Add fuzz tests to endpoints VM

Author: mtdowling

.github/workflows/fuzz-testing.yml

@@ -53,6 +53,12 @@ jobs:
         run: |
           ./gradlew fuzz -Pfuzz.maxDuration=4h --stacktrace
 
+      - name: Run rules engine bytecode fuzz tests
+        env:
+          JAZZER_FUZZ: "1"
+        run: |
+          ./gradlew :client:client-rulesengine:test --tests "*FuzzTest*" -Djazzer.max_duration=1h --stacktrace
+
       - name: Save fuzz corpus cache
         uses: actions/cache/save@v5
         if: always()

client/client-rulesengine/build.gradle.kts

@@ -16,4 +16,12 @@ dependencies {
     testImplementation(project(":aws:client:aws-client-awsjson"))
     testImplementation(project(":client:dynamic-client"))
     testImplementation(project(":aws:client:aws-client-rulesengine"))
+
+    // Jazzer for fuzz testing
+    testImplementation(libs.jazzer.junit)
+    testImplementation(libs.jazzer.api)
+}
+
+tasks.test {
+    maxHeapSize = "2g"
 }

client/client-rulesengine/src/main/java/software/amazon/smithy/java/client/rulesengine/BytecodeDisassembler.java

@@ -207,6 +207,14 @@ String disassemble() {
     }
 
     private void disassembleSection(StringBuilder s, int startOffset, String indent) {
+        try {
+            disassembleSectionUnsafe(s, startOffset, indent);
+        } catch (IndexOutOfBoundsException | IllegalArgumentException | IllegalStateException e) {
+            s.append(indent).append("(error disassembling section: ").append(e.getMessage()).append(")\n");
+        }
+    }
+
+    private void disassembleSectionUnsafe(StringBuilder s, int startOffset, String indent) {
         BytecodeWalker walker = new BytecodeWalker(bytecode.getBytecode(), startOffset);
 
         if (!walker.hasNext()) {

client/client-rulesengine/src/main/java/software/amazon/smithy/java/client/rulesengine/BytecodeEvaluator.java

@@ -102,14 +102,25 @@ private Object[] resizeTempArray(int requiredSize) {
         return tempArray;
     }
 
-    @SuppressWarnings("unchecked")
     private Object run(int start) {
         pc = start;
 
         var instructions = bytecode.getBytecode();
         var functions = bytecode.getFunctions();
         var constantPool = bytecode.getConstantPool();
 
+        try {
+            return runLoop(instructions, functions, constantPool);
+        } catch (ArrayIndexOutOfBoundsException | ClassCastException | NullPointerException e) {
+            throw new RulesEvaluationError(
+                    "Bytecode execution error at pc=" + pc + ": " + e.getMessage(),
+                    pc);
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    private Object runLoop(byte[] instructions, RulesFunction[] functions, Object[] constantPool) {
+
         while (pc < instructions.length) {
             int opcode = instructions[pc++] & 0xFF;
             switch (opcode) {

client/client-rulesengine/src/main/java/software/amazon/smithy/java/client/rulesengine/BytecodeWalker.java

@@ -55,18 +55,31 @@ public boolean advance() {
         if (length < 0) {
             return false; // Unknown opcode
         }
-        pc += length;
+        int next = pc + length;
+        if (next > code.limit()) {
+            return false; // Instruction extends past end
+        }
+        pc = next;
         return true;
     }
 
     public int getInstructionLength() {
         if (!hasNext()) {
             return -1;
         }
-        return getInstructionLength(code.get(pc));
+        int length = getInstructionLength(code.get(pc));
+        // Validate the full instruction fits within the buffer
+        if (length > 0 && pc + length > code.limit()) {
+            return -1;
+        }
+        return length;
     }
 
     public int getOperandCount() {
+        // If the instruction doesn't fully fit in the buffer, report 0 operands
+        if (getInstructionLength() < 0) {
+            return 0;
+        }
         byte opcode = currentOpcode();
         return switch (opcode) {
             case Opcodes.NOT, Opcodes.ISSET, Opcodes.LIST0, Opcodes.LIST1, Opcodes.LIST2, Opcodes.MAP0, Opcodes.MAP1,

client/client-rulesengine/src/main/java/software/amazon/smithy/java/client/rulesengine/RulesEngineBuilder.java

@@ -184,6 +184,16 @@ public Bytecode load(byte[] data) {
             throw new IllegalArgumentException("Invalid counts in bytecode header");
         }
 
+        // Validate counts don't exceed what the data can possibly hold.
+        // Each condition/result offset is 4 bytes, each BDD node is 12 bytes.
+        long minRequiredSize = BYTECODE_HEADER_SIZE
+                + (long) conditionCount * 4
+                + (long) resultCount * 4
+                + (long) bddNodeCount * 12;
+        if (minRequiredSize > data.length) {
+            throw new IllegalArgumentException("Bytecode header counts exceed data length");
+        }
+
         // Read offset tables
         int conditionTableOffset = reader.readInt();
         int resultTableOffset = reader.readInt();
@@ -205,18 +215,35 @@ public Bytecode load(byte[] data) {
             throw new IllegalArgumentException("Invalid offsets in bytecode header");
         }
 
+        // Validate that declared counts fit within their respective sections
+        if (conditionTableOffset + (long) conditionCount * 4 > resultTableOffset) {
+            throw new IllegalArgumentException("Condition table overflows into result table");
+        } else if (resultTableOffset + (long) resultCount * 4 > functionTableOffset) {
+            throw new IllegalArgumentException("Result table overflows into function table");
+        } else if (bddTableOffset + (long) bddNodeCount * 12 > constantPoolOffset) {
+            throw new IllegalArgumentException("BDD table overflows into constant pool");
+        }
+
         // Load condition offsets
         reader.offset = conditionTableOffset;
         int[] conditionOffsets = new int[conditionCount];
         for (int i = 0; i < conditionCount; i++) {
-            conditionOffsets[i] = reader.readInt();
+            int offset = reader.readInt();
+            if (offset < 0 || offset >= data.length) {
+                throw new IllegalArgumentException("Condition offset out of bounds: " + offset);
+            }
+            conditionOffsets[i] = offset;
         }
 
         // Load result offsets
         reader.offset = resultTableOffset;
         int[] resultOffsets = new int[resultCount];
         for (int i = 0; i < resultCount; i++) {
-            resultOffsets[i] = reader.readInt();
+            int offset = reader.readInt();
+            if (offset < 0 || offset >= data.length) {
+                throw new IllegalArgumentException("Result offset out of bounds: " + offset);
+            }
+            resultOffsets[i] = offset;
         }
 
         // Load function names and resolve them using this builder's functions

client/client-rulesengine/src/test/java/software/amazon/smithy/java/client/rulesengine/BytecodeEvaluatorFuzzTest.java

@@ -0,0 +1,81 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package software.amazon.smithy.java.client.rulesengine;
+
+import com.code_intelligence.jazzer.junit.FuzzTest;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Fuzz tests for {@link BytecodeEvaluator} — evaluating bytecode with random instruction streams.
+ *
+ * <p>Constructs minimal valid Bytecode objects with fuzz-derived instruction bytes,
+ * then runs the evaluator to check for crash safety.
+ */
+class BytecodeEvaluatorFuzzTest {
+
+    private static final int MAX_FUZZ_INPUT = 512;
+
+    @FuzzTest
+    void fuzzEvaluateCondition(byte[] data) {
+        if (data.length < 1 || data.length > MAX_FUZZ_INPUT) {
+            return;
+        }
+
+        // Build a Bytecode with the fuzz data as the instruction stream and a single condition at offset 0.
+        Bytecode bytecode = new Bytecode(
+                data,
+                new int[] {0}, // one condition at offset 0
+                new int[0],
+                new RegisterDefinition[] {
+                        new RegisterDefinition("p0", false, "default", null, false),
+                        new RegisterDefinition("t0", false, null, null, true)
+                },
+                new Object[] {"a", "b", 1, true, false, null, List.of(), Map.of()},
+                new RulesFunction[0],
+                new int[] {0, 1, -1}, // BDD: condition 0 -> TRUE/FALSE
+                2 // root = node 0
+        );
+
+        BytecodeEvaluator evaluator = new BytecodeEvaluator(bytecode,
+                new RulesExtension[0],
+                RegisterFiller.of(bytecode, Map.of()));
+        evaluator.reset(null, Map.of());
+
+        try {
+            evaluator.test(0);
+        } catch (RulesEvaluationError | IllegalArgumentException ignored) {}
+    }
+
+    @FuzzTest
+    void fuzzEvaluateResult(byte[] data) {
+        if (data.length < 1 || data.length > MAX_FUZZ_INPUT) {
+            return;
+        }
+
+        Bytecode bytecode = new Bytecode(
+                data,
+                new int[0],
+                new int[] {0}, // one result at offset 0
+                new RegisterDefinition[] {
+                        new RegisterDefinition("p0", false, "https://example.com", null, false),
+                        new RegisterDefinition("t0", false, null, null, true)
+                },
+                new Object[] {"https://example.com", "key", "value", 42, true, false},
+                new RulesFunction[0],
+                new int[] {-1, 100_000_000, -1}, // Terminal -> result 0
+                100_000_000);
+
+        BytecodeEvaluator evaluator = new BytecodeEvaluator(bytecode,
+                new RulesExtension[0],
+                RegisterFiller.of(bytecode, Map.of()));
+        evaluator.reset(null, Map.of());
+
+        try {
+            evaluator.resolveResult(0);
+        } catch (RulesEvaluationError | IllegalArgumentException ignored) {}
+    }
+}

client/client-rulesengine/src/test/java/software/amazon/smithy/java/client/rulesengine/BytecodeLoadFuzzTest.java

@@ -0,0 +1,29 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package software.amazon.smithy.java.client.rulesengine;
+
+import com.code_intelligence.jazzer.junit.FuzzTest;
+
+/**
+ * Fuzz tests for loading bytecode from arbitrary byte arrays via {@link RulesEngineBuilder#load(byte[])}.
+ *
+ * <p>This exercises header parsing, offset validation, constant pool deserialization,
+ * register definition loading, BDD node loading, and function resolution.
+ */
+class BytecodeLoadFuzzTest {
+
+    private static final int MAX_FUZZ_INPUT = 2048;
+
+    @FuzzTest
+    void fuzzLoad(byte[] data) {
+        if (data.length > MAX_FUZZ_INPUT) {
+            return;
+        }
+        try {
+            new RulesEngineBuilder().load(data);
+        } catch (IllegalArgumentException | RulesEvaluationError ignored) {}
+    }
+}

client/client-rulesengine/src/test/java/software/amazon/smithy/java/client/rulesengine/BytecodeReaderFuzzTest.java

@@ -0,0 +1,38 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package software.amazon.smithy.java.client.rulesengine;
+
+import com.code_intelligence.jazzer.junit.FuzzTest;
+
+/**
+ * Fuzz tests for {@link BytecodeReader} — constant deserialization and register definition parsing.
+ */
+class BytecodeReaderFuzzTest {
+
+    private static final int MAX_FUZZ_INPUT = 1024;
+
+    @FuzzTest
+    void fuzzReadConstant(byte[] data) {
+        if (data.length > MAX_FUZZ_INPUT) {
+            return;
+        }
+        try {
+            new BytecodeReader(data, 0).readConstant();
+        } catch (IllegalArgumentException ignored) {}
+    }
+
+    @FuzzTest
+    void fuzzReadRegisterDefinitions(byte[] data) {
+        if (data.length < 1 || data.length > MAX_FUZZ_INPUT) {
+            return;
+        }
+        // Use first byte to determine count (1-16)
+        int count = (data[0] & 0x0F) + 1;
+        try {
+            new BytecodeReader(data, 1).readRegisterDefinitions(count);
+        } catch (IllegalArgumentException ignored) {}
+    }
+}

client/client-rulesengine/src/test/java/software/amazon/smithy/java/client/rulesengine/BytecodeWalkerFuzzTest.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package software.amazon.smithy.java.client.rulesengine;
+
+import com.code_intelligence.jazzer.junit.FuzzTest;
+
+/**
+ * Fuzz tests for {@link BytecodeWalker} — walking arbitrary instruction streams.
+ */
+class BytecodeWalkerFuzzTest {
+
+    private static final int MAX_FUZZ_INPUT = 1024;
+
+    @FuzzTest
+    void fuzzWalker(byte[] data) {
+        if (data.length > MAX_FUZZ_INPUT) {
+            return;
+        }
+        try {
+            BytecodeWalker walker = new BytecodeWalker(data);
+            int steps = 0;
+            while (walker.hasNext() && steps++ < 500) {
+                walker.currentOpcode();
+                int count = walker.getOperandCount();
+                for (int i = 0; i < count; i++) {
+                    walker.getOperand(i);
+                }
+                if (walker.isReturnOpcode()) {
+                    break;
+                }
+                if (!walker.advance()) {
+                    break;
+                }
+            }
+        } catch (IllegalArgumentException | IllegalStateException ignored) {}
+    }
+}