Add evmc and host interface implementation. Modify fuzzer harness to make use of evmc host/vm.

test/tools/ossfuzz/CMakeLists.txt

@@ -9,8 +9,11 @@ add_dependencies(ossfuzz
         )
 
 if (OSSFUZZ)
-add_custom_target(ossfuzz_proto)
-add_dependencies(ossfuzz_proto yul_proto_ossfuzz yul_proto_diff_ossfuzz)
+    add_custom_target(ossfuzz_proto)
+    add_dependencies(ossfuzz_proto yul_proto_ossfuzz yul_proto_diff_ossfuzz)
+
+    add_custom_target(ossfuzz_abiv2)
+    add_dependencies(ossfuzz_abiv2 abiv2_proto_ossfuzz)
 endif()
 
 if (OSSFUZZ)
@@ -49,6 +52,26 @@ if (OSSFUZZ)
             protobuf-mutator.a
             protobuf.a
             FuzzingEngine.a)
+
+    add_executable(abiv2_proto_ossfuzz
+            ../../EVMHost.cpp
+            abiV2ProtoFuzzer.cpp
+            abiV2FuzzerCommon.cpp
+            protoToAbiV2.cpp
+            abiV2Proto.pb.cc
+    )
+    target_include_directories(abiv2_proto_ossfuzz PRIVATE
+            /src/LPM/external.protobuf/include
+            /src/libprotobuf-mutator
+            /src/evmone/include
+    )
+    target_link_libraries(abiv2_proto_ossfuzz PRIVATE solidity
+            evmone intx ethash keccak evmc-instructions evmc
+            protobuf-mutator-libfuzzer.a
+            protobuf-mutator.a
+            protobuf.a
+            FuzzingEngine.a
+    )
 else()
     add_library(solc_opt_ossfuzz
             solc_opt_ossfuzz.cpp
@@ -99,4 +122,23 @@ else()
 #            protobuf-mutator.a
 #            protobuf.a
 #            FuzzingEngine.a)
+#    add_executable(abiv2_proto_ossfuzz
+#            ../../EVMHost.cpp
+#            abiV2ProtoFuzzer.cpp
+#            abiV2FuzzerCommon.cpp
+#            protoToAbiV2.cpp
+#            abiV2Proto.pb.cc
+#    )
+#    target_include_directories(abiv2_proto_ossfuzz PRIVATE
+#            /src/LPM/external.protobuf/include
+#            /src/libprotobuf-mutator
+#            /src/evmone/include
+#    )
+#    target_link_libraries(abiv2_proto_ossfuzz PRIVATE solidity
+#            evmone intx ethash keccak evmc-instructions evmc
+#            protobuf-mutator-libfuzzer.a
+#            protobuf-mutator.a
+#            protobuf.a
+#            FuzzingEngine.a
+#    )
 endif()

test/tools/ossfuzz/abiV2FuzzerCommon.cpp

@@ -27,7 +27,7 @@ dev::bytes SolidityCompilationFramework::compileContract(
 			);
 		std::cerr << "Compiling contract failed" << std::endl;
 	}
-	dev::eth::LinkerObject obj = m_compiler.runtimeObject(
+	dev::eth::LinkerObject obj = m_compiler.object(
 		_contractName.empty() ?
 		m_compiler.lastContractName() :
 		_contractName

test/tools/ossfuzz/abiV2FuzzerCommon.h

@@ -28,7 +28,7 @@ public:
 protected:
 	dev::solidity::CompilerStack m_compiler;
 	langutil::EVMVersion m_evmVersion;
-	dev::solidity::OptimiserSettings m_optimiserSettings = dev::solidity::OptimiserSettings::full();
+	dev::solidity::OptimiserSettings m_optimiserSettings = dev::solidity::OptimiserSettings::none();
 };
 }
 }

test/tools/ossfuzz/abiV2ProtoFuzzer.cpp

@@ -15,15 +15,86 @@
 	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#include <test/EVMHost.h>
 #include <test/tools/ossfuzz/abiV2FuzzerCommon.h>
 #include <test/tools/ossfuzz/protoToAbiV2.h>
+#include <evmone/evmone.h>
 #include <src/libfuzzer/libfuzzer_macro.h>
 #include <fstream>
 
+static evmc::vm evmone = evmc::vm{evmc_create_evmone()};
+
 using namespace dev::test::abiv2fuzzer;
+using namespace dev::test;
 using namespace dev;
 using namespace std;
 
+namespace
+{
+/// Test function returns a uint256 value
+static size_t const expectedOutputLength = 32;
+/// Expected output value is decimal 1000 or hex 03E8
+static uint8_t const expectedOutput[expectedOutputLength] = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, u'\x03', u'\xe8'
+};
+
+/// Compares the contents of the memory address pointed to
+/// by `_result` of `_length` bytes to the expected output.
+/// Returns true if `_result` matches expected output, false
+/// otherwise.
+bool isOutputExpected(uint8_t const* _result, size_t _length)
+{
+	if (_length != expectedOutputLength)
+		return false;
+
+	return (memcmp(_result, expectedOutput, expectedOutputLength) == 0);
+}
+
+/// Accepts a reference to a user-specified input and returns an
+/// evmc_message with all of its fields zero initialized except
+/// gas and input fields.
+/// The gas field is set to the maximum permissible value so that we
+/// don't run into out of gas errors. The input field is copied from
+/// user input.
+evmc_message initializeMessage(dev::bytes const& _input)
+{
+	// Zero initialize all message fields
+	evmc_message msg = {};
+	// Gas available (value of type int64_t) is set to its maximum
+	// value.
+	msg.gas = std::numeric_limits<int64_t>::max();
+	msg.input_data = _input.data();
+	msg.input_size = _input.size();
+	return msg;
+}
+
+/// Accepts host context implementation, and keccak256 hash of the function
+/// to be called at a specified address in the simulated blockchain as
+/// input and returns the result of the execution of the called function.
+evmc::result executeContract(
+	EVMHost& _hostContext,
+	dev::bytes const& _functionHash,
+	evmc_address _deployedAddress
+)
+{
+	evmc_message message = initializeMessage(_functionHash);
+	message.destination = _deployedAddress;
+	message.kind = EVMC_CALL;
+	return _hostContext.call(message);
+}
+
+/// Accepts a reference to host context implementation and byte code
+/// as input and deploys it on the simulated blockchain. Returns the
+/// result of deployment.
+evmc::result deployContract(EVMHost& _hostContext, dev::bytes const& _code)
+{
+	evmc_message message = initializeMessage(_code);
+	message.kind = EVMC_CREATE;
+	return _hostContext.call(message);
+}
+}
+
 DEFINE_PROTO_FUZZER(Contract const& _input)
 {
 	string contract_source = ProtoConverter{}.contractToString(_input);
@@ -44,17 +115,48 @@ DEFINE_PROTO_FUZZER(Contract const& _input)
 	{
 		// Compile contract generated by the proto fuzzer
 		SolidityCompilationFramework solCompilationFramework;
-		std::string contractName = ":Factory";
+		std::string contractName = ":C";
 		byteCode = solCompilationFramework.compileContract(contract_source, contractName);
 		Json::Value methodIdentifiers = solCompilationFramework.getMethodIdentifiers();
 		// We always call the function test() that is defined in proto converter template
 		hexEncodedInput = methodIdentifiers["test()"].asString();
 	}
-	catch (...)
+	// Ignore compilation failures
+	catch (Exception const&)
 	{
-		cout << contract_source << endl;
-		throw;
+		return;
 	}
-	// TODO: Call evmone wrapper here
-	return;
+
+	if (const char* dump_path = getenv("PROTO_FUZZER_DUMP_CODE"))
+	{
+		ofstream of(dump_path);
+		of << toHex(byteCode);
+	}
+
+	// We target the default EVM which is the latest
+	langutil::EVMVersion version = {};
+	EVMHost hostContext(version, evmone);
+
+	// Deploy contract and signal failure if deploy failed
+	evmc::result createResult = deployContract(hostContext, byteCode);
+	solAssert(
+		createResult.status_code == EVMC_SUCCESS,
+		"Proto ABIv2 Fuzzer: Contract creation failed"
+	);
+
+	// Execute test function and signal failure if EVM reverted or
+	// did not return expected output on successful execution.
+	evmc::result callResult = executeContract(
+		hostContext,
+		fromHex(hexEncodedInput),
+		createResult.create_address
+	);
+
+	// We don't care about EVM One failures other than EVMC_REVERT
+	solAssert(callResult.status_code != EVMC_REVERT, "Proto ABIv2 fuzzer: EVM One reverted");
+	if (callResult.status_code == EVMC_SUCCESS)
+		solAssert(
+			isOutputExpected(callResult.output_data, callResult.output_size),
+			"Proto ABIv2 fuzzer: ABIv2 coding failure found"
+		);
 }