|
| 1 | +// Copyright 2020 The go-ethereum Authors |
| 2 | +// This file is part of the go-ethereum library. |
| 3 | +// |
| 4 | +// The go-ethereum library is free software: you can redistribute it and/or modify |
| 5 | +// it under the terms of the GNU Lesser General Public License as published by |
| 6 | +// the Free Software Foundation, either version 3 of the License, or |
| 7 | +// (at your option) any later version. |
| 8 | +// |
| 9 | +// The go-ethereum library is distributed in the hope that it will be useful, |
| 10 | +// but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 11 | +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 12 | +// GNU Lesser General Public License for more details. |
| 13 | +// |
| 14 | +// You should have received a copy of the GNU Lesser General Public License |
| 15 | +// along with the go-ethereum library. If not, see <http://www.gnu.org/licenses/>. |
| 16 | + |
| 17 | +package abi |
| 18 | + |
| 19 | +import ( |
| 20 | + "fmt" |
| 21 | + "reflect" |
| 22 | + "strings" |
| 23 | + "testing" |
| 24 | + |
| 25 | + fuzz "github.com/google/gofuzz" |
| 26 | +) |
| 27 | + |
| 28 | +// TestReplicate can be used to replicate crashers from the fuzzing tests. |
| 29 | +// Just replace testString with the data in .quoted |
| 30 | +func TestReplicate(t *testing.T) { |
| 31 | + //t.Skip("Test only useful for reproducing issues") |
| 32 | + fuzzAbi([]byte("\x20\x20\x20\x20\x20\x20\x20\x20\x80\x00\x00\x00\x20\x20\x20\x20\x00")) |
| 33 | + //fuzzAbi([]byte("asdfasdfkadsf;lasdf;lasd;lfk")) |
| 34 | +} |
| 35 | + |
| 36 | +// FuzzABI is the main entrypoint for fuzzing |
| 37 | +func FuzzABI(f *testing.F) { |
| 38 | + f.Fuzz(func(t *testing.T, data []byte) { |
| 39 | + fuzzAbi(data) |
| 40 | + }) |
| 41 | +} |
| 42 | + |
| 43 | +var ( |
| 44 | + names = []string{"_name", "name", "NAME", "name_", "__", "_name_", "n"} |
| 45 | + stateMut = []string{"pure", "view", "payable"} |
| 46 | + pays = []string{"true", "false"} |
| 47 | + vNames = []string{"a", "b", "c", "d", "e", "f", "g"} |
| 48 | + varNames = append(vNames, names...) |
| 49 | + varTypes = []string{"bool", "address", "bytes", "string", |
| 50 | + "uint8", "int8", "uint8", "int8", "uint16", "int16", |
| 51 | + "uint24", "int24", "uint32", "int32", "uint40", "int40", "uint48", "int48", "uint56", "int56", |
| 52 | + "uint64", "int64", "uint72", "int72", "uint80", "int80", "uint88", "int88", "uint96", "int96", |
| 53 | + "uint104", "int104", "uint112", "int112", "uint120", "int120", "uint128", "int128", "uint136", "int136", |
| 54 | + "uint144", "int144", "uint152", "int152", "uint160", "int160", "uint168", "int168", "uint176", "int176", |
| 55 | + "uint184", "int184", "uint192", "int192", "uint200", "int200", "uint208", "int208", "uint216", "int216", |
| 56 | + "uint224", "int224", "uint232", "int232", "uint240", "int240", "uint248", "int248", "uint256", "int256", |
| 57 | + "bytes1", "bytes2", "bytes3", "bytes4", "bytes5", "bytes6", "bytes7", "bytes8", "bytes9", "bytes10", "bytes11", |
| 58 | + "bytes12", "bytes13", "bytes14", "bytes15", "bytes16", "bytes17", "bytes18", "bytes19", "bytes20", "bytes21", |
| 59 | + "bytes22", "bytes23", "bytes24", "bytes25", "bytes26", "bytes27", "bytes28", "bytes29", "bytes30", "bytes31", |
| 60 | + "bytes32", "bytes"} |
| 61 | +) |
| 62 | + |
| 63 | +func unpackPack(abi ABI, method string, input []byte) ([]interface{}, bool) { |
| 64 | + if out, err := abi.Unpack(method, input); err == nil { |
| 65 | + _, err := abi.Pack(method, out...) |
| 66 | + if err != nil { |
| 67 | + // We have some false positives as we can unpack these type successfully, but not pack them |
| 68 | + if err.Error() == "abi: cannot use []uint8 as type [0]int8 as argument" || |
| 69 | + err.Error() == "abi: cannot use uint8 as type int8 as argument" { |
| 70 | + return out, false |
| 71 | + } |
| 72 | + panic(err) |
| 73 | + } |
| 74 | + return out, true |
| 75 | + } |
| 76 | + return nil, false |
| 77 | +} |
| 78 | + |
| 79 | +func packUnpack(abi ABI, method string, input *[]interface{}) bool { |
| 80 | + if packed, err := abi.Pack(method, input); err == nil { |
| 81 | + outptr := reflect.New(reflect.TypeOf(input)) |
| 82 | + err := abi.UnpackIntoInterface(outptr.Interface(), method, packed) |
| 83 | + if err != nil { |
| 84 | + panic(err) |
| 85 | + } |
| 86 | + out := outptr.Elem().Interface() |
| 87 | + if !reflect.DeepEqual(input, out) { |
| 88 | + panic(fmt.Sprintf("unpackPack is not equal, \ninput : %x\noutput: %x", input, out)) |
| 89 | + } |
| 90 | + return true |
| 91 | + } |
| 92 | + return false |
| 93 | +} |
| 94 | + |
| 95 | +type arg struct { |
| 96 | + name string |
| 97 | + typ string |
| 98 | +} |
| 99 | + |
| 100 | +func createABI(name string, stateMutability, payable *string, inputs []arg) (ABI, error) { |
| 101 | + sig := fmt.Sprintf(`[{ "type" : "function", "name" : "%v" `, name) |
| 102 | + if stateMutability != nil { |
| 103 | + sig += fmt.Sprintf(`, "stateMutability": "%v" `, *stateMutability) |
| 104 | + } |
| 105 | + if payable != nil { |
| 106 | + sig += fmt.Sprintf(`, "payable": %v `, *payable) |
| 107 | + } |
| 108 | + if len(inputs) > 0 { |
| 109 | + sig += `, "inputs" : [ {` |
| 110 | + for i, inp := range inputs { |
| 111 | + sig += fmt.Sprintf(`"name" : "%v", "type" : "%v" `, inp.name, inp.typ) |
| 112 | + if i+1 < len(inputs) { |
| 113 | + sig += "," |
| 114 | + } |
| 115 | + } |
| 116 | + sig += "} ]" |
| 117 | + sig += `, "outputs" : [ {` |
| 118 | + for i, inp := range inputs { |
| 119 | + sig += fmt.Sprintf(`"name" : "%v", "type" : "%v" `, inp.name, inp.typ) |
| 120 | + if i+1 < len(inputs) { |
| 121 | + sig += "," |
| 122 | + } |
| 123 | + } |
| 124 | + sig += "} ]" |
| 125 | + } |
| 126 | + sig += `}]` |
| 127 | + //fmt.Printf("sig: %s\n", sig) |
| 128 | + return JSON(strings.NewReader(sig)) |
| 129 | +} |
| 130 | + |
| 131 | +func fuzzAbi(input []byte) { |
| 132 | + var ( |
| 133 | + fuzzer = fuzz.NewFromGoFuzz(input) |
| 134 | + name = oneOf(fuzzer, names) |
| 135 | + stateM = oneOfOrNil(fuzzer, stateMut) |
| 136 | + payable = oneOfOrNil(fuzzer, pays) |
| 137 | + arguments []arg |
| 138 | + ) |
| 139 | + for i := 0; i < upTo(fuzzer, 10); i++ { |
| 140 | + argName := oneOf(fuzzer, varNames) |
| 141 | + argTyp := oneOf(fuzzer, varTypes) |
| 142 | + switch upTo(fuzzer, 10) { |
| 143 | + case 0: // 10% chance to make it a slice |
| 144 | + argTyp += "[]" |
| 145 | + case 1: // 10% chance to make it an array |
| 146 | + argTyp += fmt.Sprintf("[%d]", 1+upTo(fuzzer, 30)) |
| 147 | + default: |
| 148 | + } |
| 149 | + arguments = append(arguments, arg{name: argName, typ: argTyp}) |
| 150 | + } |
| 151 | + abi, err := createABI(name, stateM, payable, arguments) |
| 152 | + if err != nil { |
| 153 | + //fmt.Printf("err: %v\n", err) |
| 154 | + panic(err) |
| 155 | + } |
| 156 | + structs, _ := unpackPack(abi, name, input) |
| 157 | + _ = packUnpack(abi, name, &structs) |
| 158 | +} |
| 159 | + |
| 160 | +func upTo(fuzzer *fuzz.Fuzzer, max int) int { |
| 161 | + var i int |
| 162 | + fuzzer.Fuzz(&i) |
| 163 | + if i < 0 { |
| 164 | + return (-1 - i) % max |
| 165 | + } |
| 166 | + return i % max |
| 167 | +} |
| 168 | + |
| 169 | +func oneOf(fuzzer *fuzz.Fuzzer, options []string) string { |
| 170 | + return options[upTo(fuzzer, len(options))] |
| 171 | +} |
| 172 | + |
| 173 | +func oneOfOrNil(fuzzer *fuzz.Fuzzer, options []string) *string { |
| 174 | + if i := upTo(fuzzer, len(options)+1); i < len(options) { |
| 175 | + return &options[i] |
| 176 | + } |
| 177 | + return nil |
| 178 | +} |
0 commit comments