Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Java Integration] : Dig up necessary information from the static analysis #547

Merged
merged 7 commits into from
Oct 18, 2022

Conversation

arthurscchan
Copy link
Contributor

Dig up different information from the static analysis and call graph generation for fuzz introspector's further processing.
Also apply test on larger java project.

Referring to Steps 2 - 3 in Issue #536

Signed-off-by: Arthur Chan arthur.chan@adalogics.com

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
@arthurscchan
Copy link
Contributor Author

arthurscchan commented Oct 17, 2022

Sample call graph

--------------------------------------------------
Class #1: Fuzz.TestFuzzer
Class #1 Method #1: <Fuzz.TestFuzzer: void <init>()>
	 > No calls to this method.

	 Total: 0 internal calls.

	 > No calls from this method.

	 Total: 0 external calls.

Class #1 Method #2: <Fuzz.TestFuzzer: void fuzzerTestOneInput(com.code_intelligence.jazzer.api.FuzzedDataProvider)>
	 > No calls to this method.

	 Total: 0 internal calls.

	 > calls <java.lang.Object: void <clinit>()> on Line 27
	 > calls <Function.FunctionTest: void function1()> on Line 28
	 > calls <Function.FunctionTest: void <init>()> on Line 27
	 > calls <java.lang.Object: void <clinit>()> on Line 30
	 > calls <Function.FunctionTest: void function2()> on Line 30

	 Total: 5 external calls.

Class #1 Method #3: <Fuzz.TestFuzzer: void main(java.lang.String[])>
	 > No calls to this method.

	 Total: 0 internal calls.

	 > No calls from this method.

	 Total: 0 external calls.

--------------------------------------------------
Class #2: Function.FunctionTest
Class #2 Method #4: <Function.FunctionTest: void <init>()>
	 > called by <Fuzz.TestFuzzer: void fuzzerTestOneInput(com.code_intelligence.jazzer.api.FuzzedDataProvider)> on Line 27

	 Total: 1 internal calls.

	 > calls <java.lang.Object: void <init>()> on Line 20

	 Total: 1 external calls.

Class #2 Method #5: <Function.FunctionTest: void function1()>
	 > called by <Fuzz.TestFuzzer: void fuzzerTestOneInput(com.code_intelligence.jazzer.api.FuzzedDataProvider)> on Line 28

	 Total: 1 internal calls.

	 > calls <java.lang.System: void <clinit>()> on Line 22
	 > calls <java.io.PrintStream: void println(java.lang.String)> on Line 22
	 > calls <java.lang.Object: void <clinit>()> on Line 22

	 Total: 3 external calls.

Class #2 Method #6: <Function.FunctionTest: void function2()>
	 > called by <Fuzz.TestFuzzer: void fuzzerTestOneInput(com.code_intelligence.jazzer.api.FuzzedDataProvider)> on Line 30

	 Total: 1 internal calls.

	 > No calls from this method.

	 Total: 0 external calls.

Class #2 Method #7: <Function.FunctionTest: void functionPublicDead()>
	 > No calls to this method.

	 Total: 0 internal calls.

	 > No calls from this method.

	 Total: 0 external calls.

Class #2 Method #8: <Function.FunctionTest: void functionPrivateDead()>
	 > No calls to this method.

	 Total: 0 internal calls.

	 > No calls from this method.

	 Total: 0 external calls.

--------------------------------------------------
Total Edges:9

Showing source class, source methods, target methods, source line number.
Also, because the analysis is based on edges in the graph, so the total of external calls and internal calls to a method could be calculated to determine if a method has been called or has called to another methods. Only method in the analysing scope will be included, in other word, the method with no internal or external calls will only be included if at least one of its siblings method has been connected by edges, or its parent class is being included in the analysing scope.

@arthurscchan arthurscchan marked this pull request as ready for review October 17, 2022 17:25
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
@arthurscchan
Copy link
Contributor Author

FunctionTest.java

package Function;

public class FunctionTest {
	public void function1() {
		System.out.println("F1");
	}

	public static void function2() {
		System.out.println("F2");
	}

	public void functionPublicDead() {
		System.out.println("PuD");
	}

	private void functionPrivateDead() {
		System.out.println("PrD");
	}

}

TestFuzzer.java

package Fuzz;

import Function.FunctionTest;
import com.code_intelligence.jazzer.api.FuzzedDataProvider;

public class TestFuzzer {
	public static void fuzzerTestOneInput(FuzzedDataProvider data) {
		int choice = data.consumeInt(0,1);

		if (choice == 0) {
			FunctionTest ft = new FunctionTest();
			ft.function1();
		} else {
			FunctionTest.function2();
		}
	}
}

Copy link
Contributor

@DavidKorczynski DavidKorczynski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
@arthurscchan
Copy link
Contributor Author

arthurscchan commented Oct 18, 2022

Sample result, I am still digging into soot to find a way to get those "null" informations.

filename: "Fuzz.TestFuzzer"
functionConfig:
  listName: "All functions"
  functionElements:
  - functionName: "<init>"
    functionSourceFile: "Fuzz.TestFuzzer"
    linkageType: null
    functionLinenumber: 21
    functionDepth: null
    returnType: "void"
    argCount: 0
    argTypes: []
    constantsTouched: []
    argNames: []
    iCount: null
    edgeCount: 0
    functionReached: []
    functionUses: 0
    branchProfiles: null
    cyclomaticComplexity: null
    bbcount: null
  - functionName: "fuzzerTestOneInput"
    functionSourceFile: "Fuzz.TestFuzzer"
    linkageType: null
    functionLinenumber: 23
    functionDepth: null
    returnType: "void"
    argCount: 1
    argTypes:
    - "com.code_intelligence.jazzer.api.FuzzedDataProvider"
    constantsTouched: []
    argNames: []
    iCount: null
    edgeCount: 5
    functionReached:
    - "<java.lang.Object: void <clinit>()>; Line: 27"
    - "<Function.FunctionTest: void function1()>; Line: 28"
    - "<Function.FunctionTest: void <init>()>; Line: 27"
    - "<java.lang.Object: void <clinit>()>; Line: 30"
    - "<Function.FunctionTest: void function2()>; Line: 30"
    functionUses: 0
    branchProfiles: null
    cyclomaticComplexity: null
    bbcount: null
  - functionName: "main"
    functionSourceFile: "Fuzz.TestFuzzer"
    linkageType: null
    functionLinenumber: 34
    functionDepth: null
    returnType: "void"
    argCount: 1
    argTypes:
    - "java.lang.String[]"
    constantsTouched: []
    argNames: []
    iCount: null
    edgeCount: 0
    functionReached: []
    functionUses: 0
    branchProfiles: null
    cyclomaticComplexity: null
    bbcount: null


---
filename: "Function.FunctionTest"
functionConfig:
  listName: "All functions"
  functionElements:
  - functionName: "<init>"
    functionSourceFile: "Function.FunctionTest"
    linkageType: null
    functionLinenumber: 19
    functionDepth: null
    returnType: "void"
    argCount: 0
    argTypes: []
    constantsTouched: []
    argNames: []
    iCount: null
    edgeCount: 1
    functionReached:
    - "<java.lang.Object: void <init>()>; Line: 20"
    functionUses: 1
    branchProfiles: null
    cyclomaticComplexity: null
    bbcount: null
  - functionName: "function1"
    functionSourceFile: "Function.FunctionTest"
    linkageType: null
    functionLinenumber: 21
    functionDepth: null
    returnType: "void"
    argCount: 0
    argTypes: []
    constantsTouched: []
    argNames: []
    iCount: null
    edgeCount: 3
    functionReached:
    - "<java.lang.System: void <clinit>()>; Line: 22"
    - "<java.io.PrintStream: void println(java.lang.String)>; Line: 22"
    - "<java.lang.Object: void <clinit>()>; Line: 22"
    functionUses: 1
    branchProfiles: null
    cyclomaticComplexity: null
    bbcount: null
  - functionName: "function2"
    functionSourceFile: "Function.FunctionTest"
    linkageType: null
    functionLinenumber: 25
    functionDepth: null
    returnType: "void"
    argCount: 0
    argTypes: []
    constantsTouched: []
    argNames: []
    iCount: null
    edgeCount: 0
    functionReached: []
    functionUses: 1
    branchProfiles: null
    cyclomaticComplexity: null
    bbcount: null
  - functionName: "functionPublicDead"
    functionSourceFile: "Function.FunctionTest"
    linkageType: null
    functionLinenumber: 29
    functionDepth: null
    returnType: "void"
    argCount: 0
    argTypes: []
    constantsTouched: []
    argNames: []
    iCount: null
    edgeCount: 0
    functionReached: []
    functionUses: 0
    branchProfiles: null
    cyclomaticComplexity: null
    bbcount: null
  - functionName: "functionPrivateDead"
    functionSourceFile: "Function.FunctionTest"
    linkageType: null
    functionLinenumber: 33
    functionDepth: null
    returnType: "void"
    argCount: 0
    argTypes: []
    constantsTouched: []
    argNames: []
    iCount: null
    edgeCount: 0
    functionReached: []
    functionUses: 0
    branchProfiles: null
    cyclomaticComplexity: null
    bbcount: null

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
Copy link
Contributor

@DavidKorczynski DavidKorczynski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add licenses where applicable.

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
@DavidKorczynski DavidKorczynski merged commit ea1ed05 into ossf:main Oct 18, 2022
@arthurscchan arthurscchan deleted the call_graph_details branch October 29, 2022 00:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants