plugeth/tests/fuzzers
rjl493456442 6d2aeb43d5
cmd, core/state, eth, tests, trie: improve state reader (#27428)
The state availability is checked during the creation of a state reader.

-    In hash-based database, if the specified root node does not exist on disk disk, then
    the state reader won't be created and an error will be returned.

-    In path-based database, if the specified state layer is not available, then the
    state reader won't be created and an error will be returned.

This change also contains a stricter semantics regarding the `Commit` operation: once it has been performed, the trie is no longer usable, and certain operations will return an error.
2023-06-20 15:31:45 -04:00
..
abi all: replace uses of ioutil with io and os (#24869) 2022-05-16 11:59:35 +02:00
bitutil tests/fuzzers: fix false positive in bitutil fuzzer (#22076) 2020-12-27 21:58:39 +01:00
bls12381 tests/fuzzers: supply gnark multiexp config, fixes #26669 (#26670) 2023-02-13 08:14:34 -05:00
bn256 tests/fuzzers/bn256: add PairingCheck fuzzer (#27252) 2023-05-16 07:27:54 -04:00
difficulty all: fix docstrings 2022-10-04 09:18:02 +02:00
keystore tests/fuzzers: improve the fuzzers (#21829) 2020-11-13 12:36:38 +01:00
les all: move main transaction pool into a subpool (#27463) 2023-06-16 15:29:40 +03:00
rangeproof trie: remove parameter 'fromLevel' in Prove (#27512) 2023-06-19 16:28:40 +02:00
rlp test/fuzzers: fuzz rlp handling of big.Int and uint256.Int (#26917) 2023-04-03 05:42:34 -04:00
runtime all: fix spelling mistakes (#25961) 2022-10-11 09:37:00 +02:00
secp256k1 all: update license headers and AUTHORS from git history (#24947) 2022-05-24 20:39:40 +02:00
snap all: cleanup tests (#25641) 2022-09-07 20:21:59 +02:00
stacktrie cmd, core/state, eth, tests, trie: improve state reader (#27428) 2023-06-20 15:31:45 -04:00
trie cmd, core/state, eth, tests, trie: improve state reader (#27428) 2023-06-20 15:31:45 -04:00
txfetcher all: move main transaction pool into a subpool (#27463) 2023-06-16 15:29:40 +03:00
vflux all: replace uses of ioutil with io and os (#24869) 2022-05-16 11:59:35 +02:00
README.md all: fix typos in comments (#21118) 2020-05-25 10:21:28 +02:00

Fuzzers

To run a fuzzer locally, you need go-fuzz installed.

First build a fuzzing-binary out of the selected package:

(cd ./rlp && CGO_ENABLED=0 go-fuzz-build .)

That command should generate a rlp-fuzz.zip in the rlp/ directory. If you are already in that directory, you can do

[user@work rlp]$ go-fuzz
2019/11/26 13:36:54 workers: 6, corpus: 3 (3s ago), crashers: 0, restarts: 1/0, execs: 0 (0/sec), cover: 0, uptime: 3s
2019/11/26 13:36:57 workers: 6, corpus: 3 (6s ago), crashers: 0, restarts: 1/0, execs: 0 (0/sec), cover: 1054, uptime: 6s
2019/11/26 13:37:00 workers: 6, corpus: 3 (9s ago), crashers: 0, restarts: 1/8358, execs: 25074 (2786/sec), cover: 1054, uptime: 9s
2019/11/26 13:37:03 workers: 6, corpus: 3 (12s ago), crashers: 0, restarts: 1/8497, execs: 50986 (4249/sec), cover: 1054, uptime: 12s
2019/11/26 13:37:06 workers: 6, corpus: 3 (15s ago), crashers: 0, restarts: 1/9330, execs: 74640 (4976/sec), cover: 1054, uptime: 15s
2019/11/26 13:37:09 workers: 6, corpus: 3 (18s ago), crashers: 0, restarts: 1/9948, execs: 99482 (5527/sec), cover: 1054, uptime: 18s
2019/11/26 13:37:12 workers: 6, corpus: 3 (21s ago), crashers: 0, restarts: 1/9428, execs: 122568 (5836/sec), cover: 1054, uptime: 21s
2019/11/26 13:37:15 workers: 6, corpus: 3 (24s ago), crashers: 0, restarts: 1/9676, execs: 145152 (6048/sec), cover: 1054, uptime: 24s
2019/11/26 13:37:18 workers: 6, corpus: 3 (27s ago), crashers: 0, restarts: 1/9855, execs: 167538 (6205/sec), cover: 1054, uptime: 27s
2019/11/26 13:37:21 workers: 6, corpus: 3 (30s ago), crashers: 0, restarts: 1/9645, execs: 192901 (6430/sec), cover: 1054, uptime: 30s
2019/11/26 13:37:24 workers: 6, corpus: 3 (33s ago), crashers: 0, restarts: 1/9967, execs: 219294 (6645/sec), cover: 1054, uptime: 33s

Otherwise:

go-fuzz -bin ./rlp/rlp-fuzz.zip

Notes

Once a 'crasher' is found, the fuzzer tries to avoid reporting the same vector twice, so stores the fault in the suppressions folder. Thus, if you e.g. make changes to fix a bug, you should remove all data from the suppressions-folder, to verify that the issue is indeed resolved.

Also, if you have only one and the same exit-point for multiple different types of test, the suppression can make the fuzzer hide different types of errors. So make sure that each type of failure is unique (for an example, see the rlp fuzzer, where a counter i is used to differentiate between failures:

		if !bytes.Equal(input, output) {
			panic(fmt.Sprintf("case %d: encode-decode is not equal, \ninput : %x\noutput: %x", i, input, output))
		}