1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
// Copyright 2022 Code Intelligence GmbH
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package com.example;
import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;
import com.code_intelligence.jazzer.api.HookType;
import com.code_intelligence.jazzer.api.MethodHook;
import java.lang.invoke.MethodHandle;
import java.lang.reflect.Field;
import java.util.regex.Pattern;
// This fuzzer verifies that:
// 1. a class referenced in a static initializer of a hook is still instrumented with the hook;
// 2. hooks that are not shipped in the Jazzer agent JAR can still instrument Java standard library
// classes.
public class HookDependenciesFuzzer {
private static final Field PATTERN_ROOT;
static {
Field root;
try {
root = Pattern.class.getDeclaredField("root");
} catch (NoSuchFieldException e) {
root = null;
}
PATTERN_ROOT = root;
}
@MethodHook(type = HookType.AFTER, targetClassName = "java.util.regex.Matcher",
targetMethod = "matches", targetMethodDescriptor = "()Z",
additionalClassesToHook = {"java.util.regex.Pattern"})
public static void
matcherMatchesHook(MethodHandle method, Object alwaysNull, Object[] alwaysEmpty, int hookId,
Boolean returnValue) {
if (PATTERN_ROOT != null) {
throw new FuzzerSecurityIssueLow("Hook applied even though it depends on the class to hook");
}
}
public static void fuzzerTestOneInput(byte[] data) {
try {
Pattern.matches("foobar", "foobar");
} catch (Throwable t) {
if (t instanceof FuzzerSecurityIssueLow) {
throw t;
} else {
// Unexpected exception, exit without producing a finding to let the test fail due to the
// missing Java reproducer.
// FIXME(fabian): This is hacky and will result in false positives as soon as we implement
// Java reproducers for fuzz target exits. Replace this with a more reliable signal.
t.printStackTrace();
System.exit(1);
}
}
}
}
|
