mirror
/
go-ethereum
mirror of https://github.com/ethereum/go-ethereum
2
0
Fork 1
Code Issues Releases Wiki Activity

tests/fuzzers/abi: better test generation (#22158)

Browse Source 
* tests/fuzzers/abi: better test generation

* tests/fuzzers/abi: fixed packing issue

* oss-fuzz: enable abi fuzzer
pull/22134/head
Marius van der Wijden 4 years ago committed by GitHub
parent 034ecc3210
commit 398182284c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 51 additions and 79 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 6
      oss-fuzz.sh
  2. 115
      tests/fuzzers/abi/abifuzzer.go
  3. 9
      tests/fuzzers/abi/abifuzzer_test.go

6
oss-fuzz.sh
Unescape View File

@ -100,6 +100,7 @@ compile_fuzzer tests/fuzzers/rlp Fuzz fuzzRlp
compile_fuzzer tests/fuzzers/trie Fuzz fuzzTrie
compile_fuzzer tests/fuzzers/stacktrie Fuzz fuzzStackTrie
compile_fuzzer tests/fuzzers/difficulty Fuzz fuzzDifficulty
compile_fuzzertests/fuzzers/abi Fuzz fuzzAbi
compile_fuzzer tests/fuzzers/bls12381 FuzzG1Add fuzz_g1_add
compile_fuzzer tests/fuzzers/bls12381 FuzzG1Mul fuzz_g1_mul
@ -113,8 +114,3 @@ compile_fuzzer tests/fuzzers/bls12381 FuzzMapG2 fuzz_map_g2
#TODO: move this to tests/fuzzers, if possible
compile_fuzzer crypto/blake2b Fuzz fuzzBlake2b
# This doesn't work very well @TODO
#compile_fuzzertests/fuzzers/abi Fuzz fuzzAbi

115
tests/fuzzers/abi/abifuzzer.go
Unescape View File

@ -17,38 +17,53 @@
package abi
import (
"bytes"
"fmt"
"math/rand"
"reflect"
"strings"
"github.com/ethereum/go-ethereum/accounts/abi"
"github.com/ethereum/go-ethereum/crypto"
fuzz "github.com/google/gofuzz"
)
func unpackPack(abi abi.ABI, method string, inputType []interface{}, input []byte) bool {
outptr := reflect.New(reflect.TypeOf(inputType))
if err := abi.UnpackIntoInterface(outptr.Interface(), method, input); err == nil {
output, err := abi.Pack(method, input)
var (
names = []string{"_name", "name", "NAME", "name_", "__", "_name_", "n"}
stateMut = []string{"", "pure", "view", "payable"}
stateMutabilites = []*string{&stateMut[0], &stateMut[1], &stateMut[2], &stateMut[3]}
pays = []string{"", "true", "false"}
payables = []*string{&pays[0], &pays[1]}
vNames = []string{"a", "b", "c", "d", "e", "f", "g"}
varNames = append(vNames, names...)
varTypes = []string{"bool", "address", "bytes", "string",
"uint8", "int8", "uint8", "int8", "uint16", "int16",
"uint24", "int24", "uint32", "int32", "uint40", "int40", "uint48", "int48", "uint56", "int56",
"uint64", "int64", "uint72", "int72", "uint80", "int80", "uint88", "int88", "uint96", "int96",
"uint104", "int104", "uint112", "int112", "uint120", "int120", "uint128", "int128", "uint136", "int136",
"uint144", "int144", "uint152", "int152", "uint160", "int160", "uint168", "int168", "uint176", "int176",
"uint184", "int184", "uint192", "int192", "uint200", "int200", "uint208", "int208", "uint216", "int216",
"uint224", "int224", "uint232", "int232", "uint240", "int240", "uint248", "int248", "uint256", "int256",
"bytes1", "bytes2", "bytes3", "bytes4", "bytes5", "bytes6", "bytes7", "bytes8", "bytes9", "bytes10", "bytes11",
"bytes12", "bytes13", "bytes14", "bytes15", "bytes16", "bytes17", "bytes18", "bytes19", "bytes20", "bytes21",
"bytes22", "bytes23", "bytes24", "bytes25", "bytes26", "bytes27", "bytes28", "bytes29", "bytes30", "bytes31",
"bytes32", "bytes"}
)
func unpackPack(abi abi.ABI, method string, input []byte) ([]interface{}, bool) {
if out, err := abi.Unpack(method, input); err == nil {
_, err := abi.Pack(method, out...)
if err != nil {
// We have some false positives as we can unpack these type successfully, but not pack them
if err.Error() == "abi: cannot use []uint8 as type [0]int8 as argument" ||
err.Error() == "abi: cannot use uint8 as type int8 as argument" {
return false
return out, false
}
panic(err)
}
if !bytes.Equal(input, output[4:]) {
panic(fmt.Sprintf("unpackPack is not equal, \ninput : %x\noutput: %x", input, output[4:]))
}
return true
return out, true
}
return false
return nil, false
}
func packUnpack(abi abi.ABI, method string, input []interface{}) bool {
func packUnpack(abi abi.ABI, method string, input *[]interface{}) bool {
if packed, err := abi.Pack(method, input); err == nil {
outptr := reflect.New(reflect.TypeOf(input))
err := abi.UnpackIntoInterface(outptr.Interface(), method, packed)
@ -100,64 +115,23 @@ func createABI(name string, stateMutability, payable *string, inputs []args) (ab
return abi.JSON(strings.NewReader(sig))
}
func fillStruct(structs []interface{}, data []byte) {
if structs != nil && len(data) != 0 {
fuzz.NewFromGoFuzz(data).Fuzz(&structs)
}
}
func createStructs(args []args) []interface{} {
structs := make([]interface{}, len(args))
for i, arg := range args {
t, err := abi.NewType(arg.typ, "", nil)
if err != nil {
panic(err)
}
structs[i] = reflect.New(t.GetType()).Elem()
}
return structs
}
func runFuzzer(input []byte) int {
good := false
fuzzer := fuzz.NewFromGoFuzz(input)
names := []string{"_name", "name", "NAME", "name_", "__", "_name_", "n"}
stateMut := []string{"", "pure", "view", "payable"}
stateMutabilites := []*string{nil, &stateMut[0], &stateMut[1], &stateMut[2], &stateMut[3]}
pays := []string{"true", "false"}
payables := []*string{nil, &pays[0], &pays[1]}
varNames := []string{"a", "b", "c", "d", "e", "f", "g"}
varNames = append(varNames, names...)
varTypes := []string{"bool", "address", "bytes", "string",
"uint8", "int8", "uint8", "int8", "uint16", "int16",
"uint24", "int24", "uint32", "int32", "uint40", "int40", "uint48", "int48", "uint56", "int56",
"uint64", "int64", "uint72", "int72", "uint80", "int80", "uint88", "int88", "uint96", "int96",
"uint104", "int104", "uint112", "int112", "uint120", "int120", "uint128", "int128", "uint136", "int136",
"uint144", "int144", "uint152", "int152", "uint160", "int160", "uint168", "int168", "uint176", "int176",
"uint184", "int184", "uint192", "int192", "uint200", "int200", "uint208", "int208", "uint216", "int216",
"uint224", "int224", "uint232", "int232", "uint240", "int240", "uint248", "int248", "uint256", "int256",
"bytes1", "bytes2", "bytes3", "bytes4", "bytes5", "bytes6", "bytes7", "bytes8", "bytes9", "bytes10", "bytes11",
"bytes12", "bytes13", "bytes14", "bytes15", "bytes16", "bytes17", "bytes18", "bytes19", "bytes20", "bytes21",
"bytes22", "bytes23", "bytes24", "bytes25", "bytes26", "bytes27", "bytes28", "bytes29", "bytes30", "bytes31",
"bytes32", "bytes"}
rnd := rand.New(rand.NewSource(123456))
if len(input) > 0 {
kec := crypto.Keccak256(input)
rnd = rand.New(rand.NewSource(int64(kec[0])))
}
name := names[rnd.Intn(len(names))]
stateM := stateMutabilites[rnd.Intn(len(stateMutabilites))]
payable := payables[rnd.Intn(len(payables))]
name := names[getUInt(fuzzer)%len(names)]
stateM := stateMutabilites[getUInt(fuzzer)%len(stateMutabilites)]
payable := payables[getUInt(fuzzer)%len(payables)]
maxLen := 5
for k := 1; k < maxLen; k++ {
var arg []args
for i := k; i > 0; i-- {
argName := varNames[i]
argTyp := varTypes[rnd.Int31n(int32(len(varTypes)))]
if rnd.Int31n(10) == 0 {
argTyp := varTypes[getUInt(fuzzer)%len(varTypes)]
if getUInt(fuzzer)%10 == 0 {
argTyp += "[]"
} else if rnd.Int31n(10) == 0 {
arrayArgs := rnd.Int31n(30) + 1
} else if getUInt(fuzzer)%10 == 0 {
arrayArgs := getUInt(fuzzer)%30 + 1
argTyp += fmt.Sprintf("[%d]", arrayArgs)
}
arg = append(arg, args{
@ -169,10 +143,8 @@ func runFuzzer(input []byte) int {
if err != nil {
continue
}
structs := createStructs(arg)
b := unpackPack(abi, name, structs, input)
fillStruct(structs, input)
c := packUnpack(abi, name, structs)
structs, b := unpackPack(abi, name, input)
c := packUnpack(abi, name, &structs)
good = good || b || c
}
if good {
@ -184,3 +156,12 @@ func runFuzzer(input []byte) int {
func Fuzz(input []byte) int {
return runFuzzer(input)
}
func getUInt(fuzzer *fuzz.Fuzzer) int {
var i int
fuzzer.Fuzz(&i)
if i < 0 {
i *= -1
}
return i
}

9
tests/fuzzers/abi/abifuzzer_test.go
Unescape View File

@ -23,13 +23,8 @@ import (
// TestReplicate can be used to replicate crashers from the fuzzing tests.
// Just replace testString with the data in .quoted
func TestReplicate(t *testing.T) {
testString := "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00" +
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
"\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00000000000" +
"00000000000000000000" +
"00000000000000000000" +
"00000001"
testString := "N\xef\xbf0\xef\xbf99000000000000" +
"000000000000"
data := []byte(testString)
runFuzzer(data)

Write Preview
Loading…
Cancel
Save