/* This file is part of solidity. solidity is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. solidity is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with solidity. If not, see . */ #include #include #include #include #include #include #include static evmc::VM evmone = evmc::VM{evmc_create_evmone()}; using namespace solidity::test::abiv2fuzzer; using namespace solidity::test::solarithfuzzer; using namespace solidity; using namespace solidity::test; using namespace solidity::util; using namespace std; namespace { /// Test function returns a uint256 value //static size_t const expectedOutputLength = 32; ///// Expected output value is decimal 0 //static uint8_t const expectedOutput[expectedOutputLength] = { // 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 //}; /// Compares the contents of the memory address pointed to /// by `_result` of `_length` bytes to the expected output. /// Returns true if `_result` matches expected output, false /// otherwise. //bool isOutputExpected(evmc::result const& _run) //{ // if (_run.output_size != expectedOutputLength) // return false; // // return (memcmp(_run.output_data, expectedOutput, expectedOutputLength) == 0); //} bool compareRuns(evmc::result const& _run1, evmc::result const& _run2) { if (_run1.output_size != _run2.output_size) return false; return memcmp(_run1.output_data, _run2.output_data, _run1.output_size) == 0; } /// Accepts a reference to a user-specified input and returns an /// evmc_message with all of its fields zero initialized except /// gas and input fields. /// The gas field is set to the maximum permissible value so that we /// don't run into out of gas errors. The input field is copied from /// user input. evmc_message initializeMessage(bytes const& _input) { // Zero initialize all message fields evmc_message msg = {}; // Gas available (value of type int64_t) is set to its maximum // value. msg.gas = std::numeric_limits::max(); msg.input_data = _input.data(); msg.input_size = _input.size(); return msg; } /// Accepts host context implementation, and keccak256 hash of the function /// to be called at a specified address in the simulated blockchain as /// input and returns the result of the execution of the called function. evmc::result executeContract( EVMHost& _hostContext, bytes const& _functionHash, evmc_address _deployedAddress ) { evmc_message message = initializeMessage(_functionHash); message.destination = _deployedAddress; message.kind = EVMC_CALL; return _hostContext.call(message); } /// Accepts a reference to host context implementation and byte code /// as input and deploys it on the simulated blockchain. Returns the /// result of deployment. evmc::result deployContract(EVMHost& _hostContext, bytes const& _code) { evmc_message message = initializeMessage(_code); message.kind = EVMC_CREATE; return _hostContext.call(message); } std::pair compileContract( std::string _sourceCode, std::string _contractName, std::map const& _libraryAddresses = {}, frontend::OptimiserSettings _optimization = frontend::OptimiserSettings::minimal() ) { try { // Compile contract generated by the proto fuzzer SolidityCompilationFramework solCompilationFramework; return std::make_pair( solCompilationFramework.compileContract(_sourceCode, _contractName, _libraryAddresses, _optimization), solCompilationFramework.getMethodIdentifiers() ); } // Ignore stack too deep errors during compilation catch (langutil::StackTooDeepError const&) { throw langutil::FuzzerError(); } } evmc::result deployAndExecute(EVMHost& _hostContext, bytes _byteCode, std::string _hexEncodedInput) { // Deploy contract and signal failure if deploy failed evmc::result createResult = deployContract(_hostContext, _byteCode); solAssert( createResult.status_code == EVMC_SUCCESS, "Proto solc fuzzer: Contract creation failed" ); // Execute test function and signal failure if EVM reverted or // did not return expected output on successful execution. evmc::result callResult = executeContract( _hostContext, fromHex(_hexEncodedInput), createResult.create_address ); // We don't care about EVM One failures other than EVMC_REVERT solAssert(callResult.status_code != EVMC_REVERT, "Proto solc fuzzer: EVM One reverted"); return callResult; } evmc::result compileDeployAndExecute( std::string _sourceCode, std::string _contractName, std::string _methodName, frontend::OptimiserSettings _optimization, std::string _libraryName = {} ) { bytes libraryBytecode; Json::Value libIds; // We target the default EVM which is the latest langutil::EVMVersion version = {}; EVMHost hostContext(version, evmone); std::map _libraryAddressMap; // First deploy library if (!_libraryName.empty()) { tie(libraryBytecode, libIds) = compileContract( _sourceCode, _libraryName, {}, _optimization ); // Deploy contract and signal failure if deploy failed evmc::result createResult = deployContract(hostContext, libraryBytecode); solAssert( createResult.status_code == EVMC_SUCCESS, "Proto solc fuzzer: Library deployment failed" ); _libraryAddressMap[_libraryName] = EVMHost::convertFromEVMC(createResult.create_address); } auto [bytecode, ids] = compileContract( _sourceCode, _contractName, _libraryAddressMap, _optimization ); return deployAndExecute( hostContext, bytecode, ids[_methodName].asString() ); } } DEFINE_PROTO_FUZZER(Program const& _input) { ProtoConverter converter; string sol_source = converter.programToString(_input); if (const char* dump_path = getenv("PROTO_FUZZER_DUMP_PATH")) { // With libFuzzer binary run this to generate a YUL source file x.yul: // PROTO_FUZZER_DUMP_PATH=x.yul ./a.out proto-input ofstream of(dump_path); of.write(sol_source.data(), sol_source.size()); } if (const char* dump_path = getenv("SOL_DEBUG_FILE")) { sol_source.clear(); // With libFuzzer binary run this to generate a YUL source file x.yul: // PROTO_FUZZER_LOAD_PATH=x.yul ./a.out proto-input ifstream ifstr(dump_path); sol_source = { std::istreambuf_iterator(ifstr), std::istreambuf_iterator() }; std::cout << sol_source << std::endl; } try { auto minimalResult = compileDeployAndExecute( sol_source, ":C", "test()", frontend::OptimiserSettings::minimal(), "" ); bool successState = minimalResult.status_code == EVMC_SUCCESS; auto optResult = compileDeployAndExecute( sol_source, ":C", "test()", frontend::OptimiserSettings::standard(), "" ); if (successState) { solAssert( optResult.status_code == EVMC_SUCCESS, "Sol arith fuzzer: Optimal code failed" ); solAssert( compareRuns(minimalResult, optResult), "Sol arith fuzzer: Runs produced different result" ); } } catch (langutil::FuzzerError const&) { } }