| // Copyright 2021 Code Intelligence GmbH |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| |
| package com.code_intelligence.jazzer.runtime; |
| |
| import com.code_intelligence.jazzer.utils.Utils; |
| import com.github.fmeum.rules_jni.RulesJni; |
| import java.lang.reflect.Executable; |
| import java.nio.charset.Charset; |
| |
| @SuppressWarnings("unused") |
| final public class TraceDataFlowNativeCallbacks { |
| static { |
| // On Windows, we instead statically link the fuzzer callbacks into the driver. |
| if (!System.getProperty("os.name").startsWith("Windows")) { |
| RulesJni.loadLibrary("jazzer_fuzzer_callbacks", TraceDataFlowNativeCallbacks.class); |
| } |
| } |
| |
| // Note that we are not encoding as modified UTF-8 here: The FuzzedDataProvider transparently |
| // converts CESU8 into modified UTF-8 by coding null bytes on two bytes. Since the fuzzer is more |
| // likely to insert literal null bytes, having both the fuzzer input and the reported string |
| // comparisons be CESU8 should perform even better than the current implementation using modified |
| // UTF-8. |
| private static final Charset FUZZED_DATA_CHARSET = Charset.forName("CESU8"); |
| |
| public static native void traceMemcmp(byte[] b1, byte[] b2, int result, int pc); |
| |
| public static void traceStrcmp(String s1, String s2, int result, int pc) { |
| traceMemcmp(encodeForLibFuzzer(s1), encodeForLibFuzzer(s2), result, pc); |
| } |
| |
| public static void traceStrstr(String s1, String s2, int pc) { |
| traceStrstr0(encodeForLibFuzzer(s2), pc); |
| } |
| |
| public static void traceReflectiveCall(Executable callee, int pc) { |
| String className = callee.getDeclaringClass().getCanonicalName(); |
| String executableName = callee.getName(); |
| String descriptor = Utils.getDescriptor(callee); |
| tracePcIndir(Utils.simpleFastHash(className, executableName, descriptor), pc); |
| } |
| |
| public static int traceCmpLongWrapper(long arg1, long arg2, int pc) { |
| traceCmpLong(arg1, arg2, pc); |
| // Long.compare serves as a substitute for the lcmp opcode, which can't be used directly |
| // as the stack layout required for the call can't be achieved without local variables. |
| return Long.compare(arg1, arg2); |
| } |
| |
| // The caller has to ensure that arg1 and arg2 have the same class. |
| public static void traceGenericCmp(Object arg1, Object arg2, int pc) { |
| if (arg1 instanceof CharSequence) { |
| traceStrcmp(arg1.toString(), arg2.toString(), 1, pc); |
| } else if (arg1 instanceof Integer) { |
| traceCmpInt((int) arg1, (int) arg2, pc); |
| } else if (arg1 instanceof Long) { |
| traceCmpLong((long) arg1, (long) arg2, pc); |
| } else if (arg1 instanceof Short) { |
| traceCmpInt((short) arg1, (short) arg2, pc); |
| } else if (arg1 instanceof Byte) { |
| traceCmpInt((byte) arg1, (byte) arg2, pc); |
| } else if (arg1 instanceof Character) { |
| traceCmpInt((char) arg1, (char) arg2, pc); |
| } else if (arg1 instanceof Number) { |
| traceCmpLong(((Number) arg1).longValue(), ((Number) arg2).longValue(), pc); |
| } else if (arg1 instanceof byte[]) { |
| traceMemcmp((byte[]) arg1, (byte[]) arg2, 1, pc); |
| } |
| } |
| |
| /* trace-cmp */ |
| public static native void traceCmpInt(int arg1, int arg2, int pc); |
| public static native void traceConstCmpInt(int arg1, int arg2, int pc); |
| public static native void traceCmpLong(long arg1, long arg2, int pc); |
| public static native void traceSwitch(long val, long[] cases, int pc); |
| /* trace-div */ |
| public static native void traceDivInt(int val, int pc); |
| public static native void traceDivLong(long val, int pc); |
| /* trace-gep */ |
| public static native void traceGep(long val, int pc); |
| /* indirect-calls */ |
| public static native void tracePcIndir(int callee, int caller); |
| |
| public static native void handleLibraryLoad(); |
| |
| private static byte[] encodeForLibFuzzer(String str) { |
| // libFuzzer string hooks only ever consume the first 64 bytes, so we can definitely cut the |
| // string off after 64 characters. |
| return str.substring(0, Math.min(str.length(), 64)).getBytes(FUZZED_DATA_CHARSET); |
| } |
| |
| private static native void traceStrstr0(byte[] needle, int pc); |
| } |