Skip to content

Commit 9fe86da

Browse files
oetroetr
committed
feat: String mutator now uses @DictionaryProvider
The StringMutatorFactory now extracts applicable Strings from the @DictionaryProvider and uses them during mutation according to the pInv of the last @DictionaryProvider annotation it found on this type.
1 parent 8e419fa commit 9fe86da

File tree

4 files changed

+268
-2
lines changed

4 files changed

+268
-2
lines changed

‎src/main/java/com/code_intelligence/jazzer/mutation/mutator/lang/StringMutatorFactory.java‎

Lines changed: 107 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,30 @@
1717
package com.code_intelligence.jazzer.mutation.mutator.lang;
1818

1919
import static com.code_intelligence.jazzer.mutation.combinator.MutatorCombinators.mutateThenMapToImmutable;
20-
import static com.code_intelligence.jazzer.mutation.support.TypeSupport.*;
20+
import static com.code_intelligence.jazzer.mutation.support.DictionaryProviderSupport.extractFirstInvProbability;
21+
import static com.code_intelligence.jazzer.mutation.support.TypeSupport.findFirstParentIfClass;
22+
import static com.code_intelligence.jazzer.mutation.support.TypeSupport.notNull;
23+
import static com.code_intelligence.jazzer.mutation.support.TypeSupport.withLength;
2124

2225
import com.code_intelligence.jazzer.mutation.annotation.Ascii;
2326
import com.code_intelligence.jazzer.mutation.annotation.UrlSegment;
2427
import com.code_intelligence.jazzer.mutation.annotation.WithUtf8Length;
2528
import com.code_intelligence.jazzer.mutation.api.Debuggable;
2629
import com.code_intelligence.jazzer.mutation.api.ExtendedMutatorFactory;
2730
import com.code_intelligence.jazzer.mutation.api.MutatorFactory;
31+
import com.code_intelligence.jazzer.mutation.api.PseudoRandom;
2832
import com.code_intelligence.jazzer.mutation.api.SerializingMutator;
2933
import com.code_intelligence.jazzer.mutation.mutator.libfuzzer.LibFuzzerMutatorFactory;
34+
import com.code_intelligence.jazzer.mutation.support.DictionaryProviderSupport;
3035
import com.code_intelligence.jazzer.mutation.support.TypeHolder;
36+
import java.io.DataInputStream;
37+
import java.io.DataOutputStream;
38+
import java.io.IOException;
3139
import java.lang.reflect.AnnotatedType;
3240
import java.nio.charset.StandardCharsets;
3341
import java.util.Optional;
3442
import java.util.function.Predicate;
43+
import java.util.stream.Stream;
3544

3645
final class StringMutatorFactory implements MutatorFactory {
3746
private static final int HEADER_MASK = 0b1100_0000;
@@ -176,7 +185,9 @@ public Optional<SerializingMutator<?>> tryCreate(
176185

177186
AnnotatedType innerByteArray =
178187
notNull(withLength(new TypeHolder<byte[]>() {}.annotatedType(), min, max));
179-
return LibFuzzerMutatorFactory.tryCreate(innerByteArray);
188+
Optional<SerializingMutator<?>> innerMutator =
189+
LibFuzzerMutatorFactory.tryCreate(innerByteArray);
190+
return UserDictionaryMutatorWrapper.of(innerMutator, type, min, max);
180191
})
181192
.map(
182193
byteArrayMutator -> {
@@ -198,4 +209,98 @@ public Optional<SerializingMutator<?>> tryCreate(
198209
(Predicate<Debuggable> inCycle) -> "String");
199210
});
200211
}
212+
213+
private static final class UserDictionaryMutatorWrapper extends SerializingMutator<byte[]> {
214+
private final byte[][] dictionaryValues;
215+
private final SerializingMutator<byte[]> basicMutator;
216+
private final int pInv;
217+
218+
public static Optional<SerializingMutator<?>> of(
219+
Optional<SerializingMutator<?>> mutator, AnnotatedType type, int minSize, int maxSize) {
220+
if (!mutator.isPresent()) {
221+
return Optional.empty();
222+
}
223+
Optional<byte[][]> values = generateDictionaryValues(type, minSize, maxSize);
224+
if (!values.isPresent()) {
225+
return mutator;
226+
}
227+
return Optional.of(
228+
new UserDictionaryMutatorWrapper(
229+
(SerializingMutator<byte[]>) mutator.get(),
230+
values.get(),
231+
extractFirstInvProbability(type)));
232+
}
233+
234+
public UserDictionaryMutatorWrapper(
235+
SerializingMutator<byte[]> basicMutator, byte[][] dictionaryValues, int pInv) {
236+
this.basicMutator = basicMutator;
237+
this.dictionaryValues = dictionaryValues;
238+
this.pInv = pInv;
239+
}
240+
241+
public static Optional<byte[][]> generateDictionaryValues(
242+
AnnotatedType type, int minSize, int maxSize) {
243+
return DictionaryProviderSupport.extractRawValues(type)
244+
.map(
245+
stream ->
246+
stream
247+
.flatMap(
248+
o -> {
249+
if (o instanceof String) {
250+
return Stream.of(((String) o).getBytes(StandardCharsets.UTF_8));
251+
} else {
252+
return Stream.empty();
253+
}
254+
})
255+
.filter(b -> b.length >= minSize && b.length <= maxSize)
256+
.distinct()
257+
.toArray(byte[][]::new));
258+
}
259+
260+
@Override
261+
public String toDebugString(Predicate<Debuggable> isInCycle) {
262+
return "String";
263+
}
264+
265+
@Override
266+
public byte[] read(DataInputStream in) throws IOException {
267+
return basicMutator.read(in);
268+
}
269+
270+
@Override
271+
public void write(byte[] value, DataOutputStream out) throws IOException {
272+
basicMutator.write(value, out);
273+
}
274+
275+
@Override
276+
public byte[] detach(byte[] value) {
277+
return basicMutator.detach(value);
278+
}
279+
280+
@Override
281+
public byte[] init(PseudoRandom prng) {
282+
if (prng.trueInOneOutOf(pInv)) {
283+
return prng.pickIn(dictionaryValues);
284+
}
285+
return basicMutator.init(prng);
286+
}
287+
288+
@Override
289+
public byte[] mutate(byte[] value, PseudoRandom prng) {
290+
if (prng.trueInOneOutOf(pInv)) {
291+
return prng.pickIn(dictionaryValues);
292+
}
293+
return basicMutator.mutate(value, prng);
294+
}
295+
296+
@Override
297+
public byte[] crossOver(byte[] value, byte[] otherValue, PseudoRandom prng) {
298+
return basicMutator.crossOver(value, otherValue, prng);
299+
}
300+
301+
@Override
302+
public boolean hasFixedSize() {
303+
return false;
304+
}
305+
}
201306
}

‎src/main/java/com/code_intelligence/jazzer/mutation/support/BUILD.bazel‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ java_library(
77
],
88
deps = [
99
"//src/main/java/com/code_intelligence/jazzer/mutation/annotation",
10+
"//src/main/java/com/code_intelligence/jazzer/mutation/runtime",
1011
"//src/main/java/com/code_intelligence/jazzer/mutation/utils",
1112
"//src/main/java/com/code_intelligence/jazzer/utils:log",
1213
],

‎tests/BUILD.bazel‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,28 @@ java_fuzz_target_test(
2020
verify_crash_input = False,
2121
)
2222

23+
java_fuzz_target_test(
24+
name = "DictionaryProviderFuzzerLongString",
25+
srcs = [
26+
"src/test/java/com/example/DictionaryProviderFuzzerLongString.java",
27+
],
28+
allowed_findings = ["com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow"],
29+
fuzzer_args = [
30+
"-runs=10000",
31+
],
32+
target_class = "com.example.DictionaryProviderFuzzerLongString",
33+
verify_crash_input = False,
34+
verify_crash_reproducer = False,
35+
deps = [
36+
"//deploy:jazzer-junit",
37+
"//deploy:jazzer-project",
38+
"@maven//:com_google_truth_truth",
39+
"@maven//:org_junit_jupiter_junit_jupiter_api",
40+
"@maven//:org_junit_jupiter_junit_jupiter_engine",
41+
"@maven//:org_junit_platform_junit_platform_launcher",
42+
],
43+
)
44+
2345
java_fuzz_target_test(
2446
name = "JpegImageParserAutofuzz",
2547
allowed_findings = ["java.lang.NegativeArraySizeException"],

‎tests/src/test/java/com/example/DictionaryProviderFuzzerLongString.java‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
/*
2+
* Copyright 2024 Code Intelligence GmbH
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package com.example;
18+
19+
import static com.google.common.truth.Truth.assertThat;
20+
21+
import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
22+
import com.code_intelligence.jazzer.junit.FuzzTest;
23+
import com.code_intelligence.jazzer.mutation.annotation.DictionaryProvider;
24+
import com.code_intelligence.jazzer.mutation.annotation.NotNull;
25+
import com.code_intelligence.jazzer.mutation.annotation.WithSize;
26+
import com.code_intelligence.jazzer.mutation.annotation.WithUtf8Length;
27+
import java.util.List;
28+
import java.util.stream.Stream;
29+
30+
public class DictionaryProviderFuzzerLongString {
31+
private static final String str00 = repeat("0123456789abcdef", 50);
32+
private static final String str01 = repeat("sitting duck suprime", 53);
33+
private static final String str10 = repeat("poa0189fbhBHOVBO781%", 30);
34+
private static final String unused = repeat("XdeadbeefX", 21);
35+
36+
public static Stream<?> dict0() {
37+
return Stream.of(
38+
str00,
39+
str01,
40+
// We can mix all kinds of values in the same dictionary.
41+
// Each mutator only takes the values it can use.
42+
123,
43+
4567899999L);
44+
}
45+
46+
public static Stream<?> dict1() {
47+
return Stream.of(str10);
48+
}
49+
50+
public static Stream<?> emptyDict() {
51+
return Stream.of();
52+
}
53+
54+
public static Stream<?> unusedDictionary() {
55+
return Stream.of(unused);
56+
}
57+
58+
@FuzzTest
59+
// Just propagate the dictionary to all types of the fuzz test method that can use it.
60+
// Annotating individual String parameters is also possible.
61+
@DictionaryProvider(
62+
value = {"dict0"},
63+
// Here we use a very low probability for picking dictionary values.
64+
// It gets overwritten for some arguments below.
65+
pInv = 1000000000)
66+
public static void fuzzerTestOneInput(
67+
@NotNull
68+
// Extend the maximum length of the String so that the dictionary values can actually be
69+
// used
70+
@WithUtf8Length(max = 10000)
71+
// The String mutator for this argument will use "dict1" and "emptyDict" with pInv = 2
72+
// for all dictionary entries.
73+
@DictionaryProvider(
74+
value = {"emptyDict"},
75+
// Set pInv = 2 for the String mutator
76+
pInv = 2)
77+
String data00,
78+
79+
// Identical annotations as for data00
80+
@NotNull
81+
@WithUtf8Length(max = 10000)
82+
@DictionaryProvider(
83+
value = {"emptyDict"},
84+
pInv = 2)
85+
String data01,
86+
87+
// The String mutator, inside the List mutator for this argument will use "dict0" and
88+
// "dict1" with pInv = 2 for all dictionary entries.
89+
// Note that the String mutator is not directly annotated, and gets annotated because
90+
// @DictionaryProvider has PropertyConstraint.RECURSIVE
91+
@DictionaryProvider(
92+
value = {"dict1"},
93+
pInv = 2)
94+
@NotNull
95+
@WithSize(max = 2)
96+
List<@NotNull String> data1,
97+
98+
// The String mutator for this argument will use entries from
99+
// @DictionaryProvider(value={"dict0"}, pInv = 1000000000), that get propagated here from the
100+
// method annotation.
101+
@NotNull String data2) {
102+
103+
// This should only happen 2:1000000000 times.
104+
assertThat(data2.equals(str00)).isFalse();
105+
assertThat(data2.equals(str01)).isFalse();
106+
107+
// Error: matched a long string from dictionary entry this variable was NOT annotated with.
108+
// This should never happen.
109+
assertThat(data00.equals(str10)).isFalse();
110+
assertThat(data00.equals(unused)).isFalse();
111+
assertThat(data01.equals(str10)).isFalse();
112+
assertThat(data01.equals(unused)).isFalse();
113+
assertThat(data1.equals(unused)).isFalse();
114+
assertThat(data2.equals(str10)).isFalse();
115+
assertThat(data2.equals(unused)).isFalse();
116+
117+
/*
118+
* libFuzzer's table of recent compares only allows 64 bytes, so asking the fuzzer to construct
119+
* these long strings would run for a very very long time without finding them. However, with a
120+
* @DictionaryProvider this problem is trivial, because we can directly provide these long strings to
121+
* the fuzzer, and also force that they are used more often by setting pInv to a low value close to 2.
122+
*/
123+
if (data00.equals(str00)
124+
&& data01.equals(str01)
125+
&& !data1.isEmpty()
126+
&& data1.get(0).equals(str10)) {
127+
throw new FuzzerSecurityIssueLow("Found all long strings as expected");
128+
}
129+
}
130+
131+
private static String repeat(String str, int count) {
132+
StringBuilder sb = new StringBuilder(str.length() * count);
133+
for (int i = 0; i < count; i++) {
134+
sb.append(str);
135+
}
136+
return sb.toString();
137+
}
138+
}

0 commit comments

Comments
 (0)