localhost", 62351)) {
32 | s.getInetAddress();
33 | } catch (ConnectException ignored) {
34 | }
35 | }
36 | }
37 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/JUnitSsrfFindingFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzedDataProvider;
20 | import com.code_intelligence.jazzer.junit.FuzzTest;
21 | import java.net.ConnectException;
22 | import java.net.Socket;
23 |
24 | public class JUnitSsrfFindingFuzzer {
25 | @FuzzTest
26 | void fuzzTest(FuzzedDataProvider data) throws Exception {
27 | try (Socket s = new Socket("localhost", 62351)) {
28 | s.getInetAddress();
29 | } catch (ConnectException ignored) {
30 | }
31 | }
32 | }
33 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/JazzerApiFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzedDataProvider;
20 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
21 | import com.code_intelligence.jazzer.api.Jazzer;
22 |
23 | public class JazzerApiFuzzer {
24 | public static void fuzzerTestOneInput(FuzzedDataProvider data) {
25 | Jazzer.exploreState(data.consumeByte(), 1);
26 | Jazzer.guideTowardsEquality(data.consumeString(10), data.pickValue(new String[] {"foo"}), 1);
27 | Jazzer.guideTowardsEquality(data.consumeBytes(10), new byte[] {}, 2);
28 | Jazzer.guideTowardsContainment(data.consumeAsciiString(10), "bar", 2);
29 | throw new FuzzerSecurityIssueLow("Jazzer API calls succeed");
30 | }
31 | }
32 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/KotlinStringCompareFuzzer.kt:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example
18 |
19 | import java.io.IOException
20 | import kotlin.io.encoding.Base64
21 | import kotlin.io.encoding.ExperimentalEncodingApi
22 |
23 | object KotlinStringCompareFuzzer {
24 | @JvmStatic
25 | @OptIn(ExperimentalEncodingApi::class)
26 | fun fuzzerTestOneInput(data: ByteArray) {
27 | val text = Base64.encode(data)
28 | if (text.startsWith("aGVsbG8K") &&
29 | // hello
30 | text.endsWith("d29ybGQK") // world
31 | ) {
32 | throw IOException("Found the secret message!")
33 | }
34 | }
35 | }
36 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/KotlinVararg.kt:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example
18 |
19 | class KotlinVararg(
20 | vararg opts: String,
21 | ) {
22 | private val allOpts = opts.toList().joinToString(", ")
23 |
24 | fun doStuff() = allOpts
25 | }
26 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/KotlinVarargFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzedDataProvider;
20 | import java.io.IOException;
21 |
22 | public class KotlinVarargFuzzer {
23 | public static void fuzzerTestOneInput(FuzzedDataProvider data) throws IOException {
24 | String out = new KotlinVararg(data.consumeRemainingAsString().split("; ")).doStuff();
25 | if (out.contains("a, a")) {
26 | throw new IOException(out);
27 | }
28 | }
29 | }
30 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/LocalDateTimeFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
20 | import com.code_intelligence.jazzer.junit.FuzzTest;
21 | import java.time.LocalDateTime;
22 |
23 | public class LocalDateTimeFuzzer {
24 | @FuzzTest
25 | void localDateTimeFuzzTest(LocalDateTime localDateTime) {
26 | if (localDateTime == null) {
27 | return;
28 | }
29 | LocalDateTime targetDate = LocalDateTime.of(2024, 5, 30, 23, 59);
30 | if (targetDate.getDayOfYear() == localDateTime.getDayOfYear()) {
31 | throw new FuzzerSecurityIssueLow("LocalDateTime mutator works!");
32 | }
33 | }
34 | }
35 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/LongStringFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
20 |
21 | /**
22 | * Provoke a finding with huge captured data to verify that the generated crash reproducer is still
23 | * compilable. This test uses a huge, predefined corpus to speed up finding the issue.
24 | *
25 | * Reproduces issue #269 (...)
27 | */
28 | public class LongStringFuzzer {
29 | public static void fuzzerTestOneInput(byte[] data) {
30 | if (data.length > 1024 * 64) {
31 | throw new FuzzerSecurityIssueLow("String too long exception");
32 | }
33 | }
34 | }
35 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/MapFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium;
20 | import com.code_intelligence.jazzer.mutation.annotation.NotNull;
21 | import java.util.Map;
22 |
23 | public class MapFuzzer {
24 | public static void fuzzerTestOneInput(@NotNull Map<@NotNull String, @NotNull String> map) {
25 | if (map.getOrDefault("some_key", "").startsWith("prefix")) {
26 | if (map.containsKey("other_key")) {
27 | throw new FuzzerSecurityIssueMedium();
28 | }
29 | }
30 | }
31 | }
32 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/MemoryLeakFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzedDataProvider;
20 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
21 |
22 | public class MemoryLeakFuzzer {
23 | public static void fuzzerTestOneInput(FuzzedDataProvider data) {
24 | throw new FuzzerSecurityIssueLow();
25 | }
26 | }
27 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/MutatorComplexProtoFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium;
20 | import com.code_intelligence.jazzer.mutation.annotation.NotNull;
21 | import com.code_intelligence.jazzer.protobuf.Proto2.TestProtobuf;
22 |
23 | public class MutatorComplexProtoFuzzer {
24 | public static void fuzzerTestOneInput(@NotNull TestProtobuf proto) {
25 | if (proto.getI32() == 1234 && proto.getStr().equals("abcd")) {
26 | throw new FuzzerSecurityIssueMedium("Secret proto is found!");
27 | }
28 | }
29 | }
30 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/MutatorFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium;
20 | import com.code_intelligence.jazzer.mutation.annotation.InRange;
21 | import com.code_intelligence.jazzer.mutation.annotation.NotNull;
22 |
23 | public class MutatorFuzzer {
24 | public static void fuzzerTestOneInput(
25 | @InRange(max = -42) short num, @NotNull SimpleProto.MyProto proto) {
26 | if (num > -42) {
27 | throw new IllegalArgumentException();
28 | }
29 |
30 | if (proto.getNumber() == 12345678) {
31 | if (proto.getMessage().getText().contains("Hello, proto!")) {
32 | throw new FuzzerSecurityIssueMedium("Dangerous proto");
33 | }
34 | }
35 | }
36 | }
37 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/NoCoverageFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | public class NoCoverageFuzzer {
20 | public static void fuzzerTestOneInput(byte[] data) {}
21 | }
22 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/NoSeedFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.Jazzer;
20 |
21 | public class NoSeedFuzzer {
22 | public static void fuzzerInitialize() {
23 | // Verify that the seed was randomly generated and not taken to be the fixed
24 | // one set in FuzzTargetTestWrapper. This has a 1 / INT_MAX chance to be
25 | // flaky, which is acceptable.
26 | if (Jazzer.SEED == (int) 2735196724L) {
27 | System.err.println(
28 | "Jazzer.SEED should not equal the fixed seed set in FuzzTargetTestWrapper");
29 | System.exit(1);
30 | }
31 | }
32 |
33 | public static void fuzzerTestOneInput(byte[] data) {}
34 | }
35 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/ObjectEqualsIntegerFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzedDataProvider;
20 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
21 | import com.code_intelligence.jazzer.junit.FuzzTest;
22 | import java.util.Objects;
23 |
24 | public class ObjectEqualsIntegerFuzzer {
25 | @FuzzTest
26 | void objectEqualsInteger(FuzzedDataProvider fdp) {
27 | int integer = fdp.consumeInt();
28 | if (Objects.equals(integer, 4711)) {
29 | throw new FuzzerSecurityIssueLow("ObjectsEqualsFuzzer works!");
30 | }
31 | }
32 | }
33 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/ObjectEqualsStringFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
20 | import com.code_intelligence.jazzer.junit.FuzzTest;
21 | import java.util.Objects;
22 |
23 | public class ObjectEqualsStringFuzzer {
24 | @FuzzTest
25 | void objectEqualsString(byte[] input) {
26 | String stringInput = new String(input);
27 | if (Objects.equals(stringInput, "ObjectsEqualsFuzzer")) {
28 | throw new FuzzerSecurityIssueLow("ObjectsEqualsFuzzer works!");
29 | }
30 | }
31 | }
32 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/OfflineInstrumentedFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | public class OfflineInstrumentedFuzzer {
20 | public static void fuzzerTestOneInput(byte[] data) {
21 | OfflineInstrumentedTarget.someFunction(data);
22 | }
23 | }
24 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/OfflineInstrumentedTarget.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | public class OfflineInstrumentedTarget {
20 | public static void someFunction(byte[] data) {
21 | if (new String(data).equals("found it")) {
22 | throw new IllegalStateException("Expected exception");
23 | }
24 | }
25 | }
26 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/PrimitiveTypeCompareHookFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzedDataProvider;
20 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueCritical;
21 |
22 | /*
23 | * Regression test for https://github.com/CodeIntelligenceTesting/jazzer/issues/790.
24 | */
25 | public class PrimitiveTypeCompareHookFuzzer {
26 | public static void fuzzerTestOneInput(FuzzedDataProvider data) {
27 | Byte.compare(data.consumeByte(), (byte) 127);
28 | Short.compare(data.consumeShort(), (short) 4096);
29 | throw new FuzzerSecurityIssueCritical();
30 | }
31 | }
32 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/RegressionModeTest.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
20 | import com.code_intelligence.jazzer.junit.FuzzTest;
21 |
22 | public class RegressionModeTest {
23 |
24 | private static int count = 0;
25 |
26 | @FuzzTest
27 | void fuzzTest(String ignored) {
28 | if (count++ > 0) {
29 | throw new FuzzerSecurityIssueLow("Should not be reached in regression mode");
30 | }
31 | }
32 | }
33 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/SeedFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
20 | import com.code_intelligence.jazzer.api.Jazzer;
21 |
22 | public class SeedFuzzer {
23 | public static void fuzzerInitialize() {
24 | if (Jazzer.SEED != 1234567) {
25 | throw new FuzzerSecurityIssueLow("Expected Jazzer.SEED to be 1234567, got " + Jazzer.SEED);
26 | }
27 | }
28 |
29 | public static void fuzzerTestOneInput(byte[] data) {}
30 | }
31 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/StringCompareFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
20 | import java.util.Base64;
21 |
22 | public class StringCompareFuzzer {
23 | public static void fuzzerTestOneInput(byte[] data) {
24 | String text = Base64.getEncoder().encodeToString(data);
25 | if (text.startsWith("aGVsbG8K") // hello
26 | && text.endsWith("d29ybGQK") // world
27 | ) {
28 | throw new FuzzerSecurityIssueLow("Found the secret message!");
29 | }
30 | }
31 | }
32 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/SwitchCoverageHelper.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | public class SwitchCoverageHelper {
20 | int covered = 0;
21 | final int cases;
22 | static boolean[] casesVisited;
23 |
24 | public SwitchCoverageHelper(int cases) {
25 | this.cases = cases;
26 | casesVisited = new boolean[cases];
27 | }
28 |
29 | public void coverCase(int caze) {
30 | if (caze < 0 || caze >= cases) {
31 | throw new IllegalArgumentException("Invalid case");
32 | }
33 | if (casesVisited[caze]) {
34 | return;
35 | }
36 | casesVisited[caze] = true;
37 | covered++;
38 | }
39 |
40 | public boolean allBranchesCovered() {
41 | return covered == cases;
42 | }
43 | }
44 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/TestMethodInManifestFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | import com.code_intelligence.jazzer.api.FuzzerSecurityIssueCritical;
20 | import com.code_intelligence.jazzer.junit.FuzzTest;
21 | import org.junit.jupiter.api.MethodOrderer;
22 | import org.junit.jupiter.api.Order;
23 | import org.junit.jupiter.api.TestMethodOrder;
24 |
25 | @TestMethodOrder(MethodOrderer.OrderAnnotation.class)
26 | class TestMethodInManifestFuzzer {
27 | @Order(0)
28 | @FuzzTest
29 | void notThisFuzzTest(byte[] bytes) {}
30 |
31 | @Order(1)
32 | @FuzzTest
33 | void thisFuzzTest(byte[] bytes) {
34 | throw new FuzzerSecurityIssueCritical();
35 | }
36 |
37 | @Order(2)
38 | @FuzzTest
39 | void alsoNotThisFuzzTest(byte[] bytes) {}
40 | }
41 |
--------------------------------------------------------------------------------
/tests/src/test/java/com/example/TimeoutFuzzer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 Code Intelligence GmbH
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example;
18 |
19 | public class TimeoutFuzzer {
20 | public static void fuzzerTestOneInput(byte[] b) {
21 | while (true) {}
22 | }
23 | }
24 |
--------------------------------------------------------------------------------
/tests/src/test/native/com/example/BUILD.bazel:
--------------------------------------------------------------------------------
1 | load("@rules_jni//jni:defs.bzl", "cc_jni_library")
2 | load("//bazel:compat.bzl", "SKIP_ON_WINDOWS")
3 |
4 | cc_jni_library(
5 | name = "native_value_profile_fuzzer",
6 | srcs = ["native_value_profile_fuzzer.cpp"],
7 | copts = [
8 | "-fsanitize=fuzzer-no-link",
9 | ],
10 | linkopts = [
11 | "-fsanitize=fuzzer-no-link",
12 | ],
13 | target_compatible_with = SKIP_ON_WINDOWS,
14 | visibility = ["//tests:__pkg__"],
15 | deps = ["//tests:native_value_profile_fuzzer.hdrs"],
16 | )
17 |
--------------------------------------------------------------------------------
/tests/src/test/proto/BUILD.bazel:
--------------------------------------------------------------------------------
1 | proto_library(
2 | name = "simple_proto",
3 | srcs = ["simple_proto.proto"],
4 | )
5 |
6 | java_proto_library(
7 | name = "simple_java_proto",
8 | visibility = ["//tests:__pkg__"],
9 | deps = [":simple_proto"],
10 | )
11 |
--------------------------------------------------------------------------------
/tests/src/test/proto/simple_proto.proto:
--------------------------------------------------------------------------------
1 | //
2 | // Copyright 2024 Code Intelligence GmbH
3 | //
4 | // Licensed under the Apache License, Version 2.0 (the "License");
5 | // you may not use this file except in compliance with the License.
6 | // You may obtain a copy of the License at
7 | //
8 | // http://www.apache.org/licenses/LICENSE-2.0
9 | //
10 | // Unless required by applicable law or agreed to in writing, software
11 | // distributed under the License is distributed on an "AS IS" BASIS,
12 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | // See the License for the specific language governing permissions and
14 | // limitations under the License.
15 | //
16 |
17 | syntax = "proto3";
18 |
19 | package com.example;
20 |
21 | option java_package = "com.example";
22 |
23 | message MyProto {
24 | uint64 number = 1;
25 | MySubProto message = 2;
26 | }
27 |
28 | message MySubProto {
29 | string text = 1;
30 | }
31 |
32 |
--------------------------------------------------------------------------------
/third_party/BUILD.bazel:
--------------------------------------------------------------------------------
1 | exports_files(["jacoco_internal.jarjar"])
2 |
--------------------------------------------------------------------------------
/third_party/android/BUILD:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/CodeIntelligenceTesting/jazzer/efbc6354e412ce221ad3b18a6fdd32bf12241825/third_party/android/BUILD
--------------------------------------------------------------------------------
/third_party/jacoco-ignore-offline-instrumentation.patch:
--------------------------------------------------------------------------------
1 | diff --git org.jacoco.core/src/org/jacoco/core/internal/instr/InstrSupport.java org.jacoco.core/src/org/jacoco/core/internal/instr/InstrSupport.java
2 | index b8333a2f..1c728638 100644
3 | --- org.jacoco.core/src/org/jacoco/core/internal/instr/InstrSupport.java
4 | +++ org.jacoco.core/src/org/jacoco/core/internal/instr/InstrSupport.java
5 | @@ -234,11 +234,6 @@ public final class InstrSupport {
6 | */
7 | public static void assertNotInstrumented(final String member,
8 | final String owner) throws IllegalStateException {
9 | - if (member.equals(DATAFIELD_NAME) || member.equals(INITMETHOD_NAME)) {
10 | - throw new IllegalStateException(format(
11 | - "Cannot process instrumented class %s. Please supply original non-instrumented classes.",
12 | - owner));
13 | - }
14 | }
15 |
16 | /**
17 |
--------------------------------------------------------------------------------
/third_party/jacoco_internal.BUILD:
--------------------------------------------------------------------------------
1 | load("@bazel_jar_jar//:jar_jar.bzl", "jar_jar")
2 |
3 | java_import(
4 | name = "jacoco_internal",
5 | jars = ["jacoco_internal_shaded.jar"],
6 | visibility = ["//visibility:public"],
7 | deps = [
8 | "@maven//:org_ow2_asm_asm",
9 | "@maven//:org_ow2_asm_asm_commons",
10 | "@maven//:org_ow2_asm_asm_tree",
11 | ],
12 | )
13 |
14 | jar_jar(
15 | name = "jacoco_internal_shaded",
16 | input_jar = "libjacoco_internal_unshaded.jar",
17 | rules = "@jazzer//third_party:jacoco_internal.jarjar",
18 | )
19 |
20 | java_library(
21 | name = "jacoco_internal_unshaded",
22 | srcs = glob([
23 | "org.jacoco.core/src/org/jacoco/core/**/*.java",
24 | ]),
25 | javacopts = [
26 | "-Xep:EqualsHashCode:OFF",
27 | "-Xep:ReturnValueIgnored:OFF",
28 | ],
29 | resources = glob([
30 | "org.jacoco.core/src/org/jacoco/core/**/*.properties",
31 | ]),
32 | deps = [
33 | "@maven//:org_ow2_asm_asm",
34 | "@maven//:org_ow2_asm_asm_commons",
35 | "@maven//:org_ow2_asm_asm_tree",
36 | ],
37 | )
38 |
--------------------------------------------------------------------------------
/third_party/jacoco_internal.jarjar:
--------------------------------------------------------------------------------
1 | rule org.jacoco.** com.code_intelligence.jazzer.third_party.@0
2 |
--------------------------------------------------------------------------------
/third_party/protobuf-disable-layering_check.patch:
--------------------------------------------------------------------------------
1 | From f4444a81218ede5eb58306bd57eaefb5d9ffd9e2 Mon Sep 17 00:00:00 2001
2 | From: Fabian Meumertzheim
3 | Date: Mon, 8 Jan 2024 13:30:32 +0100
4 | Subject: [PATCH] Disable unsupported `layering_check` Bazel feature
5 |
6 | This allows downstream projects to use `layering_check` without having
7 | to patch Protobuf to disable the feature for the repository.
8 | ---
9 | REPO.bazel | 11 +++++++++++
10 | 1 file changed, 11 insertions(+)
11 | create mode 100644 REPO.bazel
12 |
13 | diff --git a/REPO.bazel b/REPO.bazel
14 | new file mode 100644
15 | index 00000000000..a537ac745fa
16 | --- /dev/null
17 | +++ b/REPO.bazel
18 | @@ -0,0 +1,11 @@
19 | +# This file is read by Bazel 7 and newer, both if Protobuf is the main
20 | +# repository and if it is an external repository.
21 | +repo(
22 | + features = [
23 | + # Protobuf cc_* targets do not specify all dependencies from which they
24 | + # include headers. This causes builds of downstream projects with
25 | + # --feature=layering_check to fail, which can be avoided by disabling
26 | + # the feature for the entire repository.
27 | + "-layering_check",
28 | + ],
29 | +)
30 |
--------------------------------------------------------------------------------
/third_party/slicer.BUILD:
--------------------------------------------------------------------------------
1 | cc_library(
2 | name = "jazzer_slicer",
3 | srcs = [
4 | "slicer/bytecode_encoder.cc",
5 | "slicer/code_ir.cc",
6 | "slicer/common.cc",
7 | "slicer/control_flow_graph.cc",
8 | "slicer/debuginfo_encoder.cc",
9 | "slicer/dex_bytecode.cc",
10 | "slicer/dex_format.cc",
11 | "slicer/dex_ir.cc",
12 | "slicer/dex_ir_builder.cc",
13 | "slicer/dex_utf8.cc",
14 | "slicer/instrumentation.cc",
15 | "slicer/reader.cc",
16 | "slicer/tryblocks_encoder.cc",
17 | "slicer/writer.cc",
18 | ],
19 | hdrs = glob(["slicer/export/slicer/*.h"]),
20 | copts = [
21 | "-Wall",
22 | "-Wno-sign-compare",
23 | "-Wno-unused-parameter",
24 | "-Wno-shift-count-overflow",
25 | "-Wno-missing-braces",
26 | ],
27 | includes = ["slicer/export"],
28 | visibility = [
29 | "//visibility:public",
30 | ],
31 | )
32 |
--------------------------------------------------------------------------------