Open r00tdaemon opened 1 year ago
Custom hooks need to be packaged into separate JAR files (see https://github.com/CodeIntelligenceTesting/jazzer/blob/main/docs/advanced.md#custom-hooks, although this arguably shouldn't be hidden in the last paragraph of that section). The JAR files that contain them are added to the bootstrap class path and if that happens to your fuzz target, FuzzedDataProvider
will be loaded twice in different class loaders.
Could you try whether moving the hook to a separate jar file resolves the issue?
When I tried running the following command with release binary it worked - ~/tools/jazzer --cp=~/tools/jazzer_standalone.jar:build/libs/hooks_examples-uber.jar --target_class=com.example.ExampleFuzzer --custom_hooks=com.example.ExampleFuzzerHooks
I can try with separate jars but since above command worked I'm guessing it might be an issue with the docker image
Hi @r00tdaemon ! We actually went down this root with another prodsec team. Jazzer didn't end up being the right solution for them and they pivoted to our closed source fuzzer. It was easier and they found bugs. Want to discuss more? david[dot]merian [at] code-intelligence[dot]com
When trying to run jazzer docker image by specifying
--custom_hooks
flag it throws the following error.Steps to reproduce -
docker run --rm -v $(pwd):/fuzzing cifuzz/jazzer --cp=<path to jar> --target_class=com.example.ExampleFuzzer --custom_hooks=com.example.ExampleFuzzerHooks
If you run the same command without
--custom_hooks
flag it works fine. I have not tried running jazzer with release binary