/* This file is part of solidity. solidity is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. solidity is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with solidity. If not, see . */ #include #include #include #include #include #include #include static evmc::VM evmone = evmc::VM{evmc_create_evmone()}; using namespace solidity; using namespace solidity::test; using namespace solidity::test::solprotofuzzer; using namespace solidity::util; using namespace solidity::test::abiv2fuzzer; using namespace std; namespace { /// Compares two runs of EVMC returing true if they are /// equal and false otherwise. bool isOutputExpected(evmc::result const& _run1, evmc::result const& _run2) { if (_run1.output_size != _run2.output_size) return false; if (getenv("SOL_DEBUG_FILE") != nullptr) { unsigned r = _run1.output_data[31] | _run1.output_data[30] << 8 | _run1.output_data[29] << 16 | _run1.output_data[28] << 24; std::cout << r << std::endl; } return (memcmp(_run1.output_data, _run2.output_data, _run1.output_size) == 0); } /// Accepts a reference to a user-specified input and returns an /// evmc_message with all of its fields zero initialized except /// gas and input fields. /// The gas field is set to the maximum permissible value so that we /// don't run into out of gas errors. The input field is copied from /// user input. evmc_message initializeMessage(bytes const& _input) { // Zero initialize all message fields evmc_message msg = {}; // Gas available (value of type int64_t) is set to its maximum // value. msg.gas = std::numeric_limits::max(); msg.input_data = _input.data(); msg.input_size = _input.size(); return msg; } /// Accepts host context implementation, and keccak256 hash of the function /// to be called at a specified address in the simulated blockchain as /// input and returns the result of the execution of the called function. evmc::result executeContract( EVMHost& _hostContext, bytes const& _functionHash, evmc_address _deployedAddress ) { evmc_message message = initializeMessage(_functionHash); message.destination = _deployedAddress; message.kind = EVMC_CALL; return _hostContext.call(message); } /// Accepts a reference to host context implementation and byte code /// as input and deploys it on the simulated blockchain. Returns the /// result of deployment. evmc::result deployContract(EVMHost& _hostContext, bytes const& _code) { evmc_message message = initializeMessage(_code); message.kind = EVMC_CREATE; return _hostContext.call(message); } std::pair compileContract( std::string _sourceCode, std::string _contractName, std::map const& _libraryAddresses = {}, frontend::OptimiserSettings _optimization = frontend::OptimiserSettings::minimal() ) { try { // Compile contract generated by the proto fuzzer SolidityCompilationFramework solCompilationFramework; return std::make_pair( solCompilationFramework.compileContract(_sourceCode, _contractName, _libraryAddresses, _optimization), solCompilationFramework.getMethodIdentifiers() ); } // Ignore stack too deep errors during compilation catch (evmasm::StackTooDeepException const&) { return std::make_pair(bytes{}, Json::Value(0)); } } evmc::result deployAndExecute(EVMHost& _hostContext, bytes _byteCode, std::string _hexEncodedInput) { // Deploy contract and signal failure if deploy failed evmc::result createResult = deployContract(_hostContext, _byteCode); solAssert( createResult.status_code == EVMC_SUCCESS, "Proto solc fuzzer: Contract creation failed" ); // Execute test function and signal failure if EVM reverted or // did not return expected output on successful execution. evmc::result callResult = executeContract( _hostContext, fromHex(_hexEncodedInput), createResult.create_address ); // We don't care about EVM One failures other than EVMC_REVERT solAssert(callResult.status_code != EVMC_REVERT, "Proto solc fuzzer: EVM One reverted"); return callResult; } evmc::result compileDeployAndExecute( std::string _sourceCode, std::string _contractName, std::string _methodName, frontend::OptimiserSettings _optimization, std::string _libraryName = {} ) { bytes libraryBytecode; Json::Value libIds; // We target the default EVM which is the latest langutil::EVMVersion version = {}; EVMHost hostContext(version, evmone); std::map _libraryAddressMap; // First deploy library if (!_libraryName.empty()) { tie(libraryBytecode, libIds) = compileContract( _sourceCode, _libraryName, {}, _optimization ); // Deploy contract and signal failure if deploy failed evmc::result createResult = deployContract(hostContext, libraryBytecode); solAssert( createResult.status_code == EVMC_SUCCESS, "Proto solc fuzzer: Library deployment failed" ); _libraryAddressMap[_libraryName] = EVMHost::convertFromEVMC(createResult.create_address); } auto [minimalBytecode, ids] = compileContract( _sourceCode, _contractName, _libraryAddressMap, _optimization ); return deployAndExecute( hostContext, minimalBytecode, ids[_methodName].asString() ); } } DEFINE_PROTO_FUZZER(Program const& _input) { ProtoConverter converter; string sol_source = converter.protoToSolidity(_input); if (const char* dump_path = getenv("PROTO_FUZZER_DUMP_PATH")) { // With libFuzzer binary run this to generate a YUL source file x.yul: // PROTO_FUZZER_DUMP_PATH=x.yul ./a.out proto-input ofstream of(dump_path); of.write(sol_source.data(), sol_source.size()); } if (const char* dump_path = getenv("SOL_DEBUG_FILE")) { sol_source.clear(); // With libFuzzer binary run this to generate a YUL source file x.yul: // PROTO_FUZZER_LOAD_PATH=x.yul ./a.out proto-input ifstream ifstr(dump_path); sol_source = { std::istreambuf_iterator(ifstr), std::istreambuf_iterator() }; std::cout << sol_source << std::endl; } auto minimalResult = compileDeployAndExecute( sol_source, ":C", "test()", frontend::OptimiserSettings::minimal(), converter.libraryTest() ? converter.libraryName() : "" ); auto optResult = compileDeployAndExecute( sol_source, ":C", "test()", frontend::OptimiserSettings::standard(), converter.libraryTest() ? converter.libraryName() : "" ); // Both executions should either return success or identical evmone status code bool successState = minimalResult.status_code == EVMC_SUCCESS && optResult.status_code == EVMC_SUCCESS; bool identicalState = minimalResult.status_code == optResult.status_code; bool executeState = successState || identicalState; solAssert(executeState, "Proto solc fuzzer: Different execution status"); if (successState) solAssert( isOutputExpected(minimalResult, optResult), "Proto solc fuzzer: Output mismatch" ); return; }