-
Notifications
You must be signed in to change notification settings - Fork 163
Open
Description
Description
Originally mentioned in #1024 (comment)
Autofuzz generates invalid code for multi-dimensional arrays such as int[][]. The Jazzer code uses Class#getName during code generation, however for arrays that uses the JVM type descriptor (e.g. [I), which is not valid in the generated Java code:
| String.format("new %s[]{", type.getComponentType().getName()), ", ", "}"); |
This could be solved by using Class#getTypeName which returns the desired format, however its documentation makes no guarantees about the output. So it might be safer to create a custom method which produces the desired type string.
Reproduction steps
- Create a dummy Java class which takes a multi-dimensional array as input
package example; public class Test { public Test(int[][] i) { if (i != null && i.length > 3) throw new RuntimeException(); } }
- Compile that file and package the compiled file (
example/Test.class) in a JAR (e.g.example.jar) - Run Autofuzz
ℹ️ This should detect a crash and generate a reproducer file
./jazzer --cp=example.jar --autofuzz="example.Test::new"Crash_....java - Inspect the reproducer file
Crash_....java
❌ Bug: The generated reproducer contains invalid Java codenew example.Test(new [I[]{...});(note the[I)
simonresch
Metadata
Metadata
Assignees
Labels
No labels