How to provide initial corpus when using FuzzedDataProvider

[centic9]

Hi,

I have some fuzzing projects where I want to use a FuzzedDataProvider to allow fuzzing to vary the code-paths fully by using all sorts of combinations of options.

The code parses some string-input where I would like to ensure that none of the possible inputs causes issues in the code.

However using FuzzedDataProvider means that corpus documents have a binary format, so I would expect that simply providing an initial corpus of strings as simple input documents is not working.

If this is the case, is there a way to provide a good initial corpus for some of the strings that are returned in the various method-calls to FuzzedDataProvider?

[fmeum]

This is a problem that is more or less inherent to the design of FuzzedDataProvider as a generator rather than a mutator. There are ways to make the input format more readable, but all of them would result in breaking changes.

Instead, we are working on a new mutator that operates directly on the parameter types of your fuzz test (see https://github.com/CodeIntelligenceTesting/jazzer/blob/main/tests/src/test/java/com/example/ExperimentalMutatorFuzzer.java for an example).

[centic9]

Thanks for the explanation!

Is there a way to programmatically create the matching binary by kind of doing the "reverse" to the "consume" actions to produce binary files suitable as initial corpus?

[fmeum]

Yes, the format is pretty much stable at this point (although of course an implementation detail and undocumented), so this would be possible.

I don't think that we would be able to work on this though given our focus on the new mutator, which avoids this problem on a conceptual level and even allows you to specify corpus entries as Java objects from code.

[ghost]

Hi @centic9 ! Thanks for your question, and especially, finding this edge case for the corpus in Jazzer. Did you test ExperimentalMutatorFuzzer? How did ExperimentalMutatorFuzzer work for you?

I'm very curious to learn more. Happy to discuss further "offline" with you if you prefer. My email: david[dot]merian[at]code-intelligence[dot]com

Cheers,
Dave Merian

[centic9]

| How did ExperimentalMutatorFuzzer work for you?

@David-Merian-CI Thanks for the suggestion, but I am not sure how the functionality from that example would be useful for producing a good "seed" corpus of input-files?

It's a nice feature to be able to have more complex values be sent in, but it does not solve how to provide a good set of initial "seed" documents.

In some of my fuzzing tests with complex input-formats, having a good initial seed corpus is crucial to get Jazzer across some "hurdles" which it cannot detect with pure coverage-guided fuzzing alone.

As far as I see it is not easy to provide seed documents with any of the "non-byte-array" ways of fuzzing.

[ghost]

Thank you for the feedback, @centic9 ! We "archived" Jazzer a few months ago (long story). Consequently, the version available here with ExperimentalMutatorFuzzer is halfway done. The offline /closed source version of ExperimentalMutatorFuzzer is more stable and battle tested.

Nonetheless, I'd be happy to give you engineering support and see if we can't/have already solved the seed corpus issue. I'm fairly confident we have.

Would you want to probe this? Typically we would need to dedicate 30 to 60 minutes with some discussion and screen sharing.

Can you let me know what you want to do? david.merian[at]code-intelligence[dot]com

Cheers,
Dave Merian