cerc-io/solidity
16
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

yul proto fuzzer: Do not generate infinite for loops and limit total

Browse Source 
number of for loops per test program to two
This commit is contained in:
Bhargava Shastry 2019-11-18 12:12:30 +01:00
parent 470c19eb8c
commit 9befb4bdf0
2 changed files with 36 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
test/tools/ossfuzz/protoToYul.cpp
View File

@ -34,10 +34,19 @@ using namespace solidity::util;
using namespace solidity;
string ProtoConverter::dictionaryToken(HexPrefix _p)
{
std::string token;
// If dictionary constant is requested while converting
// for loop condition, then return zero so that we don't
// generate infinite for loops.
if (m_inForCond)
token = "0";
else
{
unsigned indexVar = m_inputSize * m_inputSize + counter();
std::string token = hexDictionary[indexVar % hexDictionary.size()];
token = hexDictionary[indexVar % hexDictionary.size()];
yulAssert(token.size() <= 64, "Proto Fuzzer: Dictionary token too large");
}
return _p == HexPrefix::Add ? "0x" + token : token;
}
@ -173,6 +182,12 @@ void ProtoConverter::visit(Expression const& _x)
visit(_x.varref());
break;
case Expression::kCons:
// If literal expression describes for-loop condition
// then force it to zero, so we don't generate infinite
// for loops
if (m_inForCond)
m_output << "0";
else
m_output << visit(_x.cons());
break;
case Expression::kBinop:
@ -964,17 +979,22 @@ void ProtoConverter::visit(StoreFunc const& _x)
void ProtoConverter::visit(ForStmt const& _x)
{
if (++m_numForLoops > s_maxForLoops)
return;
bool wasInForBody = m_inForBodyScope;
bool wasInForInit = m_inForInitScope;
bool wasForInitScopeExtEnabled = m_forInitScopeExtEnabled;
m_inForBodyScope = false;
m_inForInitScope = true;
m_forInitScopeExtEnabled = true;
m_inForCond = false;
m_output << "for ";
visit(_x.for_init());
m_inForInitScope = false;
m_forInitScopeExtEnabled = wasForInitScopeExtEnabled;
m_inForCond = true;
visit(_x.for_cond());
m_inForCond = false;
visit(_x.for_post());
m_inForBodyScope = true;
visit(_x.for_body());
@ -997,6 +1017,9 @@ void ProtoConverter::visit(ForStmt const& _x)
void ProtoConverter::visit(BoundedForStmt const& _x)
{
if (++m_numForLoops > s_maxForLoops)
return;
// Boilerplate for loop that limits the number of iterations to a maximum of 4.
std::string loopVarName("i_" + std::to_string(m_numNestedForLoops++));
m_output << "for { let " << loopVarName << " := 0 } "

9
test/tools/ossfuzz/protoToYul.h
View File

@ -42,7 +42,9 @@ public:
m_globalVars = std::vector<std::vector<std::string>>{};
m_inForBodyScope = false;
m_inForInitScope = false;
m_inForCond = false;
m_numNestedForLoops = 0;
m_numForLoops = 0;
m_counter = 0;
m_inputSize = 0;
m_inFunctionDef = false;
@ -339,11 +341,18 @@ private:
/// Predicate to keep track of for body scope. If false, break/continue
/// statements can not be created.
bool m_inForBodyScope;
/// Maximum number of for loops that a test case may contain
static auto constexpr s_maxForLoops = 2;
// Index used for naming loop variable of bounded for loops
unsigned m_numNestedForLoops;
/// Counter for number of for loops
unsigned m_numForLoops;
/// Predicate to keep track of for loop init scope. If true, variable
/// or function declarations can not be created.
bool m_inForInitScope;
/// Flag that is true while converting for loop condition,
/// false otherwise.
bool m_inForCond;
/// Monotonically increasing counter
unsigned m_counter;
/// Size of protobuf input