Merge remote-tracking branch 'origin/develop' into breaking

test/tools/ossfuzz/abiV2FuzzerCommon.cpp

@@ -40,3 +40,46 @@ solidity::bytes SolidityCompilationFramework::compileContract(
 	);
 	return obj.bytecode;
 }
+
+bool AbiV2Utility::isOutputExpected(
+	uint8_t const* _result,
+	size_t _length,
+	std::vector<uint8_t> const& _expectedOutput
+)
+{
+	if (_length != _expectedOutput.size())
+		return false;
+
+	return (memcmp(_result, _expectedOutput.data(), _length) == 0);
+}
+
+evmc_message AbiV2Utility::initializeMessage(bytes const& _input)
+{
+	// Zero initialize all message fields
+	evmc_message msg = {};
+	// Gas available (value of type int64_t) is set to its maximum
+	// value.
+	msg.gas = std::numeric_limits<int64_t>::max();
+	msg.input_data = _input.data();
+	msg.input_size = _input.size();
+	return msg;
+}
+
+evmc::result AbiV2Utility::executeContract(
+	EVMHost& _hostContext,
+	bytes const& _functionHash,
+	evmc_address _deployedAddress
+)
+{
+	evmc_message message = initializeMessage(_functionHash);
+	message.destination = _deployedAddress;
+	message.kind = EVMC_CALL;
+	return _hostContext.call(message);
+}
+
+evmc::result AbiV2Utility::deployContract(EVMHost& _hostContext, bytes const& _code)
+{
+	evmc_message message = initializeMessage(_code);
+	message.kind = EVMC_CREATE;
+	return _hostContext.call(message);
+}

test/tools/ossfuzz/abiV2FuzzerCommon.h

@@ -1,14 +1,17 @@
 #pragma once
 
+#include <test/EVMHost.h>
+
 #include <libsolidity/interface/CompilerStack.h>
 
 #include <libyul/AssemblyStack.h>
 
 #include <libsolutil/Keccak256.h>
 
+#include <evmone/evmone.h>
+
 namespace solidity::test::abiv2fuzzer
 {
-
 class SolidityCompilationFramework
 {
 public:
@@ -29,4 +32,36 @@ protected:
 	langutil::EVMVersion m_evmVersion;
 };
 
+struct AbiV2Utility
+{
+	/// Compares the contents of the memory address pointed to
+	/// by `_result` of `_length` bytes to the expected output.
+	/// Returns true if `_result` matches expected output, false
+	/// otherwise.
+	static bool isOutputExpected(
+		uint8_t const* _result,
+		size_t _length,
+		std::vector<uint8_t> const& _expectedOutput
+	);
+	/// Accepts a reference to a user-specified input and returns an
+	/// evmc_message with all of its fields zero initialized except
+	/// gas and input fields.
+	/// The gas field is set to the maximum permissible value so that we
+	/// don't run into out of gas errors. The input field is copied from
+	/// user input.
+	static evmc_message initializeMessage(bytes const& _input);
+	/// Accepts host context implementation, and keccak256 hash of the function
+	/// to be called at a specified address in the simulated blockchain as
+	/// input and returns the result of the execution of the called function.
+	static evmc::result executeContract(
+		EVMHost& _hostContext,
+		bytes const& _functionHash,
+		evmc_address _deployedAddress
+	);
+	/// Accepts a reference to host context implementation and byte code
+	/// as input and deploys it on the simulated blockchain. Returns the
+	/// result of deployment.
+	static evmc::result deployContract(EVMHost& _hostContext, bytes const& _code);
+};
+
 }

test/tools/ossfuzz/abiV2ProtoFuzzer.cpp

@@ -16,89 +16,26 @@
 */
 // SPDX-License-Identifier: GPL-3.0
 
-#include <test/EVMHost.h>
 #include <test/tools/ossfuzz/abiV2FuzzerCommon.h>
 #include <test/tools/ossfuzz/protoToAbiV2.h>
 
-#include <evmone/evmone.h>
 #include <src/libfuzzer/libfuzzer_macro.h>
 
 #include <fstream>
 
-static evmc::VM evmone = evmc::VM{evmc_create_evmone()};
-
 using namespace solidity::test::abiv2fuzzer;
 using namespace solidity::test;
 using namespace solidity::util;
 using namespace solidity;
 using namespace std;
 
-namespace
-{
-/// Test function returns a uint256 value
-static size_t const expectedOutputLength = 32;
+static evmc::VM evmone = evmc::VM{evmc_create_evmone()};
 /// Expected output value is decimal 0
-static uint8_t const expectedOutput[expectedOutputLength] = {
+static vector<uint8_t> const expectedOutput = {
 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 };
 
-/// Compares the contents of the memory address pointed to
-/// by `_result` of `_length` bytes to the expected output.
-/// Returns true if `_result` matches expected output, false
-/// otherwise.
-bool isOutputExpected(uint8_t const* _result, size_t _length)
-{
-	if (_length != expectedOutputLength)
-		return false;
-
-	return (memcmp(_result, expectedOutput, expectedOutputLength) == 0);
-}
-
-/// Accepts a reference to a user-specified input and returns an
-/// evmc_message with all of its fields zero initialized except
-/// gas and input fields.
-/// The gas field is set to the maximum permissible value so that we
-/// don't run into out of gas errors. The input field is copied from
-/// user input.
-evmc_message initializeMessage(bytes const& _input)
-{
-	// Zero initialize all message fields
-	evmc_message msg = {};
-	// Gas available (value of type int64_t) is set to its maximum
-	// value.
-	msg.gas = std::numeric_limits<int64_t>::max();
-	msg.input_data = _input.data();
-	msg.input_size = _input.size();
-	return msg;
-}
-
-/// Accepts host context implementation, and keccak256 hash of the function
-/// to be called at a specified address in the simulated blockchain as
-/// input and returns the result of the execution of the called function.
-evmc::result executeContract(
-	EVMHost& _hostContext,
-	bytes const& _functionHash,
-	evmc_address _deployedAddress
-)
-{
-	evmc_message message = initializeMessage(_functionHash);
-	message.destination = _deployedAddress;
-	message.kind = EVMC_CALL;
-	return _hostContext.call(message);
-}
-
-/// Accepts a reference to host context implementation and byte code
-/// as input and deploys it on the simulated blockchain. Returns the
-/// result of deployment.
-evmc::result deployContract(EVMHost& _hostContext, bytes const& _code)
-{
-	evmc_message message = initializeMessage(_code);
-	message.kind = EVMC_CREATE;
-	return _hostContext.call(message);
-}
-}
-
 DEFINE_PROTO_FUZZER(Contract const& _input)
 {
 	string contract_source = ProtoConverter{}.contractToString(_input);
@@ -147,7 +84,7 @@ DEFINE_PROTO_FUZZER(Contract const& _input)
 	EVMHost hostContext(version, evmone);
 
 	// Deploy contract and signal failure if deploy failed
-	evmc::result createResult = deployContract(hostContext, byteCode);
+	evmc::result createResult = AbiV2Utility::deployContract(hostContext, byteCode);
 	solAssert(
 		createResult.status_code == EVMC_SUCCESS,
 		"Proto ABIv2 Fuzzer: Contract creation failed"
@@ -155,7 +92,7 @@ DEFINE_PROTO_FUZZER(Contract const& _input)
 
 	// Execute test function and signal failure if EVM reverted or
 	// did not return expected output on successful execution.
-	evmc::result callResult = executeContract(
+	evmc::result callResult = AbiV2Utility::executeContract(
 		hostContext,
 		fromHex(hexEncodedInput),
 		createResult.create_address
@@ -165,7 +102,7 @@ DEFINE_PROTO_FUZZER(Contract const& _input)
 	solAssert(callResult.status_code != EVMC_REVERT, "Proto ABIv2 fuzzer: EVM One reverted");
 	if (callResult.status_code == EVMC_SUCCESS)
 		solAssert(
-			isOutputExpected(callResult.output_data, callResult.output_size),
+			AbiV2Utility::isOutputExpected(callResult.output_data, callResult.output_size, expectedOutput),
 			"Proto ABIv2 fuzzer: ABIv2 coding failure found"
 		);
 }

test/tools/ossfuzz/yulFuzzerCommon.cpp

@@ -27,12 +27,14 @@ yulFuzzerUtil::TerminationReason yulFuzzerUtil::interpret(
 	shared_ptr<yul::Block> _ast,
 	Dialect const& _dialect,
 	size_t _maxSteps,
-	size_t _maxTraceSize
+	size_t _maxTraceSize,
+	size_t _maxExprNesting
 )
 {
 	InterpreterState state;
 	state.maxTraceSize = _maxTraceSize;
 	state.maxSteps = _maxSteps;
+	state.maxExprNesting = _maxExprNesting;
 	// Add 64 bytes of pseudo-randomly generated calldata so that
 	// calldata opcodes perform non trivial work.
 	state.calldata = {
@@ -59,6 +61,10 @@ yulFuzzerUtil::TerminationReason yulFuzzerUtil::interpret(
 	{
 		reason = TerminationReason::TraceLimitReached;
 	}
+	catch (ExpressionNestingLimitReached const&)
+	{
+		reason = TerminationReason::ExpresionNestingLimitReached;
+	}
 	catch (ExplicitlyTerminated const&)
 	{
 		reason = TerminationReason::ExplicitlyTerminated;

test/tools/ossfuzz/yulFuzzerCommon.h

@@ -28,6 +28,7 @@ struct yulFuzzerUtil
 		ExplicitlyTerminated,
 		StepLimitReached,
 		TraceLimitReached,
+		ExpresionNestingLimitReached,
 		None
 	};
 
@@ -36,10 +37,12 @@ struct yulFuzzerUtil
 		std::shared_ptr<yul::Block> _ast,
 		Dialect const& _dialect,
 		size_t _maxSteps = maxSteps,
-		size_t _maxTraceSize = maxTraceSize
+		size_t _maxTraceSize = maxTraceSize,
+		size_t _maxExprNesting = maxExprNesting
 	);
 	static size_t constexpr maxSteps = 100;
 	static size_t constexpr maxTraceSize = 75;
+	static size_t constexpr maxExprNesting = 64;
 };
 
 }

test/tools/ossfuzz/yulProto_diff_ossfuzz.cpp

@@ -99,7 +99,8 @@ DEFINE_PROTO_FUZZER(Program const& _input)
 
 	if (
 		termReason == yulFuzzerUtil::TerminationReason::StepLimitReached ||
-		termReason == yulFuzzerUtil::TerminationReason::TraceLimitReached
+		termReason == yulFuzzerUtil::TerminationReason::TraceLimitReached ||
+		termReason == yulFuzzerUtil::TerminationReason::ExpresionNestingLimitReached
 	)
 		return;
 
@@ -109,10 +110,10 @@ DEFINE_PROTO_FUZZER(Program const& _input)
 		stack.parserResult()->code,
 		EVMDialect::strictAssemblyForEVMObjects(version)
 	);
-
 	if (
 		termReason == yulFuzzerUtil::TerminationReason::StepLimitReached ||
-		termReason == yulFuzzerUtil::TerminationReason::TraceLimitReached
+		termReason == yulFuzzerUtil::TerminationReason::TraceLimitReached ||
+		termReason == yulFuzzerUtil::TerminationReason::ExpresionNestingLimitReached
 	)
 		return;
 

test/tools/yulInterpreter/Interpreter.cpp

@@ -247,6 +247,7 @@ void Interpreter::incrementStep()
 
 void ExpressionEvaluator::operator()(Literal const& _literal)
 {
+	incrementStep();
 	static YulString const trueString("true");
 	static YulString const falseString("false");
 
@@ -256,6 +257,7 @@ void ExpressionEvaluator::operator()(Literal const& _literal)
 void ExpressionEvaluator::operator()(Identifier const& _identifier)
 {
 	solAssert(m_variables.count(_identifier.name), "");
+	incrementStep();
 	setValue(m_variables.at(_identifier.name));
 }
 
@@ -326,6 +328,7 @@ void ExpressionEvaluator::evaluateArgs(
 	vector<optional<LiteralKind>> const* _literalArguments
 )
 {
+	incrementStep();
 	vector<u256> values;
 	size_t i = 0;
 	/// Function arguments are evaluated in reverse.
@@ -341,3 +344,13 @@ void ExpressionEvaluator::evaluateArgs(
 	m_values = std::move(values);
 	std::reverse(m_values.begin(), m_values.end());
 }
+
+void ExpressionEvaluator::incrementStep()
+{
+	m_nestingLevel++;
+	if (m_state.maxExprNesting > 0 && m_nestingLevel > m_state.maxExprNesting)
+	{
+		m_state.trace.emplace_back("Maximum expression nesting level reached.");
+		throw ExpressionNestingLimitReached();
+	}
+}

test/tools/yulInterpreter/Interpreter.h

@@ -55,6 +55,10 @@ class TraceLimitReached: public InterpreterTerminatedGeneric
 {
 };
 
+class ExpressionNestingLimitReached: public InterpreterTerminatedGeneric
+{
+};
+
 enum class ControlFlowState
 {
 	Default,
@@ -92,6 +96,7 @@ struct InterpreterState
 	size_t maxTraceSize = 0;
 	size_t maxSteps = 0;
 	size_t numSteps = 0;
+	size_t maxExprNesting = 0;
 	ControlFlowState controlFlowState = ControlFlowState::Default;
 
 	void dumpTraceAndState(std::ostream& _out) const;
@@ -202,6 +207,11 @@ private:
 		std::vector<std::optional<LiteralKind>> const* _literalArguments
 	);
 
+	/// Increment evaluation count, throwing exception if the
+	/// nesting level is beyond the upper bound configured in
+	/// the interpreter state.
+	void incrementStep();
+
 	InterpreterState& m_state;
 	Dialect const& m_dialect;
 	/// Values of variables.
@@ -209,6 +219,8 @@ private:
 	Scope& m_scope;
 	/// Current value of the expression
 	std::vector<u256> m_values;
+	/// Current expression nesting level
+	unsigned m_nestingLevel = 0;
 };
 
 }