/*
This file is part of solidity.
solidity is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
solidity is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with solidity. If not, see .
*/
// SPDX-License-Identifier: GPL-3.0
#include
#include
#include
#include
#include
#include
using namespace solidity::frontend::test;
using namespace std;
// Prototype as we can't use the FuzzerInterface.h header.
extern "C" int LLVMFuzzerTestOneInput(uint8_t const* _data, size_t _size);
extern "C" size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize);
struct CustomMutator {
using RandomEngine = std::mt19937_64;
using Distribution = std::uniform_int_distribution;
explicit CustomMutator(unsigned _seed = 1337): Rand(_seed) {}
enum class Mutation {
DEFAULT,
ADDSTMT,
NUMMUTATIONS
};
size_t operator()(uint8_t* _data, size_t _size, size_t _maxSize, unsigned int _seed)
{
return this->operator()(
_data,
_size,
_maxSize,
static_cast(_seed % static_cast(Mutation::NUMMUTATIONS))
);
}
size_t operator()(uint8_t* _data, size_t _size, size_t _maxSize, Mutation _mut)
{
if (_maxSize <= _size || _size == 0)
return LLVMFuzzerMutate(_data, _size, _maxSize);
switch (_mut)
{
case Mutation::DEFAULT:
return LLVMFuzzerMutate(_data, _size, _maxSize);
case Mutation::ADDSTMT:
return addStmt(_data, _size, _maxSize);
case Mutation::NUMMUTATIONS:
solAssert(false, "Solc fuzzer: Invalid mutation selected");
}
}
size_t addStmt(uint8_t* _data, size_t _size, size_t _maxSize)
{
Distribution stmtDist(0, s_statements.size());
Distribution posDist(0, _size);
// Pseudo randomly choose statement
size_t idx = stmtDist(Rand);
// Pseudo randomly choose mutation position
size_t pos = posDist(Rand);
string stmt = s_statements[idx];
size_t stmtLen = stmt.size();
// Fit length must not equal/exceed maxSize
size_t fitLen = 0;
if (pos + stmtLen >= _maxSize)
fitLen = _maxSize - pos - 1;
else
fitLen = stmtLen;
memcpy(
static_cast(_data + pos),
static_cast(stmt.data()),
fitLen
);
size_t newSize = pos + fitLen > _size ? pos + fitLen : _size;
return newSize;
}
RandomEngine Rand;
};
extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* _data, size_t _size, size_t _maxSize, unsigned int _seed)
{
return CustomMutator{}(_data, _size, _maxSize, _seed);
}
extern "C" int LLVMFuzzerTestOneInput(uint8_t const* _data, size_t _size)
{
if (_size <= 600)
{
string input(reinterpret_cast(_data), _size);
map sourceCode;
try
{
TestCaseReader t = TestCaseReader(std::istringstream(input));
sourceCode = t.sources().sources;
map settings = t.settings();
bool compileViaYul =
settings.count("compileViaYul") &&
(settings.at("compileViaYul") == "also" || settings.at("compileViaYul") == "true");
bool optimize = settings.count("optimize") && settings.at("optimize") == "true";
FuzzerUtil::testCompiler(
sourceCode,
optimize,
/*_rand=*/static_cast(_size),
/*forceSMT=*/true,
compileViaYul
);
}
catch (runtime_error const&)
{
return 0;
}
}
return 0;
}