Use Jazzer to fuzz Jazzer (#774)

Create a new project to enable fuzzing Jazzer with itself

selffuzz/.gitignore

@@ -0,0 +1,5 @@
+.cifuzz-build/
+.cifuzz-corpus/
+.cifuzz-findings/
+target/
+src/test/resources/

selffuzz/BUILD.bazel

@@ -0,0 +1,8 @@
+load("@com_github_johnynek_bazel_jar_jar//:jar_jar.bzl", "jar_jar")
+
+jar_jar(
+    name = "jazzer_selffuzz",
+    input_jar = "//src/main/java/com/code_intelligence/jazzer:jazzer",
+    rules = "selffuzz_shade_rules.jarjar",
+    visibility = ["__subpackages__"],
+)

selffuzz/README.md

@@ -0,0 +1,30 @@
+# Selffuzz
+
+This package holds fuzz tests for Jazzer. In order to get around the
+constraint that Jazzer cannot instrument its own code this is a separate
+package that takes the built Jazzer jar and shades it such that we can
+have the normal Jazzer classes running the fuzzing while our test code
+calls the shaded Jazzer classes which have been instrumented.
+
+## Building and running
+
+```shell
+bazel build //...
+cifuzz run "<test case name>"
+```
+
+The shaded classes will be in the `com.code_intelligence.selffuzz.jazzer` package.
+
+## Maven and Bazel
+
+This package contains both Maven and Bazel files. There is no interaction
+between them. Bazel is used to integrate with the build system of the wider
+project and to integrate with Intellij and Maven is used by `cifuzz` for running the fuzz tests.
+Any dependencies used in the tests must therefore be listed in both Maven and Bazel.
+
+### Jazzer dependency in Maven
+
+In addition to testing the current working version of Jazzer, this also uses it to run the fuzzing by
+directly referencing the output jars produced by `bazel build //deploy` in `pom.xml`. Because we're
+sidestepping Maven's normal dependency handling, it won't automatically resolve Jazzer's transitive dependencies meaning
+they must be manually added to selffuzz's `pom.xml` in order for everything to be available.

selffuzz/cifuzz.yaml

@@ -0,0 +1,65 @@
+# Copyright 2023 Code Intelligence GmbH
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+## Configuration for a CI Fuzz project
+## Generated on 2023-06-15
+
+## The build system used to build this project. If not set, cifuzz tries
+## to detect the build system automatically.
+## Valid values: "bazel", "cmake", "maven", "gradle", "other".
+#build-system: cmake
+
+## If the build system type is "other", this command is used by
+## `cifuzz run` to build the fuzz test.
+#build-command: "make my_fuzz_test"
+
+## Directories containing sample inputs for the code under test.
+## See https://llvm.org/docs/LibFuzzer.html#corpus
+#seed-corpus-dirs:
+# - path/to/seed-corpus
+
+## A file containing input language keywords or other interesting byte
+## sequences.
+## See https://llvm.org/docs/LibFuzzer.html#dictionaries
+#dict: path/to/dictionary.dct
+
+## Command-line arguments to pass to libFuzzer.
+## See https://llvm.org/docs/LibFuzzer.html#options
+#engine-args:
+# - -rss_limit_mb=4096
+
+## Maximum time to run fuzz tests. The default is to run indefinitely.
+#timeout: 30m
+
+## By default, fuzz tests are executed in a sandbox to prevent accidental
+## damage to the system. Set to false to run fuzz tests unsandboxed.
+## Only supported on Linux.
+#use-sandbox: false
+
+## Set to true to print output of the `cifuzz run` command as JSON.
+#print-json: true
+
+## Set to true to disable desktop notifications.
+#no-notifications: true
+
+## Set URL of the CI App.
+#server: https://app.code-intelligence.com
+
+## Set the project name on the CI App.
+#project: my-project-1a2b3c4d
+
+## Style for CI Fuzz.
+#style: plain
+
+project: Jazzer-59bcb221

selffuzz/pom.xml

@@ -0,0 +1,157 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Copyright 2023 Code Intelligence GmbH
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>com.code-intelligence.selffuzz</groupId>
+  <artifactId>selffuzz</artifactId>
+  <version>1.0-SNAPSHOT</version>
+
+  <name>selffuzz</name>
+  <description>A project that allows us to run cifuzz against parts of Jazzer's code by shading jazzer within a new
+  namespace to allow us to instrument it without interfering with the normal Jazzer code which is running the fuzzing
+  </description>
+
+  <properties>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <maven.compiler.source>1.8</maven.compiler.source>
+    <maven.compiler.target>1.8</maven.compiler.target>
+  </properties>
+
+  <profiles>
+    <profile>
+      <id>cifuzz</id>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.jacoco</groupId>
+            <artifactId>jacoco-maven-plugin</artifactId>
+            <configuration>
+              <formats>${cifuzz.report.format}</formats>
+              <outputDirectory>${cifuzz.report.output}</outputDirectory>
+            </configuration>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
+
+  <dependencies>
+    <!-- Use JUnit Jupiter for testing. -->
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
+      <version>5.9.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-api</artifactId>
+      <version>5.9.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-params</artifactId>
+      <version>5.9.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.platform</groupId>
+      <artifactId>junit-platform-commons</artifactId>
+      <version>1.9.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.platform</groupId>
+      <artifactId>junit-platform-launcher</artifactId>
+      <version>1.9.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>com.code-intelligence</groupId>
+      <artifactId>jazzer</artifactId>
+      <version>dev</version>
+      <scope>system</scope>
+      <systemPath>${project.basedir}/../bazel-bin/deploy/jazzer-project.jar</systemPath>
+    </dependency>
+    <dependency>
+      <groupId>com.code-intelligence</groupId>
+      <artifactId>jazzer-junit</artifactId>
+      <version>dev</version>
+      <scope>system</scope>
+      <systemPath>${project.basedir}/../bazel-bin/deploy/jazzer-junit-project.jar</systemPath>
+    </dependency>
+    <dependency>
+      <groupId>com.code-intelligence</groupId>
+      <artifactId>jazzer-api</artifactId>
+      <version>dev</version>
+      <scope>system</scope>
+      <systemPath>${project.basedir}/../bazel-bin/deploy/jazzer-api-project.jar</systemPath>
+    </dependency>
+    <!--
+    <dependency>
+      <groupId>com.code-intelligence</groupId>
+      <artifactId>jazzer-junit</artifactId>
+      <version>0.19.0</version>
+      <scope>test</scope>
+    </dependency>
+    -->
+    <dependency>
+      <groupId>com.code-intelligence.selffuzz</groupId>
+      <artifactId>jazzer</artifactId>
+      <version>dev</version>
+      <scope>system</scope>
+      <systemPath>${project.basedir}/../bazel-bin/selffuzz/jazzer_selffuzz.jar</systemPath>
+    </dependency>
+    <dependency>
+      <groupId>com.google.truth</groupId>
+      <artifactId>truth</artifactId>
+      <version>1.1.3</version>
+      <scope>test</scope>
+    </dependency>
+
+  </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.jacoco</groupId>
+        <artifactId>jacoco-maven-plugin</artifactId>
+        <version>0.8.8</version>
+        <executions>
+          <execution>
+            <goals>
+              <goal>prepare-agent</goal>
+            </goals>
+          </execution>
+          <execution>
+            <id>report</id>
+            <phase>test</phase>
+            <goals>
+              <goal>report</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+</project>
+

selffuzz/selffuzz_shade_rules.jarjar

@@ -0,0 +1 @@
+rule com.code_intelligence.jazzer.** com.code_intelligence.selffuzz.jazzer.@1

selffuzz/src/test/java/com/code_intelligence/selffuzz/BUILD.bazel

@@ -0,0 +1,19 @@
+load("@contrib_rules_jvm//java:defs.bzl", "JUNIT5_DEPS", "java_junit5_test")
+
+java_junit5_test(
+    name = "FuzzTestCase",
+    srcs = ["FuzzTestCase.java"],
+    deps = JUNIT5_DEPS + [
+        "helpers",
+        "//selffuzz:jazzer_selffuzz",
+        "//src/main/java/com/code_intelligence/jazzer/junit:fuzz_test",
+        "@maven//:org_junit_jupiter_junit_jupiter_api",
+        "@maven//:org_junit_jupiter_junit_jupiter_params",
+    ],
+)
+
+java_library(
+    name = "helpers",
+    srcs = ["Helpers.java"],
+    deps = ["//selffuzz:jazzer_selffuzz"],
+)

selffuzz/src/test/java/com/code_intelligence/selffuzz/FuzzTestCase.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2023 Code Intelligence GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.code_intelligence.selffuzz;
+
+import com.code_intelligence.jazzer.junit.FuzzTest;
+import com.code_intelligence.selffuzz.jazzer.mutation.api.SerializingMutator;
+import com.code_intelligence.selffuzz.jazzer.mutation.mutator.lang.LangMutators;
+import com.code_intelligence.selffuzz.jazzer.mutation.support.TypeHolder;
+import java.io.ByteArrayInputStream;
+import java.io.DataInputStream;
+import java.io.EOFException;
+import java.io.IOException;
+import java.io.InputStream;
+
+class FuzzTestCase {
+  @FuzzTest(maxDuration = "10m")
+  void stringMutatorTest(byte[] data) {
+    SerializingMutator<String> mutator =
+        (SerializingMutator<String>) LangMutators.newFactory().createOrThrow(
+            new TypeHolder<String>() {}.annotatedType());
+
+    try (DataInputStream stream = Helpers.infiniteByteStream(data)) {
+      String out = mutator.read(stream);
+    } catch (EOFException e) {
+      // ignore end of file exceptions which can happen due to an invalid length in the input byte
+      // array
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+}

selffuzz/src/test/java/com/code_intelligence/selffuzz/Helpers.java

@@ -0,0 +1,29 @@
+/*
+ * Copyright 2023 Code Intelligence GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.code_intelligence.selffuzz;
+
+import com.code_intelligence.selffuzz.jazzer.mutation.support.InputStreamSupport;
+import java.io.ByteArrayInputStream;
+import java.io.DataInputStream;
+import java.io.InputStream;
+
+public class Helpers {
+  public static DataInputStream infiniteByteStream(byte[] data) {
+    InputStream dataStream = new ByteArrayInputStream(data);
+    return new DataInputStream(InputStreamSupport.extendWithZeros(dataStream));
+  }
+}

src/main/java/com/code_intelligence/jazzer/api/BUILD.bazel

@@ -30,7 +30,10 @@ java_library(
 java_binary(
     name = "api_deploy_env",
     create_executable = False,
-    visibility = ["//src/main/java/com/code_intelligence/jazzer:__pkg__"],
+    visibility = [
+        "//selffuzz:__pkg__",
+        "//src/main/java/com/code_intelligence/jazzer:__pkg__",
+    ],
     runtime_deps = [":api"],
 )
 

src/main/java/com/code_intelligence/jazzer/junit/BUILD.bazel

@@ -31,6 +31,7 @@ java_library(
     ],
     visibility = [
         "//examples/junit/src/test/java/com/example:__pkg__",
+        "//selffuzz/src/test/java/com/code_intelligence/selffuzz:__pkg__",
     ],
     runtime_deps = [
         # The JUnit launcher that is part of the Jazzer driver needs this on the classpath