From 98b44a17abccf5ddedc56b1fbcea6cbed62b9397 Mon Sep 17 00:00:00 2001
From: Fabian Meumertzheim <meumertzheim@code-intelligence.com>
Date: Sun, 30 May 2021 09:35:40 +0200
Subject: Fix Jazzer agent lookup

If Jazzer is imported as an external workspace from another Bazel
workspace, the runfiles path of the agent is
../jazzer/agent/jazzer_agent_deploy.jar rather than
agent/jazzer_agent_deploy.jar. Since the first path applies more
generally, we switch to it, but perform a check for a Bazel env variable
to prevent loading agents from potentially untrusted sibling dirs.
---
 driver/jvm_tooling.cpp | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

(limited to 'driver')

diff --git a/driver/jvm_tooling.cpp b/driver/jvm_tooling.cpp
index fee54377..4264850e 100644
--- a/driver/jvm_tooling.cpp
+++ b/driver/jvm_tooling.cpp
@@ -70,7 +70,7 @@ DEFINE_string(
 DECLARE_bool(hooks);
 
 namespace {
-constexpr auto kInstrumentorAgentBazelDir = "agent";
+constexpr auto kInstrumentorAgentBazelDir = "../jazzer/agent";
 constexpr auto kAgentFileName = "jazzer_agent_deploy.jar";
 constexpr const char kExceptionUtilsClassName[] =
     "com/code_intelligence/jazzer/runtime/ExceptionUtils";
@@ -89,29 +89,28 @@ std::string dirFromFullPath(const std::string &path) {
 // getInstrumentorAgentPath searches for the fuzzing instrumentation agent and
 // returns the location if it is found. Otherwise it calls exit(0).
 std::string getInstrumentorAgentPath(const std::string &executable_path) {
-  // user provided agent location takes precedence
+  // User provided agent location takes precedence.
   if (!FLAGS_agent_path.empty()) {
     if (std::ifstream(FLAGS_agent_path).good()) return FLAGS_agent_path;
     LOG(ERROR) << "Could not find " << kAgentFileName << "in \""
                << FLAGS_agent_path << "\"";
     exit(0);
   }
-
-  {
-    // first check if we are running inside the bazel tree
+  // First check if we are running inside the Bazel tree and use the agent
+  // runfile. This requires a Bazel env variable to be defined as loading an
+  // agent from a sibling directory may not be safe in e.g. download folders.
+  if (std::getenv("BUILD_WORKING_DIRECTORY") != nullptr) {
     auto bazel_path = absl::StrFormat("%s%c%s", kInstrumentorAgentBazelDir,
                                       kPathSeparator, kAgentFileName);
     if (std::ifstream(bazel_path).good()) return bazel_path;
   }
 
-  {
-    // if the agent is not in the bazel path we look next to the
-    // libfuzzer_runner binary
-    const auto dir = dirFromFullPath(executable_path);
-    auto agent_path =
-        absl::StrFormat("%s%c%s", dir, kPathSeparator, kAgentFileName);
-    if (std::ifstream(agent_path).good()) return agent_path;
-  }
+  // If the agent is not in the bazel path we look next to the jazzer_driver
+  // binary.
+  const auto dir = dirFromFullPath(executable_path);
+  auto agent_path =
+      absl::StrFormat("%s%c%s", dir, kPathSeparator, kAgentFileName);
+  if (std::ifstream(agent_path).good()) return agent_path;
   LOG(ERROR) << "Could not find " << kAgentFileName
              << ". Please provide "
                 "the pathname via the --agent_path flag.";
-- 
cgit v1.2.3