Getting WrongMethodTypeException from Jazzer, what does it mean?

[centic9]

I am trying to create a Fuzz Target for Apache POI as part of oss-fuzz, but when running the setup locally, I get the following exception which I cannot explain.

Fuzzing Apache POI with the same fuzz target in a standalone project works fine.

Only when I build and run the Docker-based fuzzing via oss-fuzz, I get this exception.

Is this a problem in Jazzer? Or does this indicate some mismatch in provided jars/dependencies?

INFO: Instrumented org.w3c.dom.Attr (took 0 ms, size +0%)
INFO: Instrumented org.apache.poi.openxml4j.opc.PackagingURIHelper (took 9 ms, size +34%)

== Java Exception: java.lang.ExceptionInInitializerError
        at org.apache.poi.openxml4j.opc.internal.ContentTypeManager.parseContentTypesFile(ContentTypeManager.java:411)
        at org.apache.poi.openxml4j.opc.internal.ContentTypeManager.<init>(ContentTypeManager.java:102)
        at org.apache.poi.openxml4j.opc.internal.ZipContentTypeManager.<init>(ZipContentTypeManager.java:53)
        at org.apache.poi.openxml4j.opc.ZipPackage.getPartsImpl(ZipPackage.java:282)
        at org.apache.poi.openxml4j.opc.OPCPackage.getParts(OPCPackage.java:743)
        at org.apache.poi.openxml4j.opc.OPCPackage.open(OPCPackage.java:315)
        at org.apache.poi.xssf.usermodel.XSSFWorkbookFactory.create(XSSFWorkbookFactory.java:97)
        at org.apache.poi.xssf.usermodel.XSSFWorkbookFactory.create(XSSFWorkbookFactory.java:36)
        at org.apache.poi.ss.usermodel.WorkbookFactory.lambda$create$2(WorkbookFactory.java:224)
        at org.apache.poi.ss.usermodel.WorkbookFactory.wp(WorkbookFactory.java:329)
        at org.apache.poi.ss.usermodel.WorkbookFactory.create(WorkbookFactory.java:224)
        at org.apache.poi.ss.usermodel.WorkbookFactory.create(WorkbookFactory.java:185)
        at POIFuzzer.fuzzAny(POIFuzzer.java:186)
        at POIFuzzer.fuzzerTestOneInput(POIFuzzer.java:48)
Caused by: java.lang.invoke.WrongMethodTypeException: cannot convert MethodHandle(String,String,String)String to (Object,Object)Object
        at java.base/java.lang.invoke.MethodHandle.asTypeUncached(MethodHandle.java:881)
        at java.base/java.lang.invoke.MethodHandle.asType(MethodHandle.java:866)
        at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:729)
        at com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal(RegexInjection.kt:126)
        at com.code_intelligence.jazzer.sanitizers.RegexInjection.patternHook(RegexInjection.kt:101)
        at org.apache.poi.openxml4j.opc.PackagePartName.throwExceptionIfPartNameHaveInvalidSegments(PackagePartName.java:245)
        at org.apache.poi.openxml4j.opc.PackagePartName.throwExceptionIfInvalidPartUri(PackagePartName.java:186)
        at org.apache.poi.openxml4j.opc.PackagePartName.<init>(PackagePartName.java:82)
        at org.apache.poi.openxml4j.opc.PackagingURIHelper.createPartName(PackagingURIHelper.java:481)
        at org.apache.poi.openxml4j.opc.PackagingURIHelper.<clinit>(PackagingURIHelper.java:134)
        ... 14 more

[centic9]

Local testing was with v0.10.0, it seems RegexInjection is a recent addition, so maybe this a regression in recent changes?

[fmeum]

You are right, this was a regression introduced by the new bug detector for regex injections. It has been fixed in efa7ac3 and since OSS-Fuzz uses Jazzer from main, the fix should already be used there. Could you try running infra/helper.py build_image <...> and confirming the prompt to pull the latest version of the base images? That should pull in the fix.

[centic9]

Thanks, yes, updating the base docker-image removed this error.