Hang directory populated with two non-hangs

[floyd-fuh]

Hi Rohan,

When I was running the AFL tutorial of JQF and simply replaced the PNG parsing with GIF parsing, feeding afl/testcases/images/gif/not_kitty.gif, I found several uncaught exceptions (attached, haven't reported them yet, feel free if you feel like it). So far so good, here are the 4 gif images:

However, at one point AFLs UI got a little stuck and soon after the hang counter went up 1. A little later another hang was found.

However, after running the hangs with either jqf-repro or a simple Java program that does the same as the driver, both did not result in a hang. One of both resulted in a "crash" (exception), the other was ok and did not result in any result (just ran through).

Do you have any idea what could cause it that hangs really occur (the UI is frozen for a short period) but the hang directory contains the wrong files? Could you try to reproduce?

In general I think the "hang" findings are very important for Java programs. While exceptions ("crashes") are good for code robustness, hangs usually indicate a more severe problem that might lead to denial of service issues.

cheers,
floyd

[rohanpadhye]

Hi floyd,

Feel free to report the crashes if they are previously unknown. You can send a PR to add trophies to the README with your name next to them.

As for hangs vs. crashes, in most programs the hangs are legit. We've found reliably hangs in Maven and Closure. However, these programs are much nicer in that they have clean entry points with usually deterministic behavior.

On the other hand, the ImageIO parsers in the JDK are really archaic pieces of code in the com.sun or java.awt package. I wouldn't be surprised if these tests were in fact non-deterministic, due to dependence on static class-level data structures. In fact, if I remember correctly, whenever I fuzzed the ImageIO library, I would see some GUI frames temporarily spring up on my desktop because java.awt was being loaded. It is also possible that JQF+AFL considers an input as a "hang" because the program paused for a long time during a particularly bad GC cycle. In general, the only solution in such cases is to simply repro the inputs and validate if there is actually a bug to be found.

Please let me know if you find some surprising issues with JQF when fuzzing something more stable, like Apache Commons, Tika, Ant, Maven, etc.

[floyd-fuh]

Ok, I see, so nothing we can do here for the moment.

I did find more interesting crashes, especially a OOM in a very low level API of a third-party library... I'll let you know once I've finished the reporting and it is fixed.