From 28876bb9a684876104ca9f21d431d3630474580c Mon Sep 17 00:00:00 2001 From: Martin Holst Swende Date: Wed, 18 Oct 2023 09:46:41 +0200 Subject: [PATCH] tests/fuzzers: merge abifuzzer into _test-file --- tests/fuzzers/abi/abifuzzer.go | 170 ---------------------------- tests/fuzzers/abi/abifuzzer_test.go | 164 ++++++++++++++++++++++++--- 2 files changed, 148 insertions(+), 186 deletions(-) delete mode 100644 tests/fuzzers/abi/abifuzzer.go diff --git a/tests/fuzzers/abi/abifuzzer.go b/tests/fuzzers/abi/abifuzzer.go deleted file mode 100644 index c13a80006c..0000000000 --- a/tests/fuzzers/abi/abifuzzer.go +++ /dev/null @@ -1,170 +0,0 @@ -// Copyright 2020 The go-ethereum Authors -// This file is part of the go-ethereum library. -// -// The go-ethereum library is free software: you can redistribute it and/or modify -// it under the terms of the GNU Lesser General Public License as published by -// the Free Software Foundation, either version 3 of the License, or -// (at your option) any later version. -// -// The go-ethereum library is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU Lesser General Public License for more details. -// -// You should have received a copy of the GNU Lesser General Public License -// along with the go-ethereum library. If not, see . - -package abi - -import ( - "fmt" - "reflect" - "strings" - - "github.com/ethereum/go-ethereum/accounts/abi" - fuzz "github.com/google/gofuzz" -) - -var ( - names = []string{"_name", "name", "NAME", "name_", "__", "_name_", "n"} - stateMut = []string{"", "pure", "view", "payable"} - stateMutabilites = []*string{&stateMut[0], &stateMut[1], &stateMut[2], &stateMut[3]} - pays = []string{"", "true", "false"} - payables = []*string{&pays[0], &pays[1]} - vNames = []string{"a", "b", "c", "d", "e", "f", "g"} - varNames = append(vNames, names...) - varTypes = []string{"bool", "address", "bytes", "string", - "uint8", "int8", "uint8", "int8", "uint16", "int16", - "uint24", "int24", "uint32", "int32", "uint40", "int40", "uint48", "int48", "uint56", "int56", - "uint64", "int64", "uint72", "int72", "uint80", "int80", "uint88", "int88", "uint96", "int96", - "uint104", "int104", "uint112", "int112", "uint120", "int120", "uint128", "int128", "uint136", "int136", - "uint144", "int144", "uint152", "int152", "uint160", "int160", "uint168", "int168", "uint176", "int176", - "uint184", "int184", "uint192", "int192", "uint200", "int200", "uint208", "int208", "uint216", "int216", - "uint224", "int224", "uint232", "int232", "uint240", "int240", "uint248", "int248", "uint256", "int256", - "bytes1", "bytes2", "bytes3", "bytes4", "bytes5", "bytes6", "bytes7", "bytes8", "bytes9", "bytes10", "bytes11", - "bytes12", "bytes13", "bytes14", "bytes15", "bytes16", "bytes17", "bytes18", "bytes19", "bytes20", "bytes21", - "bytes22", "bytes23", "bytes24", "bytes25", "bytes26", "bytes27", "bytes28", "bytes29", "bytes30", "bytes31", - "bytes32", "bytes"} -) - -func unpackPack(abi abi.ABI, method string, input []byte) ([]interface{}, bool) { - if out, err := abi.Unpack(method, input); err == nil { - _, err := abi.Pack(method, out...) - if err != nil { - // We have some false positives as we can unpack these type successfully, but not pack them - if err.Error() == "abi: cannot use []uint8 as type [0]int8 as argument" || - err.Error() == "abi: cannot use uint8 as type int8 as argument" { - return out, false - } - panic(err) - } - return out, true - } - return nil, false -} - -func packUnpack(abi abi.ABI, method string, input *[]interface{}) bool { - if packed, err := abi.Pack(method, input); err == nil { - outptr := reflect.New(reflect.TypeOf(input)) - err := abi.UnpackIntoInterface(outptr.Interface(), method, packed) - if err != nil { - panic(err) - } - out := outptr.Elem().Interface() - if !reflect.DeepEqual(input, out) { - panic(fmt.Sprintf("unpackPack is not equal, \ninput : %x\noutput: %x", input, out)) - } - return true - } - return false -} - -type args struct { - name string - typ string -} - -func createABI(name string, stateMutability, payable *string, inputs []args) (abi.ABI, error) { - sig := fmt.Sprintf(`[{ "type" : "function", "name" : "%v" `, name) - if stateMutability != nil { - sig += fmt.Sprintf(`, "stateMutability": "%v" `, *stateMutability) - } - if payable != nil { - sig += fmt.Sprintf(`, "payable": %v `, *payable) - } - if len(inputs) > 0 { - sig += `, "inputs" : [ {` - for i, inp := range inputs { - sig += fmt.Sprintf(`"name" : "%v", "type" : "%v" `, inp.name, inp.typ) - if i+1 < len(inputs) { - sig += "," - } - } - sig += "} ]" - sig += `, "outputs" : [ {` - for i, inp := range inputs { - sig += fmt.Sprintf(`"name" : "%v", "type" : "%v" `, inp.name, inp.typ) - if i+1 < len(inputs) { - sig += "," - } - } - sig += "} ]" - } - sig += `}]` - - return abi.JSON(strings.NewReader(sig)) -} - -func runFuzzer(input []byte) int { - good := false - fuzzer := fuzz.NewFromGoFuzz(input) - - name := names[getUInt(fuzzer)%len(names)] - stateM := stateMutabilites[getUInt(fuzzer)%len(stateMutabilites)] - payable := payables[getUInt(fuzzer)%len(payables)] - maxLen := 5 - for k := 1; k < maxLen; k++ { - var arg []args - for i := k; i > 0; i-- { - argName := varNames[i] - argTyp := varTypes[getUInt(fuzzer)%len(varTypes)] - if getUInt(fuzzer)%10 == 0 { - argTyp += "[]" - } else if getUInt(fuzzer)%10 == 0 { - arrayArgs := getUInt(fuzzer)%30 + 1 - argTyp += fmt.Sprintf("[%d]", arrayArgs) - } - arg = append(arg, args{ - name: argName, - typ: argTyp, - }) - } - abi, err := createABI(name, stateM, payable, arg) - if err != nil { - continue - } - structs, b := unpackPack(abi, name, input) - c := packUnpack(abi, name, &structs) - good = good || b || c - } - if good { - return 1 - } - return 0 -} - -func FuzzAbi(input []byte) int { - return runFuzzer(input) -} - -func getUInt(fuzzer *fuzz.Fuzzer) int { - var i int - fuzzer.Fuzz(&i) - if i < 0 { - i = -i - if i < 0 { - return 0 - } - } - return i -} diff --git a/tests/fuzzers/abi/abifuzzer_test.go b/tests/fuzzers/abi/abifuzzer_test.go index f23a0612c8..a206beaf91 100644 --- a/tests/fuzzers/abi/abifuzzer_test.go +++ b/tests/fuzzers/abi/abifuzzer_test.go @@ -17,7 +17,13 @@ package abi import ( + "fmt" + "reflect" + "strings" "testing" + + "github.com/ethereum/go-ethereum/accounts/abi" + fuzz "github.com/google/gofuzz" ) // TestReplicate can be used to replicate crashers from the fuzzing tests. @@ -25,25 +31,151 @@ import ( func TestReplicate(t *testing.T) { testString := "\x20\x20\x20\x20\x20\x20\x20\x20\x80\x00\x00\x00\x20\x20\x20\x20\x00" data := []byte(testString) - runFuzzer(data) -} - -// TestGenerateCorpus can be used to add corpus for the fuzzer. -// Just replace corpusHex with the hexEncoded output you want to add to the fuzzer. -func TestGenerateCorpus(t *testing.T) { - /* - corpusHex := "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" - data := common.FromHex(corpusHex) - checksum := sha1.Sum(data) - outf := fmt.Sprintf("corpus/%x", checksum) - if err := os.WriteFile(outf, data, 0777); err != nil { - panic(err) - } - */ + fuzzAbi(data) } func Fuzz(f *testing.F) { f.Fuzz(func(t *testing.T, data []byte) { - FuzzAbi(data) + fuzzAbi(data) }) } + +var ( + names = []string{"_name", "name", "NAME", "name_", "__", "_name_", "n"} + stateMut = []string{"", "pure", "view", "payable"} + stateMutabilites = []*string{&stateMut[0], &stateMut[1], &stateMut[2], &stateMut[3]} + pays = []string{"", "true", "false"} + payables = []*string{&pays[0], &pays[1]} + vNames = []string{"a", "b", "c", "d", "e", "f", "g"} + varNames = append(vNames, names...) + varTypes = []string{"bool", "address", "bytes", "string", + "uint8", "int8", "uint8", "int8", "uint16", "int16", + "uint24", "int24", "uint32", "int32", "uint40", "int40", "uint48", "int48", "uint56", "int56", + "uint64", "int64", "uint72", "int72", "uint80", "int80", "uint88", "int88", "uint96", "int96", + "uint104", "int104", "uint112", "int112", "uint120", "int120", "uint128", "int128", "uint136", "int136", + "uint144", "int144", "uint152", "int152", "uint160", "int160", "uint168", "int168", "uint176", "int176", + "uint184", "int184", "uint192", "int192", "uint200", "int200", "uint208", "int208", "uint216", "int216", + "uint224", "int224", "uint232", "int232", "uint240", "int240", "uint248", "int248", "uint256", "int256", + "bytes1", "bytes2", "bytes3", "bytes4", "bytes5", "bytes6", "bytes7", "bytes8", "bytes9", "bytes10", "bytes11", + "bytes12", "bytes13", "bytes14", "bytes15", "bytes16", "bytes17", "bytes18", "bytes19", "bytes20", "bytes21", + "bytes22", "bytes23", "bytes24", "bytes25", "bytes26", "bytes27", "bytes28", "bytes29", "bytes30", "bytes31", + "bytes32", "bytes"} +) + +func unpackPack(abi abi.ABI, method string, input []byte) ([]interface{}, bool) { + if out, err := abi.Unpack(method, input); err == nil { + _, err := abi.Pack(method, out...) + if err != nil { + // We have some false positives as we can unpack these type successfully, but not pack them + if err.Error() == "abi: cannot use []uint8 as type [0]int8 as argument" || + err.Error() == "abi: cannot use uint8 as type int8 as argument" { + return out, false + } + panic(err) + } + return out, true + } + return nil, false +} + +func packUnpack(abi abi.ABI, method string, input *[]interface{}) bool { + if packed, err := abi.Pack(method, input); err == nil { + outptr := reflect.New(reflect.TypeOf(input)) + err := abi.UnpackIntoInterface(outptr.Interface(), method, packed) + if err != nil { + panic(err) + } + out := outptr.Elem().Interface() + if !reflect.DeepEqual(input, out) { + panic(fmt.Sprintf("unpackPack is not equal, \ninput : %x\noutput: %x", input, out)) + } + return true + } + return false +} + +type args struct { + name string + typ string +} + +func createABI(name string, stateMutability, payable *string, inputs []args) (abi.ABI, error) { + sig := fmt.Sprintf(`[{ "type" : "function", "name" : "%v" `, name) + if stateMutability != nil { + sig += fmt.Sprintf(`, "stateMutability": "%v" `, *stateMutability) + } + if payable != nil { + sig += fmt.Sprintf(`, "payable": %v `, *payable) + } + if len(inputs) > 0 { + sig += `, "inputs" : [ {` + for i, inp := range inputs { + sig += fmt.Sprintf(`"name" : "%v", "type" : "%v" `, inp.name, inp.typ) + if i+1 < len(inputs) { + sig += "," + } + } + sig += "} ]" + sig += `, "outputs" : [ {` + for i, inp := range inputs { + sig += fmt.Sprintf(`"name" : "%v", "type" : "%v" `, inp.name, inp.typ) + if i+1 < len(inputs) { + sig += "," + } + } + sig += "} ]" + } + sig += `}]` + + return abi.JSON(strings.NewReader(sig)) +} + +func fuzzAbi(input []byte) int { + good := false + fuzzer := fuzz.NewFromGoFuzz(input) + + name := names[getUInt(fuzzer)%len(names)] + stateM := stateMutabilites[getUInt(fuzzer)%len(stateMutabilites)] + payable := payables[getUInt(fuzzer)%len(payables)] + maxLen := 5 + for k := 1; k < maxLen; k++ { + var arg []args + for i := k; i > 0; i-- { + argName := varNames[i] + argTyp := varTypes[getUInt(fuzzer)%len(varTypes)] + if getUInt(fuzzer)%10 == 0 { + argTyp += "[]" + } else if getUInt(fuzzer)%10 == 0 { + arrayArgs := getUInt(fuzzer)%30 + 1 + argTyp += fmt.Sprintf("[%d]", arrayArgs) + } + arg = append(arg, args{ + name: argName, + typ: argTyp, + }) + } + abi, err := createABI(name, stateM, payable, arg) + if err != nil { + continue + } + structs, b := unpackPack(abi, name, input) + c := packUnpack(abi, name, &structs) + good = good || b || c + } + if good { + return 1 + } + return 0 +} + +func getUInt(fuzzer *fuzz.Fuzzer) int { + var i int + fuzzer.Fuzz(&i) + if i < 0 { + i = -i + if i < 0 { + return 0 + } + } + return i +}