Reland "[infra] Update Jazzer to v0.17.1" (#10537)"

[jonathanmetzman]

This reverts commit cac7ccd.

[jonathanmetzman]

/gcbrun trial_build.py jvm --sanitizer coverage address undefined

[jonathanmetzman]

CC @fmeum

[fmeum]

@jonathanmetzman The current failure looks like a flake (network issue), could you retrigger it?

[jonathanmetzman]

/gcbrun trial_build.py jvm --sanitizer coverage address undefined

[jonathanmetzman]

Failures:

xnio-api fuzzing
struts fuzzing
jxls fuzzing
httpcomponents-core fuzzing
jose4j coverage
hdrhistogram fuzzing
closure-compiler fuzzing
apache-axis2 fuzzing
jose4j coverage
jackson-dataformat-xml coverage
jackson-dataformats-text coverage
httpcomponents-client coverage
bc-java coverage

[fmeum]

@jonathanmetzman Does this list only include projects that build successfully on main?

[DavidKorczynski]

A number of them are failing, but not all e.g. bc-java. See here https://introspector.oss-fuzz.com/indexing-overview where you can search for "jvm" in the table -- which should give a nice overview on which currently fail coverage on master

[jonathanmetzman]

@jonathanmetzman Does this list only include projects that build successfully on main?

It's supposed to. It's also from yesterday. I usually look at https://oss-fuzz-build-logs.storage.googleapis.com/index.html to tall

[DavidKorczynski]

It's supposed to.

of the above list closure-compiler, struts and jxls are failing in coverage builds on master -- and they've not had a successful coverage build yet as reported by https://oss-fuzz-build-logs.storage.googleapis.com/index.html

[fmeum]

I tested the listed projects locally:

• xnio-api: passes
• jose4j: passes
• struts: fails in apt-get, seems unrelated
• jxls: has a regular finding in check_build
• hdrhistogram: has a regular finding in check_build
• closure-compiler: failure is expected as rules_fuzzing will need to be updated to account for this Jazzer update. Since it runs OSS-Fuzz in CI, I can only do this after merging this PR. I have a draft PR ready with the update.
• apache-axi2 and httpcomponents-core trigger the new SSRF bug detector in check_build. I allowlisted the host and port they attempt to connect to, which gets check_build to pass with [java] Allowlist SSRF detector false positives #10550.

The coverage build failures I either couldn't reproduce or they seemed unrelated.

@jonathanmetzman Could you merge #10550 into the reland PR?

Should I look into fixing any of the remaining issues? Especially with the regular findings during check_build I lack knowledge of the projects to determine how to best ignore them without rendering the fuzzer less effective.