Draft

test/tools/ossfuzz/CMakeLists.txt

@@ -1,3 +1,5 @@
+link_directories(/usr/local/lib)
+add_subdirectory(antlr4-runtime)
 add_custom_target(ossfuzz)
 add_dependencies(ossfuzz
         solc_opt_ossfuzz
@@ -27,8 +29,13 @@ if (OSSFUZZ)
     target_link_libraries(solc_opt_ossfuzz PRIVATE libsolc evmasm)
     set_target_properties(solc_opt_ossfuzz PROPERTIES LINK_FLAGS ${LIB_FUZZING_ENGINE})
 
-    add_executable(solc_noopt_ossfuzz solc_noopt_ossfuzz.cpp ../fuzzer_common.cpp ../../TestCaseReader.cpp)
-    target_link_libraries(solc_noopt_ossfuzz PRIVATE libsolc evmasm)
+    add_executable(solc_noopt_ossfuzz
+            solc_noopt_ossfuzz.cpp
+            ../fuzzer_common.cpp
+            ../../TestCaseReader.cpp
+            libFuzzerMutator.cpp
+    )
+    target_link_libraries(solc_noopt_ossfuzz PRIVATE libsolc evmasm antlr4mutator antlr4-runtime)
     set_target_properties(solc_noopt_ossfuzz PROPERTIES LINK_FLAGS ${LIB_FUZZING_ENGINE})
 
     add_executable(const_opt_ossfuzz const_opt_ossfuzz.cpp ../fuzzer_common.cpp)

test/tools/ossfuzz/antlr4-runtime/CMakeLists.txt

@@ -0,0 +1,15 @@
+set(sources
+        SolidityBaseVisitor.h
+        SolidityVisitor.h
+        SolidityMutator.cpp
+        SolidityMutator.h
+        SolidityParser.cpp
+        SolidityParser.h
+        SolidityLexer.cpp
+        SolidityLexer.h
+        )
+add_library(antlr4mutator ${sources})
+target_include_directories(antlr4mutator PUBLIC
+        "${CMAKE_SOURCE_DIR}"
+        /usr/local/include/antlr4-runtime
+)

test/tools/ossfuzz/antlr4-runtime/SolidityBaseVisitor.h

@@ -0,0 +1,447 @@
+
+// Generated from Solidity.g4 by ANTLR 4.8
+
+#pragma once
+
+
+#include "antlr4-runtime.h"
+#include <test/tools/ossfuzz/antlr4-runtime/SolidityVisitor.h>
+
+/**
+ * This class provides an empty implementation of SolidityVisitor, which can be
+ * extended to create a visitor which only needs to handle a subset of the available methods.
+ */
+class  SolidityBaseVisitor : public SolidityVisitor {
+public:
+
+  virtual antlrcpp::Any visitSourceUnit(SolidityParser::SourceUnitContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitPragmaDirective(SolidityParser::PragmaDirectiveContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitImportDirective(SolidityParser::ImportDirectiveContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitImportAliases(SolidityParser::ImportAliasesContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitPath(SolidityParser::PathContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitSymbolAliases(SolidityParser::SymbolAliasesContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitContractDefinition(SolidityParser::ContractDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitInterfaceDefinition(SolidityParser::InterfaceDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitLibraryDefinition(SolidityParser::LibraryDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitInheritanceSpecifierList(SolidityParser::InheritanceSpecifierListContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitInheritanceSpecifier(SolidityParser::InheritanceSpecifierContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitContractBodyElement(SolidityParser::ContractBodyElementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitNamedArgument(SolidityParser::NamedArgumentContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitCallArgumentList(SolidityParser::CallArgumentListContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitUserDefinedTypeName(SolidityParser::UserDefinedTypeNameContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitModifierInvocation(SolidityParser::ModifierInvocationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitVisibility(SolidityParser::VisibilityContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitParameterList(SolidityParser::ParameterListContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitParameterDeclaration(SolidityParser::ParameterDeclarationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitConstructorDefinition(SolidityParser::ConstructorDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitStateMutability(SolidityParser::StateMutabilityContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitOverrideSpecifier(SolidityParser::OverrideSpecifierContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitFunctionDefinition(SolidityParser::FunctionDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitModifierDefinition(SolidityParser::ModifierDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitFallbackReceiveFunctionDefinition(SolidityParser::FallbackReceiveFunctionDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitStructDefinition(SolidityParser::StructDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitStructMember(SolidityParser::StructMemberContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitEnumDefinition(SolidityParser::EnumDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitStateVariableDeclaration(SolidityParser::StateVariableDeclarationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitEventParameter(SolidityParser::EventParameterContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitEventDefinition(SolidityParser::EventDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitUsingDirective(SolidityParser::UsingDirectiveContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitTypeName(SolidityParser::TypeNameContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitElementaryTypeName(SolidityParser::ElementaryTypeNameContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitFunctionTypeName(SolidityParser::FunctionTypeNameContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitVariableDeclaration(SolidityParser::VariableDeclarationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitDataLocation(SolidityParser::DataLocationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitUnaryPrefixOperation(SolidityParser::UnaryPrefixOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitPrimaryExpression(SolidityParser::PrimaryExpressionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitOrderComparison(SolidityParser::OrderComparisonContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitConditional(SolidityParser::ConditionalContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitPayableConversion(SolidityParser::PayableConversionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitAssignment(SolidityParser::AssignmentContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitUnarySuffixOperation(SolidityParser::UnarySuffixOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitShiftOperation(SolidityParser::ShiftOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitBitAndOperation(SolidityParser::BitAndOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitFunctionCall(SolidityParser::FunctionCallContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitIndexRangeAccess(SolidityParser::IndexRangeAccessContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitNewExpression(SolidityParser::NewExpressionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitIndexAccess(SolidityParser::IndexAccessContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitAddSubOperation(SolidityParser::AddSubOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitBitOrOperation(SolidityParser::BitOrOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitExpOperation(SolidityParser::ExpOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitAndOperation(SolidityParser::AndOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitInlineArray(SolidityParser::InlineArrayContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitOrOperation(SolidityParser::OrOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitMemberAccess(SolidityParser::MemberAccessContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitMulDivModOperation(SolidityParser::MulDivModOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitFunctionCallOptions(SolidityParser::FunctionCallOptionsContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitBitXorOperation(SolidityParser::BitXorOperationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitTuple(SolidityParser::TupleContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitEqualityComparison(SolidityParser::EqualityComparisonContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitMetaType(SolidityParser::MetaTypeContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitAssignOp(SolidityParser::AssignOpContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitTupleExpression(SolidityParser::TupleExpressionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitInlineArrayExpression(SolidityParser::InlineArrayExpressionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitIdentifier(SolidityParser::IdentifierContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitLiteral(SolidityParser::LiteralContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitBooleanLiteral(SolidityParser::boolLiteralContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitStringLiteral(SolidityParser::StringLiteralContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitHexStringLiteral(SolidityParser::HexStringLiteralContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitUnicodeStringLiteral(SolidityParser::UnicodeStringLiteralContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitNumberLiteral(SolidityParser::NumberLiteralContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitBlock(SolidityParser::BlockContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitStatement(SolidityParser::StatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitSimpleStatement(SolidityParser::SimpleStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitIfStatement(SolidityParser::IfStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitForStatement(SolidityParser::ForStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitWhileStatement(SolidityParser::WhileStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitDoWhileStatement(SolidityParser::DoWhileStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitContinueStatement(SolidityParser::ContinueStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitBreakStatement(SolidityParser::BreakStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitTryStatement(SolidityParser::TryStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitCatchClause(SolidityParser::CatchClauseContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitReturnStatement(SolidityParser::ReturnStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitEmitStatement(SolidityParser::EmitStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitAssemblyStatement(SolidityParser::AssemblyStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitVariableDeclarationList(SolidityParser::VariableDeclarationListContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitVariableDeclarationTuple(SolidityParser::VariableDeclarationTupleContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitVariableDeclarationStatement(SolidityParser::VariableDeclarationStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitExpressionStatement(SolidityParser::ExpressionStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitMappingType(SolidityParser::MappingTypeContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitMappingKeyType(SolidityParser::MappingKeyTypeContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulStatement(SolidityParser::YulStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulBlock(SolidityParser::YulBlockContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulVariableDeclaration(SolidityParser::YulVariableDeclarationContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulAssignment(SolidityParser::YulAssignmentContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulIfStatement(SolidityParser::YulIfStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulForStatement(SolidityParser::YulForStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulSwitchCase(SolidityParser::YulSwitchCaseContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulSwitchStatement(SolidityParser::YulSwitchStatementContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulFunctionDefinition(SolidityParser::YulFunctionDefinitionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulPath(SolidityParser::YulPathContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulFunctionCall(SolidityParser::YulFunctionCallContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulBoolean(SolidityParser::YulboolContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulLiteral(SolidityParser::YulLiteralContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+  virtual antlrcpp::Any visitYulExpression(SolidityParser::YulExpressionContext *ctx) override {
+    return visitChildren(ctx);
+  }
+
+
+};
+

test/tools/ossfuzz/antlr4-runtime/SolidityLexer.h

@@ -0,0 +1,92 @@
+
+// Generated from docs/grammar/SolidityLexer.g4 by ANTLR 4.8
+
+#pragma once
+
+
+#include "antlr4-runtime.h"
+
+
+
+
+class  SolidityLexer : public antlr4::Lexer {
+public:
+  enum {
+    ReservedKeywords = 1, Pragma = 2, Abstract = 3, Anonymous = 4, Address = 5, 
+    As = 6, Assembly = 7, Bool = 8, Break = 9, Bytes = 10, Calldata = 11, 
+    Catch = 12, Constant = 13, Constructor = 14, Continue = 15, Contract = 16, 
+    Delete = 17, Do = 18, Else = 19, Emit = 20, Enum = 21, Event = 22, External = 23, 
+    Fallback = 24, False = 25, Fixed = 26, From = 27, FixedBytes = 28, For = 29, 
+    Function = 30, Hex = 31, If = 32, Immutable = 33, Import = 34, Indexed = 35, 
+    Interface = 36, Internal = 37, Is = 38, Library = 39, Mapping = 40, 
+    Memory = 41, Modifier = 42, New = 43, NumberUnit = 44, Override = 45, 
+    Payable = 46, Private = 47, Public = 48, Pure = 49, Receive = 50, Return = 51, 
+    Returns = 52, SignedIntegerType = 53, Storage = 54, String = 55, Struct = 56, 
+    True = 57, Try = 58, Type = 59, Ufixed = 60, UnsignedIntegerType = 61, 
+    Using = 62, View = 63, Virtual = 64, While = 65, LParen = 66, RParen = 67, 
+    LBrack = 68, RBrack = 69, LBrace = 70, RBrace = 71, Colon = 72, Semicolon = 73, 
+    Period = 74, Conditional = 75, Arrow = 76, Assign = 77, AssignBitOr = 78, 
+    AssignBitXor = 79, AssignBitAnd = 80, AssignShl = 81, AssignSar = 82, 
+    AssignShr = 83, AssignAdd = 84, AssignSub = 85, AssignMul = 86, AssignDiv = 87, 
+    AssignMod = 88, Comma = 89, Or = 90, And = 91, BitOr = 92, BitXor = 93, 
+    BitAnd = 94, Shl = 95, Sar = 96, Shr = 97, Add = 98, Sub = 99, Mul = 100, 
+    Div = 101, Mod = 102, Exp = 103, Equal = 104, NotEqual = 105, LessThan = 106, 
+    GreaterThan = 107, LessThanOrEqual = 108, GreaterThanOrEqual = 109, 
+    Not = 110, BitNot = 111, Inc = 112, Dec = 113, StringLiteral = 114, 
+    NonEmptyStringLiteral = 115, UnicodeStringLiteral = 116, HexString = 117, 
+    HexNumber = 118, DecimalNumber = 119, Identifier = 120, WS = 121, COMMENT = 122, 
+    LINE_COMMENT = 123, AssemblyDialect = 124, AssemblyLBrace = 125, AssemblyBlockWS = 126, 
+    AssemblyBlockCOMMENT = 127, AssemblyBlockLINE_COMMENT = 128, YulBreak = 129, 
+    YulCase = 130, YulContinue = 131, YulDefault = 132, YulFalse = 133, 
+    YulFor = 134, YulFunction = 135, YulIf = 136, YulLeave = 137, YulLet = 138, 
+    YulSwitch = 139, YulTrue = 140, YulEVMBuiltin = 141, YulLBrace = 142, 
+    YulRBrace = 143, YulLParen = 144, YulRParen = 145, YulAssign = 146, 
+    YulPeriod = 147, YulComma = 148, YulArrow = 149, YulIdentifier = 150, 
+    YulHexNumber = 151, YulDecimalNumber = 152, YulStringLiteral = 153, 
+    YulWS = 154, YulCOMMENT = 155, YulLINE_COMMENT = 156, PragmaToken = 157, 
+    PragmaSemicolon = 158, PragmaWS = 159, PragmaCOMMENT = 160, PragmaLINE_COMMENT = 161
+  };
+
+  enum {
+    AssemblyBlockMode = 1, YulMode = 2, PragmaMode = 3
+  };
+
+  SolidityLexer(antlr4::CharStream *input);
+  ~SolidityLexer();
+
+  virtual std::string getGrammarFileName() const override;
+  virtual const std::vector<std::string>& getRuleNames() const override;
+
+  virtual const std::vector<std::string>& getChannelNames() const override;
+  virtual const std::vector<std::string>& getModeNames() const override;
+  virtual const std::vector<std::string>& getTokenNames() const override; // deprecated, use vocabulary instead
+  virtual antlr4::dfa::Vocabulary& getVocabulary() const override;
+
+  virtual const std::vector<uint16_t> getSerializedATN() const override;
+  virtual const antlr4::atn::ATN& getATN() const override;
+
+private:
+  static std::vector<antlr4::dfa::DFA> _decisionToDFA;
+  static antlr4::atn::PredictionContextCache _sharedContextCache;
+  static std::vector<std::string> _ruleNames;
+  static std::vector<std::string> _tokenNames;
+  static std::vector<std::string> _channelNames;
+  static std::vector<std::string> _modeNames;
+
+  static std::vector<std::string> _literalNames;
+  static std::vector<std::string> _symbolicNames;
+  static antlr4::dfa::Vocabulary _vocabulary;
+  static antlr4::atn::ATN _atn;
+  static std::vector<uint16_t> _serializedATN;
+
+
+  // Individual action functions triggered by action() above.
+
+  // Individual semantic predicate functions triggered by sempred() above.
+
+  struct Initializer {
+    Initializer();
+  };
+  static Initializer _init;
+};
+

test/tools/ossfuzz/antlr4-runtime/SolidityMutator.cpp

@@ -0,0 +1,87 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <test/tools/ossfuzz/antlr4-runtime/SolidityMutator.h>
+
+#include <libsolutil/Whiskers.h>
+
+#include <boost/algorithm/string/erase.hpp>
+
+using namespace std;
+using namespace solidity::util;
+
+antlrcpp::Any SolidityMutator::visitPragmaDirective(SolidityParser::PragmaDirectiveContext* _ctx)
+{
+	auto PickLiteral = [](unsigned const len) -> string
+	{
+		// TODO: Add to this list of valid pragmas
+		static const vector<string> alphanum = {
+			"solidity >=0.0.0",
+			"solidity ^0.4.24",
+			"experimental SMTChecker",
+			"experimental ABIEncoderV2",
+		};
+
+		return alphanum[len % alphanum.size()];
+	};
+
+	string pragma{};
+	for (auto &t: _ctx->PragmaToken())
+	{
+		string literal = t->toString();
+		boost::algorithm::erase_all(literal, " ");
+		if (random() % 5 == 0)
+			pragma += " " + PickLiteral(random());
+		else
+			pragma += " " + literal;
+	}
+
+	Out << Whiskers(R"(pragma <string>;<nl>)")
+		("string", pragma)
+		("nl", "\n")
+		.render();
+
+	return antlrcpp::Any();
+}
+
+antlrcpp::Any SolidityMutator::visitImportDirective(SolidityParser::ImportDirectiveContext* _ctx)
+{
+	if (_ctx->path())
+		Out << Whiskers(R"(import <path> as <id>;<nl>)")
+			("path", "\"A.sol\"")
+			("id", "A")
+			("nl", "\n")
+			.render();
+	else if (_ctx->Mul())
+		Out << Whiskers(R"(import * as <id> from <path>;<nl>)")
+			("id", "A")
+			("path", "\"A.sol\"")
+			("nl", "\n")
+			.render();
+	else if (_ctx->symbolAliases())
+		Out << Whiskers(R"(import {<symbolAliases>} from <path>;<nl>)")
+			("symbolAliases", "C as B, A")
+			("path", "\"A.sol\"")
+			("nl", "\n")
+			.render();
+	else
+		Out << Whiskers(R"(import "A.sol";<nl>)")
+				("nl", "\n")
+			   .render();
+
+	return antlrcpp::Any();
+}

test/tools/ossfuzz/antlr4-runtime/SolidityMutator.h

@@ -0,0 +1,34 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#pragma once
+
+#include <test/tools/ossfuzz/antlr4-runtime/SolidityBaseVisitor.h>
+
+class SolidityMutator: public SolidityBaseVisitor
+{
+public:
+	std::string toString()
+	{
+		return Out.str();
+	}
+	antlrcpp::Any visitPragmaDirective(SolidityParser::PragmaDirectiveContext* _ctx) override;
+	antlrcpp::Any visitImportDirective(SolidityParser::ImportDirectiveContext* _ctx) override;
+
+private:
+	std::ostringstream Out;
+};

test/tools/ossfuzz/antlr4-runtime/SolidityVisitor.h

@@ -0,0 +1,238 @@
+
+// Generated from Solidity.g4 by ANTLR 4.8
+
+#pragma once
+
+
+#include "antlr4-runtime.h"
+#include <test/tools/ossfuzz/antlr4-runtime/SolidityParser.h>
+
+
+
+/**
+ * This class defines an abstract visitor for a parse tree
+ * produced by SolidityParser.
+ */
+class  SolidityVisitor : public antlr4::tree::AbstractParseTreeVisitor {
+public:
+
+  /**
+   * Visit parse trees produced by SolidityParser.
+   */
+    virtual antlrcpp::Any visitSourceUnit(SolidityParser::SourceUnitContext *context) = 0;
+
+    virtual antlrcpp::Any visitPragmaDirective(SolidityParser::PragmaDirectiveContext *context) = 0;
+
+    virtual antlrcpp::Any visitImportDirective(SolidityParser::ImportDirectiveContext *context) = 0;
+
+    virtual antlrcpp::Any visitImportAliases(SolidityParser::ImportAliasesContext *context) = 0;
+
+    virtual antlrcpp::Any visitPath(SolidityParser::PathContext *context) = 0;
+
+    virtual antlrcpp::Any visitSymbolAliases(SolidityParser::SymbolAliasesContext *context) = 0;
+
+    virtual antlrcpp::Any visitContractDefinition(SolidityParser::ContractDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitInterfaceDefinition(SolidityParser::InterfaceDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitLibraryDefinition(SolidityParser::LibraryDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitInheritanceSpecifierList(SolidityParser::InheritanceSpecifierListContext *context) = 0;
+
+    virtual antlrcpp::Any visitInheritanceSpecifier(SolidityParser::InheritanceSpecifierContext *context) = 0;
+
+    virtual antlrcpp::Any visitContractBodyElement(SolidityParser::ContractBodyElementContext *context) = 0;
+
+    virtual antlrcpp::Any visitNamedArgument(SolidityParser::NamedArgumentContext *context) = 0;
+
+    virtual antlrcpp::Any visitCallArgumentList(SolidityParser::CallArgumentListContext *context) = 0;
+
+    virtual antlrcpp::Any visitUserDefinedTypeName(SolidityParser::UserDefinedTypeNameContext *context) = 0;
+
+    virtual antlrcpp::Any visitModifierInvocation(SolidityParser::ModifierInvocationContext *context) = 0;
+
+    virtual antlrcpp::Any visitVisibility(SolidityParser::VisibilityContext *context) = 0;
+
+    virtual antlrcpp::Any visitParameterList(SolidityParser::ParameterListContext *context) = 0;
+
+    virtual antlrcpp::Any visitParameterDeclaration(SolidityParser::ParameterDeclarationContext *context) = 0;
+
+    virtual antlrcpp::Any visitConstructorDefinition(SolidityParser::ConstructorDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitStateMutability(SolidityParser::StateMutabilityContext *context) = 0;
+
+    virtual antlrcpp::Any visitOverrideSpecifier(SolidityParser::OverrideSpecifierContext *context) = 0;
+
+    virtual antlrcpp::Any visitFunctionDefinition(SolidityParser::FunctionDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitModifierDefinition(SolidityParser::ModifierDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitFallbackReceiveFunctionDefinition(SolidityParser::FallbackReceiveFunctionDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitStructDefinition(SolidityParser::StructDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitStructMember(SolidityParser::StructMemberContext *context) = 0;
+
+    virtual antlrcpp::Any visitEnumDefinition(SolidityParser::EnumDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitStateVariableDeclaration(SolidityParser::StateVariableDeclarationContext *context) = 0;
+
+    virtual antlrcpp::Any visitEventParameter(SolidityParser::EventParameterContext *context) = 0;
+
+    virtual antlrcpp::Any visitEventDefinition(SolidityParser::EventDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitUsingDirective(SolidityParser::UsingDirectiveContext *context) = 0;
+
+    virtual antlrcpp::Any visitTypeName(SolidityParser::TypeNameContext *context) = 0;
+
+    virtual antlrcpp::Any visitElementaryTypeName(SolidityParser::ElementaryTypeNameContext *context) = 0;
+
+    virtual antlrcpp::Any visitFunctionTypeName(SolidityParser::FunctionTypeNameContext *context) = 0;
+
+    virtual antlrcpp::Any visitVariableDeclaration(SolidityParser::VariableDeclarationContext *context) = 0;
+
+    virtual antlrcpp::Any visitDataLocation(SolidityParser::DataLocationContext *context) = 0;
+
+    virtual antlrcpp::Any visitUnaryPrefixOperation(SolidityParser::UnaryPrefixOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitPrimaryExpression(SolidityParser::PrimaryExpressionContext *context) = 0;
+
+    virtual antlrcpp::Any visitOrderComparison(SolidityParser::OrderComparisonContext *context) = 0;
+
+    virtual antlrcpp::Any visitConditional(SolidityParser::ConditionalContext *context) = 0;
+
+    virtual antlrcpp::Any visitPayableConversion(SolidityParser::PayableConversionContext *context) = 0;
+
+    virtual antlrcpp::Any visitAssignment(SolidityParser::AssignmentContext *context) = 0;
+
+    virtual antlrcpp::Any visitUnarySuffixOperation(SolidityParser::UnarySuffixOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitShiftOperation(SolidityParser::ShiftOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitBitAndOperation(SolidityParser::BitAndOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitFunctionCall(SolidityParser::FunctionCallContext *context) = 0;
+
+    virtual antlrcpp::Any visitIndexRangeAccess(SolidityParser::IndexRangeAccessContext *context) = 0;
+
+    virtual antlrcpp::Any visitNewExpression(SolidityParser::NewExpressionContext *context) = 0;
+
+    virtual antlrcpp::Any visitIndexAccess(SolidityParser::IndexAccessContext *context) = 0;
+
+    virtual antlrcpp::Any visitAddSubOperation(SolidityParser::AddSubOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitBitOrOperation(SolidityParser::BitOrOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitExpOperation(SolidityParser::ExpOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitAndOperation(SolidityParser::AndOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitInlineArray(SolidityParser::InlineArrayContext *context) = 0;
+
+    virtual antlrcpp::Any visitOrOperation(SolidityParser::OrOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitMemberAccess(SolidityParser::MemberAccessContext *context) = 0;
+
+    virtual antlrcpp::Any visitMulDivModOperation(SolidityParser::MulDivModOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitFunctionCallOptions(SolidityParser::FunctionCallOptionsContext *context) = 0;
+
+    virtual antlrcpp::Any visitBitXorOperation(SolidityParser::BitXorOperationContext *context) = 0;
+
+    virtual antlrcpp::Any visitTuple(SolidityParser::TupleContext *context) = 0;
+
+    virtual antlrcpp::Any visitEqualityComparison(SolidityParser::EqualityComparisonContext *context) = 0;
+
+    virtual antlrcpp::Any visitMetaType(SolidityParser::MetaTypeContext *context) = 0;
+
+    virtual antlrcpp::Any visitAssignOp(SolidityParser::AssignOpContext *context) = 0;
+
+    virtual antlrcpp::Any visitTupleExpression(SolidityParser::TupleExpressionContext *context) = 0;
+
+    virtual antlrcpp::Any visitInlineArrayExpression(SolidityParser::InlineArrayExpressionContext *context) = 0;
+
+    virtual antlrcpp::Any visitIdentifier(SolidityParser::IdentifierContext *context) = 0;
+
+    virtual antlrcpp::Any visitLiteral(SolidityParser::LiteralContext *context) = 0;
+
+    virtual antlrcpp::Any visitBooleanLiteral(SolidityParser::boolLiteralContext *context) = 0;
+
+    virtual antlrcpp::Any visitStringLiteral(SolidityParser::StringLiteralContext *context) = 0;
+
+    virtual antlrcpp::Any visitHexStringLiteral(SolidityParser::HexStringLiteralContext *context) = 0;
+
+    virtual antlrcpp::Any visitUnicodeStringLiteral(SolidityParser::UnicodeStringLiteralContext *context) = 0;
+
+    virtual antlrcpp::Any visitNumberLiteral(SolidityParser::NumberLiteralContext *context) = 0;
+
+    virtual antlrcpp::Any visitBlock(SolidityParser::BlockContext *context) = 0;
+
+    virtual antlrcpp::Any visitStatement(SolidityParser::StatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitSimpleStatement(SolidityParser::SimpleStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitIfStatement(SolidityParser::IfStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitForStatement(SolidityParser::ForStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitWhileStatement(SolidityParser::WhileStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitDoWhileStatement(SolidityParser::DoWhileStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitContinueStatement(SolidityParser::ContinueStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitBreakStatement(SolidityParser::BreakStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitTryStatement(SolidityParser::TryStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitCatchClause(SolidityParser::CatchClauseContext *context) = 0;
+
+    virtual antlrcpp::Any visitReturnStatement(SolidityParser::ReturnStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitEmitStatement(SolidityParser::EmitStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitAssemblyStatement(SolidityParser::AssemblyStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitVariableDeclarationList(SolidityParser::VariableDeclarationListContext *context) = 0;
+
+    virtual antlrcpp::Any visitVariableDeclarationTuple(SolidityParser::VariableDeclarationTupleContext *context) = 0;
+
+    virtual antlrcpp::Any visitVariableDeclarationStatement(SolidityParser::VariableDeclarationStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitExpressionStatement(SolidityParser::ExpressionStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitMappingType(SolidityParser::MappingTypeContext *context) = 0;
+
+    virtual antlrcpp::Any visitMappingKeyType(SolidityParser::MappingKeyTypeContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulStatement(SolidityParser::YulStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulBlock(SolidityParser::YulBlockContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulVariableDeclaration(SolidityParser::YulVariableDeclarationContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulAssignment(SolidityParser::YulAssignmentContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulIfStatement(SolidityParser::YulIfStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulForStatement(SolidityParser::YulForStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulSwitchCase(SolidityParser::YulSwitchCaseContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulSwitchStatement(SolidityParser::YulSwitchStatementContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulFunctionDefinition(SolidityParser::YulFunctionDefinitionContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulPath(SolidityParser::YulPathContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulFunctionCall(SolidityParser::YulFunctionCallContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulBoolean(SolidityParser::YulboolContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulLiteral(SolidityParser::YulLiteralContext *context) = 0;
+
+    virtual antlrcpp::Any visitYulExpression(SolidityParser::YulExpressionContext *context) = 0;
+
+
+};
+

test/tools/ossfuzz/libFuzzerMutator.cpp

@@ -0,0 +1,49 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "libFuzzerMutator.h"
+
+#include <antlr4-runtime/antlr4-runtime.h>
+#include <cstring>
+
+using namespace std;
+using namespace antlr4;
+using namespace solidity::test::fuzzer;
+
+size_t CustomMutator::mutation(Mutation _mut)
+{
+	if (MaxMutantSize <= Size || Size == 0)
+		return LLVMFuzzerMutate(Data, Size,	MaxMutantSize);
+
+	switch (_mut)
+	{
+	case Mutation::ANTLR:
+	{
+		string mutant = Visitor.toString();
+		if (mutant.empty())
+			return LLVMFuzzerMutate(Data, Size, MaxMutantSize);
+		else
+		{
+			size_t mutantSize = mutant.size() >= MaxMutantSize ? MaxMutantSize - 1 : mutant.size();
+			mempcpy(Data, mutant.data(), mutantSize);
+			return mutantSize;
+		}
+	}
+	case Mutation::NUMMUTATIONS:
+		assert(false);
+	}
+}

test/tools/ossfuzz/libFuzzerMutator.h

@@ -0,0 +1,80 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#pragma once
+
+#include <test/tools/ossfuzz/antlr4-runtime/SolidityLexer.h>
+#include <test/tools/ossfuzz/antlr4-runtime/SolidityMutator.h>
+#include <test/tools/ossfuzz/antlr4-runtime/SolidityParser.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <ostream>
+#include <random>
+
+extern "C" size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize);
+
+namespace solidity::test::fuzzer
+{
+	struct CustomMutator
+	{
+		using RandomEngine = std::mt19937_64;
+
+		explicit CustomMutator(uint8_t* _data, size_t _size, size_t _maxSize, unsigned _seed = 1337):
+			Rand(_seed),
+			Data(_data),
+			Size(_size),
+			In(std::string(_data, _data + _size)),
+			MaxMutantSize(_maxSize),
+			AStream(In),
+			Lexer(&AStream),
+			Tokens(&Lexer),
+			Parser(&Tokens)
+		{
+			Lexer.removeErrorListeners();
+			Parser.removeErrorListeners();
+			Parser.sourceUnit()->accept(&Visitor);
+		}
+
+		enum class Mutation
+		{
+			ANTLR,
+			NUMMUTATIONS
+		};
+
+		size_t mutate()
+		{
+			return mutation(static_cast<Mutation>(Rand() % static_cast<unsigned int>(Mutation::NUMMUTATIONS)));
+		}
+
+		size_t mutation(Mutation _mut);
+
+		RandomEngine Rand;
+		uint8_t* Data;
+		size_t Size;
+		std::string In;
+		std::string Out;
+		size_t MaxMutantSize;
+
+		antlr4::ANTLRInputStream AStream;
+		SolidityLexer Lexer;
+		antlr4::CommonTokenStream Tokens;
+		SolidityParser Parser;
+		SolidityMutator Visitor;
+	};
+
+}

test/tools/ossfuzz/solc_noopt_ossfuzz.cpp

@@ -14,17 +14,36 @@
 	You should have received a copy of the GNU General Public License
 	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
 */
-// SPDX-License-Identifier: GPL-3.0
 
 #include <test/tools/fuzzer_common.h>
 
+#include <test/tools/ossfuzz/libFuzzerMutator.h>
+
 #include <test/TestCaseReader.h>
 
 #include <sstream>
 
+using namespace solidity::test::fuzzer;
 using namespace solidity::frontend::test;
 using namespace std;
 
+extern "C" size_t LLVMFuzzerCustomMutator(
+	uint8_t* _data,
+	size_t _size,
+	size_t _maxSize,
+	unsigned int _seed
+)
+{
+	try
+	{
+		return CustomMutator(_data, _size, _maxSize, _seed).mutate();
+	}
+	catch (range_error const&)
+	{
+		return LLVMFuzzerMutate(_data, _size, _maxSize);
+	}
+}
+
 extern "C" int LLVMFuzzerTestOneInput(uint8_t const* _data, size_t _size)
 {
 	if (_size <= 600)