Skip to content

Commit

Permalink
Mayhem support
Browse files Browse the repository at this point in the history
Mayhem support
  • Loading branch information
mayhem-bot authored and ForAllSecure Mayhem Bot committed Dec 22, 2023
1 parent fe634f3 commit c9d988b
Show file tree
Hide file tree
Showing 8 changed files with 262 additions and 0 deletions.
57 changes: 57 additions & 0 deletions .github/workflows/ClassFuzzer-mayhem.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
name: Mayhem
on:
push:
pull_request:
workflow_dispatch:
workflow_call:
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build:
name: ${{ matrix.os }} shared=${{ matrix.shared }} ${{ matrix.build_type }}
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest]
shared: [false]
build_type: [Release]
include:
- os: ubuntu-latest
triplet: x64-linux
steps:
- uses: actions/checkout@v2
with:
submodules: recursive
- name: Log in to the Container registry
uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
- name: Build and push Docker image
uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
with:
context: .
file: mayhem/Dockerfile
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Start analysis
uses: forallsecure/mcode-action@v1
with:
mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
args: --image ${{ steps.meta.outputs.tags }} --file mayhem/ClassFuzzer.mayhemfile
--cmd '/out/jazzer_driver --agent_path=/out/jazzer_agent_deploy.jar --cp=/out/javassist.jar::/out
--target_class=ClassFuzzer --jvm_args="-Xmx2048m"' --env LD_LIBRARY_PATH="/usr/lib/jvm/java-15-openjdk-amd64/lib/server":/out
--libfuzzer True
sarif-output: sarif
- name: Upload SARIF file(s)
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: sarif
55 changes: 55 additions & 0 deletions .github/workflows/jazzer_driver-mayhem.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
name: Mayhem
on:
push:
pull_request:
workflow_dispatch:
workflow_call:
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build:
name: ${{ matrix.os }} shared=${{ matrix.shared }} ${{ matrix.build_type }}
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest]
shared: [false]
build_type: [Release]
include:
- os: ubuntu-latest
triplet: x64-linux
steps:
- uses: actions/checkout@v2
with:
submodules: recursive
- name: Log in to the Container registry
uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
- name: Build and push Docker image
uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
with:
context: .
file: mayhem/Dockerfile
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Start analysis
uses: forallsecure/mcode-action@v1
with:
mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
args: --image ${{ steps.meta.outputs.tags }} --cmd /out/jazzer_driver --target
jazzer_driver --file mayhem/jazzer_driver.mayhemfile
sarif-output: sarif
- name: Upload SARIF file(s)
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: sarif
55 changes: 55 additions & 0 deletions mayhem/ClassFuzzer.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
////////////////////////////////////////////////////////////////////////////////

import com.code_intelligence.jazzer.api.FuzzedDataProvider;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.lang.RuntimeException;

import javassist.ClassPool;
import javassist.CtClass;
import javassist.CannotCompileException;
import javassist.NotFoundException;
import java.lang.NullPointerException;


public class ClassFuzzer {
public static void fuzzerTestOneInput(FuzzedDataProvider data) {
ClassPool pool = ClassPool.getDefault();
CtClass cc = null;

try {
cc = pool.makeClass(new ByteArrayInputStream(data.consumeRemainingAsBytes()));
} catch (IOException | RuntimeException e) {
}

try {
cc.getSuperclass();
cc.getNestedClasses();
cc.getClassFile();
cc.getInterfaces();
cc.getDeclaringClass();
cc.getComponentType();
} catch (NotFoundException | NullPointerException e) {
}

try {
cc.toBytecode();
} catch (IOException | NullPointerException | CannotCompileException e) {
}
}
}
8 changes: 8 additions & 0 deletions mayhem/ClassFuzzer.mayhemfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
project: PROJECT
target: ClassFuzzer
cmds:
- cmd: /out/jazzer_driver --agent_path=/out/jazzer_agent_deploy.jar --cp=/out/javassist.jar::/out --target_class=ClassFuzzer --jvm_args="-Xmx2048m"
env:
LD_LIBRARY_PATH: '"/usr/lib/jvm/java-15-openjdk-amd64/lib/server":/out'
timeout: 50
libfuzzer: true
32 changes: 32 additions & 0 deletions mayhem/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
################################################################################

FROM gcr.io/oss-fuzz-base/base-builder-jvm

RUN curl -L https://downloads.apache.org/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.zip -o maven.zip && unzip maven.zip -d $SRC/maven && rm -rf maven.zip

ENV MVN $SRC/maven/apache-maven-3.6.3/bin/mvn

COPY . javassist
RUN rm -rf javassist/mayhem

COPY mayhem/build.sh $SRC/
COPY mayhem/ClassFuzzer.java $SRC/
WORKDIR $SRC/javassist

ENV FUZZING_LANGUAGE=jvm SANITIZER=address FUZZING_ENGINE=libfuzzer
RUN compile
RUN chmod +x /out/jazzer_driver
Empty file added mayhem/Dockerfile.dockerignore
Empty file.
51 changes: 51 additions & 0 deletions mayhem/build.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
#!/bin/bash -eu
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
################################################################################


MAVEN_ARGS="-Djavac.src.version=15 -Djavac.target.version=15 -DskipTests"
$MVN package org.apache.maven.plugins:maven-shade-plugin:3.2.4:shade $MAVEN_ARGS
CURRENT_VERSION=$($MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate \
-Dexpression=project.version -q -DforceStdout)
cp "target/javassist-$CURRENT_VERSION.jar" $OUT/javassist.jar

ALL_JARS="javassist.jar"

# The classpath at build-time includes the project jars in $OUT as well as the
# Jazzer API.
BUILD_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "$OUT/%s:"):$JAZZER_API_PATH

# All .jar and .class files lie in the same directory as the fuzzer at runtime.
RUNTIME_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "\$this_dir/%s:"):\$this_dir

for fuzzer in $(find $SRC -name '*Fuzzer.java'); do
fuzzer_basename=$(basename -s .java $fuzzer)
javac -cp $BUILD_CLASSPATH $fuzzer
cp $SRC/$fuzzer_basename.class $OUT/


# Create an execution wrapper that executes Jazzer with the correct arguments.
echo "#!/bin/sh
# LLVMFuzzerTestOneInput for fuzzer detection.
this_dir=\$(dirname \"\$0\")
LD_LIBRARY_PATH=\"$JVM_LD_LIBRARY_PATH\":\$this_dir \
\$this_dir/jazzer_driver --agent_path=\$this_dir/jazzer_agent_deploy.jar \
--cp=$RUNTIME_CLASSPATH \
--target_class=$fuzzer_basename \
--jvm_args=\"-Xmx2048m\" \
\$@" > $OUT/$fuzzer_basename
chmod u+x $OUT/$fuzzer_basename
done
4 changes: 4 additions & 0 deletions mayhem/jazzer_driver.mayhemfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
project: PROJECT
target: jazzer_driver
cmds:
- cmd: /out/jazzer_driver

0 comments on commit c9d988b

Please sign in to comment.