tests, accounts/abi: move fuzzer to accounts/abi

accounts/abi/abifuzzer_test.go

@@ -22,19 +22,19 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/ethereum/go-ethereum/accounts/abi"
+	"github.com/google/gofuzz"
-	fuzz "github.com/google/gofuzz"
 )
 
 // TestReplicate can be used to replicate crashers from the fuzzing tests.
 // Just replace testString with the data in .quoted
 func TestReplicate(t *testing.T) {
-	testString := "\x20\x20\x20\x20\x20\x20\x20\x20\x80\x00\x00\x00\x20\x20\x20\x20\x00"
+	//t.Skip("Test only useful for reproducing issues")
-	data := []byte(testString)
+	fuzzAbi([]byte("\x20\x20\x20\x20\x20\x20\x20\x20\x80\x00\x00\x00\x20\x20\x20\x20\x00"))
-	fuzzAbi(data)
+	//fuzzAbi([]byte("asdfasdfkadsf;lasdf;lasd;lfk"))
 }
 
-func Fuzz(f *testing.F) {
+// FuzzABI is the main entrypoint for fuzzing
+func FuzzABI(f *testing.F) {
 	f.Fuzz(func(t *testing.T, data []byte) {
 		fuzzAbi(data)
 	})
@@ -42,10 +42,8 @@ func Fuzz(f *testing.F) {
 
 var (
 	names    = []string{"_name", "name", "NAME", "name_", "__", "_name_", "n"}
-	stateMut         = []string{"", "pure", "view", "payable"}
+	stateMut = []string{"pure", "view", "payable"}
-	stateMutabilites = []*string{&stateMut[0], &stateMut[1], &stateMut[2], &stateMut[3]}
+	pays     = []string{"true", "false"}
-	pays             = []string{"", "true", "false"}
-	payables         = []*string{&pays[0], &pays[1]}
 	vNames   = []string{"a", "b", "c", "d", "e", "f", "g"}
 	varNames = append(vNames, names...)
 	varTypes = []string{"bool", "address", "bytes", "string",
@@ -62,7 +60,7 @@ var (
 		"bytes32", "bytes"}
 )
 
-func unpackPack(abi abi.ABI, method string, input []byte) ([]interface{}, bool) {
+func unpackPack(abi ABI, method string, input []byte) ([]interface{}, bool) {
 	if out, err := abi.Unpack(method, input); err == nil {
 		_, err := abi.Pack(method, out...)
 		if err != nil {
@@ -78,7 +76,7 @@ func unpackPack(abi abi.ABI, method string, input []byte) ([]interface{}, bool)
 	return nil, false
 }
 
-func packUnpack(abi abi.ABI, method string, input *[]interface{}) bool {
+func packUnpack(abi ABI, method string, input *[]interface{}) bool {
 	if packed, err := abi.Pack(method, input); err == nil {
 		outptr := reflect.New(reflect.TypeOf(input))
 		err := abi.UnpackIntoInterface(outptr.Interface(), method, packed)
@@ -94,12 +92,12 @@ func packUnpack(abi abi.ABI, method string, input *[]interface{}) bool {
 	return false
 }
 
-type args struct {
+type arg struct {
 	name string
 	typ  string
 }
 
-func createABI(name string, stateMutability, payable *string, inputs []args) (abi.ABI, error) {
+func createABI(name string, stateMutability, payable *string, inputs []arg) (ABI, error) {
 	sig := fmt.Sprintf(`[{ "type" : "function", "name" : "%v" `, name)
 	if stateMutability != nil {
 		sig += fmt.Sprintf(`, "stateMutability": "%v" `, *stateMutability)
@@ -126,56 +124,55 @@ func createABI(name string, stateMutability, payable *string, inputs []args) (ab
 		sig += "} ]"
 	}
 	sig += `}]`
-
+	//fmt.Printf("sig: %s\n", sig)
-	return abi.JSON(strings.NewReader(sig))
+	return JSON(strings.NewReader(sig))
 }
 
-func fuzzAbi(input []byte) int {
+func fuzzAbi(input []byte) {
-	good := false
+	var (
-	fuzzer := fuzz.NewFromGoFuzz(input)
+		fuzzer    = fuzz.NewFromGoFuzz(input)
-
+		name      = oneOf(fuzzer, names)
-	name := names[getUInt(fuzzer)%len(names)]
+		stateM    = oneOfOrNil(fuzzer, stateMut)
-	stateM := stateMutabilites[getUInt(fuzzer)%len(stateMutabilites)]
+		payable   = oneOfOrNil(fuzzer, pays)
-	payable := payables[getUInt(fuzzer)%len(payables)]
+		arguments []arg
-	maxLen := 5
+	)
-	for k := 1; k < maxLen; k++ {
+	for i := 0; i < upTo(fuzzer, 10); i++ {
-		var arg []args
+		argName := oneOf(fuzzer, varNames)
-		for i := k; i > 0; i-- {
+		argTyp := oneOf(fuzzer, varTypes)
-			argName := varNames[i]
+		switch upTo(fuzzer, 10) {
-			argTyp := varTypes[getUInt(fuzzer)%len(varTypes)]
+		case 0: // 10% chance to make it a slice
-			if getUInt(fuzzer)%10 == 0 {
 			argTyp += "[]"
-			} else if getUInt(fuzzer)%10 == 0 {
+		case 1: // 10% chance to make it an array
-				arrayArgs := getUInt(fuzzer)%30 + 1
+			argTyp += fmt.Sprintf("[%d]", 1+upTo(fuzzer, 30))
-				argTyp += fmt.Sprintf("[%d]", arrayArgs)
+		default:
 		}
-			arg = append(arg, args{
+		arguments = append(arguments, arg{name: argName, typ: argTyp})
-				name: argName,
-				typ:  argTyp,
-			})
 	}
-		abi, err := createABI(name, stateM, payable, arg)
+	abi, err := createABI(name, stateM, payable, arguments)
 	if err != nil {
-			continue
+		//fmt.Printf("err: %v\n", err)
+		panic(err)
 	}
-		structs, b := unpackPack(abi, name, input)
+	structs, _ := unpackPack(abi, name, input)
-		c := packUnpack(abi, name, &structs)
+	_ = packUnpack(abi, name, &structs)
-		good = good || b || c
-	}
-	if good {
-		return 1
-	}
-	return 0
 }
 
-func getUInt(fuzzer *fuzz.Fuzzer) int {
+func upTo(fuzzer *fuzz.Fuzzer, max int) int {
 	var i int
 	fuzzer.Fuzz(&i)
 	if i < 0 {
-		i = -i
+		return (-1 - i) % max
-		if i < 0 {
-			return 0
 	}
-	}
+	return int(i) % max
-	return i
+}
+
+func oneOf(fuzzer *fuzz.Fuzzer, options []string) string {
+	return options[upTo(fuzzer, len(options))]
+}
+
+func oneOfOrNil(fuzzer *fuzz.Fuzzer, options []string) *string {
+	if i := upTo(fuzzer, len(options)+1); i < len(options) {
+		return &options[i]
+	}
+	return nil
 }

oss-fuzz.sh

@@ -92,6 +92,8 @@ function compile_fuzzer() {
   cd -
 }
 
+compile_fuzzer accounts/abi        FuzzABI fuzzAbi
+
 compile_fuzzer tests/fuzzers/bitutil  FuzzEncoder      fuzzBitutilEncoder
 compile_fuzzer tests/fuzzers/bitutil  FuzzDecoder      fuzzBitutilDecoder
 compile_fuzzer tests/fuzzers/bn256    FuzzAdd   fuzzBn256Add
@@ -104,7 +106,6 @@ compile_fuzzer tests/fuzzers/rlp        Fuzz fuzzRlp
 compile_fuzzer tests/fuzzers/trie       Fuzz fuzzTrie
 compile_fuzzer tests/fuzzers/stacktrie  Fuzz fuzzStackTrie
 compile_fuzzer tests/fuzzers/difficulty Fuzz fuzzDifficulty
-compile_fuzzer tests/fuzzers/abi        Fuzz fuzzAbi
 compile_fuzzer tests/fuzzers/les        Fuzz fuzzLes
 compile_fuzzer tests/fuzzers/secp256k1  Fuzz fuzzSecp256k1
 compile_fuzzer tests/fuzzers/vflux      FuzzClientPool fuzzClientPool
@@ -129,5 +130,4 @@ compile_fuzzer tests/fuzzers/snap  FuzzSRange fuzz_storage_range
 compile_fuzzer tests/fuzzers/snap  FuzzByteCodes fuzz_byte_codes
 compile_fuzzer tests/fuzzers/snap  FuzzTrieNodes fuzz_trie_nodes
 
-#TODO: move this to tests/fuzzers, if possible
 compile_fuzzer crypto/blake2b  Fuzz      fuzzBlake2b