BREAKING feat: use mutation framework for single-byte[] fuzz tests

Author: oetr

src/main/java/com/code_intelligence/jazzer/driver/FuzzTargetRunner.java

@@ -140,7 +140,7 @@ public final class FuzzTargetRunner {
     useMutatorFramework =
         Opt.mutatorFramework.get()
             && Opt.autofuzz.get().isEmpty()
-            && !(fuzzTarget.usesPrimitiveByteArray() || fuzzTarget.usesFuzzedDataProvider());
+            && !fuzzTarget.usesFuzzedDataProvider();
 
     useFuzzedDataProvider = fuzzTarget.usesFuzzedDataProvider();
     if (!useFuzzedDataProvider && IS_ANDROID) {

src/main/java/com/code_intelligence/jazzer/mutation/mutator/lang/PrimitiveArrayMutatorFactory.java

@@ -73,6 +73,8 @@ public Optional<SerializingMutator<?>> tryCreate(
   public static final class PrimitiveArrayMutator<T> extends SerializingMutator<T> {
     private static final int DEFAULT_MIN_LENGTH = 0;
     private static final int DEFAULT_MAX_LENGTH = 1000;
+    // This default is chosen to match libFuzzer's default max length for byte arrays.
+    private static final int DEFAULT_BYTE_ARRAY_MAX_LENGTH = 4096;
     private static final Charset FUZZED_DATA_CHARSET = Charset.forName("CESU-8");
     private long minRange;
     private long maxRange;
@@ -216,7 +218,12 @@ private void extractRange(AnnotatedType type) {
     private void extractLength(AnnotatedType type) {
       Optional<WithLength> withLength = Optional.ofNullable(type.getAnnotation(WithLength.class));
       minLength = withLength.map(WithLength::min).orElse(DEFAULT_MIN_LENGTH);
-      maxLength = withLength.map(WithLength::max).orElse(DEFAULT_MAX_LENGTH);
+      // Different default max lengths for byte[] and other primitive arrays to match libFuzzer.
+      int defaultMaxLength =
+          type.getType().getTypeName().equals("byte")
+              ? DEFAULT_BYTE_ARRAY_MAX_LENGTH
+              : DEFAULT_MAX_LENGTH;
+      maxLength = withLength.map(WithLength::max).orElse(defaultMaxLength);
     }
 
     private AnnotatedType convertWithLength(AnnotatedType type, AnnotatedType newType) {