Skip to content

Autofuzz generates invalid code for multi-dimensional array #1026

@Marcono1234

Description

@Marcono1234

Description

Originally mentioned in #1024 (comment)

Autofuzz generates invalid code for multi-dimensional arrays such as int[][]. The Jazzer code uses Class#getName during code generation, however for arrays that uses the JVM type descriptor (e.g. [I), which is not valid in the generated Java code:

String.format("new %s[]{", type.getComponentType().getName()), ", ", "}");

This could be solved by using Class#getTypeName which returns the desired format, however its documentation makes no guarantees about the output. So it might be safer to create a custom method which produces the desired type string.

Reproduction steps

  1. Create a dummy Java class which takes a multi-dimensional array as input
    package example;
    
    public class Test {
        public Test(int[][] i) {
            if (i != null && i.length > 3) throw new RuntimeException();
        }
    }
  2. Compile that file and package the compiled file (example/Test.class) in a JAR (e.g. example.jar)
  3. Run Autofuzz
    ./jazzer --cp=example.jar --autofuzz="example.Test::new"
    ℹ️ This should detect a crash and generate a reproducer file Crash_....java
  4. Inspect the reproducer file Crash_....java
    ❌ Bug: The generated reproducer contains invalid Java code new example.Test(new [I[]{...}); (note the [I)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions