Skip to content

Autofuzz generates invalid code for multi-dimensional array #1026

@Marcono1234

Description

@Marcono1234

Description

Originally mentioned in #1024 (comment)

Autofuzz generates invalid code for multi-dimensional arrays such as int[][]. The Jazzer code uses Class#getName during code generation, however for arrays that uses the JVM type descriptor (e.g. [I), which is not valid in the generated Java code:

String.format("new %s[]{", type.getComponentType().getName()), ", ", "}");

This could be solved by using Class#getTypeName which returns the desired format, however its documentation makes no guarantees about the output. So it might be safer to create a custom method which produces the desired type string.

Reproduction steps

  1. Create a dummy Java class which takes a multi-dimensional array as input
    package example;
    
    public class Test {
        public Test(int[][] i) {
            if (i != null && i.length > 3) throw new RuntimeException();
        }
    }
  2. Compile that file and package the compiled file (example/Test.class) in a JAR (e.g. example.jar)
  3. Run Autofuzz
    ./jazzer --cp=example.jar --autofuzz="example.Test::new"
    ℹ️ This should detect a crash and generate a reproducer file Crash_....java
  4. Inspect the reproducer file Crash_....java
    ❌ Bug: The generated reproducer contains invalid Java code new example.Test(new [I[]{...}); (note the [I)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions