9a6357ab09
Abiv2 use bytes string longer than 32 bytes |
||
---|---|---|
.. | ||
config | ||
abiV2FuzzerCommon.cpp | ||
abiV2FuzzerCommon.h | ||
abiV2Proto.proto | ||
abiV2ProtoFuzzer.cpp | ||
CMakeLists.txt | ||
const_opt_ossfuzz.cpp | ||
protoToAbiV2.cpp | ||
protoToAbiV2.h | ||
protoToYul.cpp | ||
protoToYul.h | ||
README.md | ||
solc_noopt_ossfuzz.cpp | ||
solc_opt_ossfuzz.cpp | ||
strictasm_assembly_ossfuzz.cpp | ||
strictasm_diff_ossfuzz.cpp | ||
strictasm_opt_ossfuzz.cpp | ||
yulFuzzerCommon.cpp | ||
yulFuzzerCommon.h | ||
yulOptimizerFuzzDictionary.h | ||
yulProto_diff_ossfuzz.cpp | ||
yulProto.proto | ||
yulProtoFuzzer.cpp |
Intro
oss-fuzz is Google's fuzzing infrastructure that performs continuous fuzzing. What this means is that, each and every upstream commit is automatically fetched by the infrastructure and fuzzed.
What does this directory contain?
To help oss-fuzz do this, we (as project maintainers) need to provide the following:
- test harnesses: C/C++ tests that define the
LLVMFuzzerTestOneInput
API. This determines what is to be fuzz tested. - build infrastructure: (c)make targets per fuzzing binary. Fuzzing requires coverage and memory instrumentation of the code to be fuzzed.
- configuration files: These are files with the
.options
extension that are parsed by oss-fuzz. The only option that we use currently is thedictionary
option that asks the fuzzing engines behind oss-fuzz to use the specified dictionary. The specified dictionary happens to besolidity.dict.
solidity.dict
contains Solidity-specific syntactical tokens that are more likely to guide the fuzzer towards generating parseable and varied Solidity input.
To be consistent and aid better evaluation of the utility of the fuzzing dictionary, we stick to the following rules-of-thumb:
- Full tokens such as
block.number
are preceded and followed by a whitespace - Incomplete tokens including function calls such as
msg.sender.send()
are abbreviated.send(
to provide some leeway to the fuzzer to sythesize variants such asaddress(this).send()
- Language keywords are suffixed by a whitespace with the exception of those that end a line of code such as
break;
andcontinue;
What is libFuzzingEngine.a?
libFuzzingEngine.a
is an oss-fuzz-related dependency. It is present in the Dockerized environment in which Solidity's oss-fuzz code will be built.
Is this directory relevant for routine Solidity CI builds?
No. This is the reason why the add_subdirectory(ossfuzz)
cmake directive is nested under the if (OSSFUZZ)
predicate. OSSFUZZ
is a solidity-wide cmake option that is invoked by the ossfuzz solidity-builder-bot in order to compile solidity fuzzer binaries.