WARNING: no interesting inputs were found so far. Is the code instrumented for coverage?

[Changochen]

Thanks for creating such an awesome tool!

I have the problem trying to fuzz file-type as a test for fuzzing async function.

My harness FuzzTarget.js:

import {fileTypeFromBuffer} from 'file-type';

export async function fuzz(data /*: Buffer */) {
       const fuzzerData = data.toString();
       return await fileTypeFromBuffer(Buffer.from(fuzzerData));
}

package.json:

{
  "devDependencies": {
    "@jazzer.js/core": "^1.4.0"
  },
  "dependencies": {
    "file-type": "^18.2.1"
  },
  "type": "module"
}

Running and the result is:

# npx jazzer FuzzTarget
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 574878024
INFO: Loaded 1 modules   (512 inline 8-bit counters): 512 [0x7ffff4f22010, 0x7ffff4f22210),
INFO: Loaded 1 PC tables (512 PCs): 512 [0x7fffdefff010,0x7fffdf001010),
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: A corpus is not provided, starting from an empty corpus
#2      INITED exec/s: 0 rss: 122Mb
WARNING: no interesting inputs were found so far. Is the code instrumented for coverage?
This may also happen if the target rejected all inputs we tried so far
#65536  pulse  corp: 1/1b lim: 652 exec/s: 32768 rss: 224Mb
#131072 pulse  corp: 1/1b lim: 1300 exec/s: 32768 rss: 226Mb

I tried to write

export function fuzz_promise(data /*: Buffer */) {
       const fuzzerData = data.toString();
       return await fileTypeFromBuffer(Buffer.from(fuzzerData));
}

Which doesn't work.

So I wonder why there is no coverage found. If the code is instrumented, it should not find no interesting inputs.

Thanks!

[0xricksanchez]

Hi @Changochen, thanks for being patient. I just managed to look into the issue at hand here.
I started with a basic reproducer.

This was my fuzz.js:

// fuzz.js
const { fileTypeFromBuffer } = require("file-type");

/**
 * @param { Buffer } data
 */
module.exports.fuzz = function(data) {
	const fuzzData = data.toString();
	return fileTypeFromBuffer(Buffer.from(fuzzData));
};

This is the package.json I used:

{
  "name": "ftype-fuzz",
  "version": "1.0.0",
  "description": "",
  "main": "fuzz.js",
  "dependencies": {
    "file-type": "^18.3.0"
  },
  "scripts": {
    "fuzz": "jazzer fuzz -i ftype",
  },
  "devDependencies": {
    "@jazzer.js/core": "file:../../packages/core"
  }
}

Running it:

$ npm i && npm run fuzz
(node:41056) Warning: Accessing non-existent property 'default' of module exports inside circular dependency
(Use `node --trace-warnings ...` to show where the warning was created)

jazzer.js/examples/ftype/node_modules/append-transform/index.js:64
                        hook(module, filename);
   ^
Error [ERR_REQUIRE_ESM]: require() of ES Module jazzer.js/examples/ftype/node_modules/file-type/index.js from jazzer.js/examples/ftype/fuzz.js not supported.
Instead change the require of index.js in jazzer.js/examples/ftype/fuzz.js to a dynamic import() which is available in all CommonJS modul
s.
    at Object.<anonymous> (jazzer.js/examples/ftype/node_modules/append-transform/index.js:64:4)
    at Object.<anonymous> (jazzer.js/examples/ftype/fuzz.js:8:5)
    at Module._compile (jazzer.js/examples/ftype/node_modules/source-map-support/source-map-support.js:568:25)
    at Module.replacementCompile (jazzer.js/examples/ftype/node_modules/append-transform/index.js:60:13)
    at Object.<anonymous> (jazzer.js/examples/ftype/node_modules/append-transform/index.js:64:4)

This showcases the problem, that didn't occur in your case, by writing your fuzz case in ES6 syntax. The npmjs page confirms, that:

This package is a ESM package. Your project needs to be ESM too. [Read more](https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c).

Checking the repository also shows that this is a pure ESM module, which we currently don't support (compare: #162, #239). It's on our roadmap to get full ESM support in the foreseeable future! Until then, I recommend writing fuzz tests in CommonJS as it can uncover such an issue at a faster pace.

PS: PR's with better ESM support are welcome ;D

[Changochen]

I see. Thanks for the investigation and the information!

PS: PR's with better ESM support are welcome ;D
I am not famililar with ESM. If I manage to do it I will definitely make a PR!