Package com.code_intelligence.jazzer.mutation.annotation

Annotation Interface ValuePool

@Target({METHOD,TYPE_USE})
@Retention(RUNTIME)
@IgnoreRecursiveConflicts
public @interface ValuePool

Provides values to user-selected types that will be used during mutation.

This annotation can be applied to fuzz test methods and any parameter type or subtype. By default, this annotation is propagated to all nested subtypes unless specified otherwise via the constraint() attribute.

Example usage:

 public class MyFuzzTargets {

   static Stream<?> valuesVisibleByAllArgumentMutators() {
     return Stream.of("example1", "example2", "example3", 1232187321, -182371);
   }

   static Stream<?> valuesVisibleOnlyByAnotherInput() {
     return Stream.of("code-intelligence.com", "secret.url.1082h3u21ibsdsazuvbsa.com");
   }

   @ValuePool("valuesVisibleByAllArgumentMutators")
   @FuzzTest
   public void fuzzerTestOneInput(String input, @ValuePool("valuesVisibleOnlyByAnotherInput") String anotherInput) {
     // Fuzzing logic here
   }
 }
 

In this example, the mutator for the String parameter input of the fuzz test method fuzzerTestOneInput will be using the values returned by valuesVisibleByAllArgumentMutators method during mutation, while the mutator for String anotherInput will use values from both methods: from the method-level ValuePool annotation that uses valuesVisibleByAllArgumentMutators and the parameter-level ValuePool annotation that uses valuesVisibleOnlyByAnotherInput.

Optional Element Summary

Optional Elements

Modifier and Type	Optional Element	Description
String	constraint	Defines the scope of the annotation.
String[]	files	Specifies glob patterns matching files that should be provided as byte[] to the annotated type.
int	maxMutations	If the mutator selects a value from this ValuePool, it will perform up to maxMutations additional mutations on the selected value.
double	p	This ValuePool will be used with probability p by the mutator responsible for fitting types.
String[]	value	Specifies supplier methods that generate values for fuzzing the annotated method or type.

Element Details

value

String[] value

Specifies supplier methods that generate values for fuzzing the annotated method or type. The specified supplier methods must be static and return a Stream<?> of values. The values don't need to match the type of the annotated method or parameter. The mutation framework will extract only the values that are compatible with the target type.

Suppliers in the fuzz test class can be referenced by their method name, while suppliers in other classes must be referenced by their fully qualified method name (e.g. com.example.MyClass#mySupplierMethod), or for nested classes: com.example.OuterClass$InnerClass#mySupplierMethod.

Default:

{}

files

String[] files

Specifies glob patterns matching files that should be provided as byte[] to the annotated type. The syntax follows closely to Java's PathMatcher "glob:" syntax.

Relative glob patterns are resolved against the working directory.

Note: Patterns that start with { or [ are treated as relative to the working directory.

Examples:

• *.jpeg - matches all jpegs in the working directory
• **.xml - matches all xml files recursively
• src/test/resources/dict/*.txt - matches txt files in a specific directory
• /absolute/path/to/some/directory/** - matches all files in an absolute path recursively
• {"*.jpg", "**.png"} - matches all jpg in the working directory, and png files recursively

Default:

{}

p

double p

This ValuePool will be used with probability p by the mutator responsible for fitting types.

Default:

0.1

maxMutations

int maxMutations

If the mutator selects a value from this ValuePool, it will perform up to maxMutations additional mutations on the selected value.

Default:

1

constraint

String constraint

Defines the scope of the annotation. Possible values are defined in PropertyConstraint. By default, it's RECURSIVE.

Default:

"JAZZER_PROPERTY_CONSTRAINT_RECURSIVE"