Passing coverage information back to libfuzzer

[TheCoryBarker]

Hi, I was hoping someone could help me understand how CoverageMap.recordCoverage(final int id) passes back the covered edges information back to libFuzzer. I see the line below at overageMap.recordCoverage:

UNSAFE.putByte(address, (byte) (counter == -1 ? 1 : counter + 1));

how does that information get to libFuzzer?

Thank you

[fmeum]

The Java part of the coverage instrumentation just uses Unsafe to write into a native memory segment. The other half is in https://github.com/CodeIntelligenceTesting/jazzer/blob/main/driver/src/main/native/com/code_intelligence/jazzer/driver/coverage_tracker.cpp, which registers new chunks of this segment with libFuzzer as needed via __sanitizer_cov_8bit_counters_init and __sanitizer_cov_pcs_init.

[TheCoryBarker]

I see, thank you Fabian