diff --git a/AGENTS.md b/AGENTS.md index b652ff7dc6..8e9148de3c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -53,3 +53,23 @@ All tests can be run via CTest. Make sure the build is up to date. - `ctest --test-dir build/debug --output-on-failure` - to filter tests use `-R ` + +## Fuzzing + +The fuzzer compares an external EVMC-compatible VM against evmone (the reference). + +### Run fuzzer with seed corpus + +```bash +EVMONE_EXTERNAL_OPTIONS= ./build/bin/evmone-fuzzer test/fuzzer/corpus/ +``` + +### Reproduce a single crash file + +```bash +EVMONE_EXTERNAL_OPTIONS= ./build/bin/evmone-fuzzer crash_files/ +``` + +### Seed corpus + +The seed corpus lives in `test/fuzzer/corpus/`. Each seed file name describes the EVM opcodes it exercises (e.g. `seed_sstore_sload.bin`, `seed_call_return.bin`). diff --git a/test/fuzzer/corpus/seed_add_mul_div.bin b/test/fuzzer/corpus/seed_add_mul_div.bin new file mode 100644 index 0000000000..48e954ed4f Binary files /dev/null and b/test/fuzzer/corpus/seed_add_mul_div.bin differ diff --git a/test/fuzzer/corpus/seed_add_tangerine.bin b/test/fuzzer/corpus/seed_add_tangerine.bin new file mode 100644 index 0000000000..4bc09a6d27 Binary files /dev/null and b/test/fuzzer/corpus/seed_add_tangerine.bin differ diff --git a/test/fuzzer/corpus/seed_addmod_mulmod.bin b/test/fuzzer/corpus/seed_addmod_mulmod.bin new file mode 100644 index 0000000000..f1d4bc1eac Binary files /dev/null and b/test/fuzzer/corpus/seed_addmod_mulmod.bin differ diff --git a/test/fuzzer/corpus/seed_address_caller_origin_gasprice.bin b/test/fuzzer/corpus/seed_address_caller_origin_gasprice.bin new file mode 100644 index 0000000000..4c723cd1e1 Binary files /dev/null and b/test/fuzzer/corpus/seed_address_caller_origin_gasprice.bin differ diff --git a/test/fuzzer/corpus/seed_and_or_xor_shl_shr.bin b/test/fuzzer/corpus/seed_and_or_xor_shl_shr.bin new file mode 100644 index 0000000000..28942d4b10 Binary files /dev/null and b/test/fuzzer/corpus/seed_and_or_xor_shl_shr.bin differ diff --git a/test/fuzzer/corpus/seed_blockhash.bin b/test/fuzzer/corpus/seed_blockhash.bin new file mode 100644 index 0000000000..6289a21ad0 Binary files /dev/null and b/test/fuzzer/corpus/seed_blockhash.bin differ diff --git a/test/fuzzer/corpus/seed_byte_swap.bin b/test/fuzzer/corpus/seed_byte_swap.bin new file mode 100644 index 0000000000..e68d1cbe39 Binary files /dev/null and b/test/fuzzer/corpus/seed_byte_swap.bin differ diff --git a/test/fuzzer/corpus/seed_call_return.bin b/test/fuzzer/corpus/seed_call_return.bin new file mode 100644 index 0000000000..7339acf3cc Binary files /dev/null and b/test/fuzzer/corpus/seed_call_return.bin differ diff --git a/test/fuzzer/corpus/seed_call_zero_all.bin b/test/fuzzer/corpus/seed_call_zero_all.bin new file mode 100644 index 0000000000..6f2aca939f Binary files /dev/null and b/test/fuzzer/corpus/seed_call_zero_all.bin differ diff --git a/test/fuzzer/corpus/seed_call_zero_value.bin b/test/fuzzer/corpus/seed_call_zero_value.bin new file mode 100644 index 0000000000..e45ad60fe0 Binary files /dev/null and b/test/fuzzer/corpus/seed_call_zero_value.bin differ diff --git a/test/fuzzer/corpus/seed_callcode.bin b/test/fuzzer/corpus/seed_callcode.bin new file mode 100644 index 0000000000..e646c47e5e Binary files /dev/null and b/test/fuzzer/corpus/seed_callcode.bin differ diff --git a/test/fuzzer/corpus/seed_calldataload_dispatcher.bin b/test/fuzzer/corpus/seed_calldataload_dispatcher.bin new file mode 100644 index 0000000000..b15eb942e3 Binary files /dev/null and b/test/fuzzer/corpus/seed_calldataload_dispatcher.bin differ diff --git a/test/fuzzer/corpus/seed_calldatasize_calldataload.bin b/test/fuzzer/corpus/seed_calldatasize_calldataload.bin new file mode 100644 index 0000000000..69b9585404 Binary files /dev/null and b/test/fuzzer/corpus/seed_calldatasize_calldataload.bin differ diff --git a/test/fuzzer/corpus/seed_callvalue_selfbalance_basefee.bin b/test/fuzzer/corpus/seed_callvalue_selfbalance_basefee.bin new file mode 100644 index 0000000000..93dcff80b7 Binary files /dev/null and b/test/fuzzer/corpus/seed_callvalue_selfbalance_basefee.bin differ diff --git a/test/fuzzer/corpus/seed_codesize_codecopy.bin b/test/fuzzer/corpus/seed_codesize_codecopy.bin new file mode 100644 index 0000000000..a0d8e20639 Binary files /dev/null and b/test/fuzzer/corpus/seed_codesize_codecopy.bin differ diff --git a/test/fuzzer/corpus/seed_difficulty_xor.bin b/test/fuzzer/corpus/seed_difficulty_xor.bin new file mode 100644 index 0000000000..c29b8adcdd Binary files /dev/null and b/test/fuzzer/corpus/seed_difficulty_xor.bin differ diff --git a/test/fuzzer/corpus/seed_dup_swap_add.bin b/test/fuzzer/corpus/seed_dup_swap_add.bin new file mode 100644 index 0000000000..560b3a2df4 Binary files /dev/null and b/test/fuzzer/corpus/seed_dup_swap_add.bin differ diff --git a/test/fuzzer/corpus/seed_empty_code.bin b/test/fuzzer/corpus/seed_empty_code.bin new file mode 100644 index 0000000000..a5c5dc4e05 Binary files /dev/null and b/test/fuzzer/corpus/seed_empty_code.bin differ diff --git a/test/fuzzer/corpus/seed_empty_large_input.bin b/test/fuzzer/corpus/seed_empty_large_input.bin new file mode 100644 index 0000000000..d6a21db989 Binary files /dev/null and b/test/fuzzer/corpus/seed_empty_large_input.bin differ diff --git a/test/fuzzer/corpus/seed_exp.bin b/test/fuzzer/corpus/seed_exp.bin new file mode 100644 index 0000000000..3eb244f572 Binary files /dev/null and b/test/fuzzer/corpus/seed_exp.bin differ diff --git a/test/fuzzer/corpus/seed_extcodecopy.bin b/test/fuzzer/corpus/seed_extcodecopy.bin new file mode 100644 index 0000000000..bd307ffa8f Binary files /dev/null and b/test/fuzzer/corpus/seed_extcodecopy.bin differ diff --git a/test/fuzzer/corpus/seed_extcodesize_extcodehash.bin b/test/fuzzer/corpus/seed_extcodesize_extcodehash.bin new file mode 100644 index 0000000000..c261c076b9 Binary files /dev/null and b/test/fuzzer/corpus/seed_extcodesize_extcodehash.bin differ diff --git a/test/fuzzer/corpus/seed_invalid_sload_sstore.bin b/test/fuzzer/corpus/seed_invalid_sload_sstore.bin new file mode 100644 index 0000000000..090b0817ae Binary files /dev/null and b/test/fuzzer/corpus/seed_invalid_sload_sstore.bin differ diff --git a/test/fuzzer/corpus/seed_invalid_with_input.bin b/test/fuzzer/corpus/seed_invalid_with_input.bin new file mode 100644 index 0000000000..e7defd296a Binary files /dev/null and b/test/fuzzer/corpus/seed_invalid_with_input.bin differ diff --git a/test/fuzzer/corpus/seed_jumpi_jumpdest.bin b/test/fuzzer/corpus/seed_jumpi_jumpdest.bin new file mode 100644 index 0000000000..e1a46ae3a0 Binary files /dev/null and b/test/fuzzer/corpus/seed_jumpi_jumpdest.bin differ diff --git a/test/fuzzer/corpus/seed_loop_jumpdest.bin b/test/fuzzer/corpus/seed_loop_jumpdest.bin new file mode 100644 index 0000000000..279e686370 Binary files /dev/null and b/test/fuzzer/corpus/seed_loop_jumpdest.bin differ diff --git a/test/fuzzer/corpus/seed_lt_gt_eq_iszero.bin b/test/fuzzer/corpus/seed_lt_gt_eq_iszero.bin new file mode 100644 index 0000000000..78d8eb5368 Binary files /dev/null and b/test/fuzzer/corpus/seed_lt_gt_eq_iszero.bin differ diff --git a/test/fuzzer/corpus/seed_mstore8_multi.bin b/test/fuzzer/corpus/seed_mstore8_multi.bin new file mode 100644 index 0000000000..60fc926e70 Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore8_multi.bin differ diff --git a/test/fuzzer/corpus/seed_mstore8_storage.bin b/test/fuzzer/corpus/seed_mstore8_storage.bin new file mode 100644 index 0000000000..4e2cf728c5 Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore8_storage.bin differ diff --git a/test/fuzzer/corpus/seed_mstore_large_offset.bin b/test/fuzzer/corpus/seed_mstore_large_offset.bin new file mode 100644 index 0000000000..6d6cb73efb Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore_large_offset.bin differ diff --git a/test/fuzzer/corpus/seed_mstore_log0.bin b/test/fuzzer/corpus/seed_mstore_log0.bin new file mode 100644 index 0000000000..3eead5f705 Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore_log0.bin differ diff --git a/test/fuzzer/corpus/seed_mstore_log2.bin b/test/fuzzer/corpus/seed_mstore_log2.bin new file mode 100644 index 0000000000..6ae040d81d Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore_log2.bin differ diff --git a/test/fuzzer/corpus/seed_mstore_mload_chain.bin b/test/fuzzer/corpus/seed_mstore_mload_chain.bin new file mode 100644 index 0000000000..ccdd302138 Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore_mload_chain.bin differ diff --git a/test/fuzzer/corpus/seed_mstore_mload_sstore.bin b/test/fuzzer/corpus/seed_mstore_mload_sstore.bin new file mode 100644 index 0000000000..27fe85038d Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore_mload_sstore.bin differ diff --git a/test/fuzzer/corpus/seed_mstore_return_shanghai.bin b/test/fuzzer/corpus/seed_mstore_return_shanghai.bin new file mode 100644 index 0000000000..45bbf320b9 Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore_return_shanghai.bin differ diff --git a/test/fuzzer/corpus/seed_mstore_return_simple.bin b/test/fuzzer/corpus/seed_mstore_return_simple.bin new file mode 100644 index 0000000000..fb873229bb Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore_return_simple.bin differ diff --git a/test/fuzzer/corpus/seed_mstore_revert.bin b/test/fuzzer/corpus/seed_mstore_revert.bin new file mode 100644 index 0000000000..0ba9881d8c Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore_revert.bin differ diff --git a/test/fuzzer/corpus/seed_mstore_sha3.bin b/test/fuzzer/corpus/seed_mstore_sha3.bin new file mode 100644 index 0000000000..0b59a170f9 Binary files /dev/null and b/test/fuzzer/corpus/seed_mstore_sha3.bin differ diff --git a/test/fuzzer/corpus/seed_number_coinbase_timestamp_gaslimit_chainid.bin b/test/fuzzer/corpus/seed_number_coinbase_timestamp_gaslimit_chainid.bin new file mode 100644 index 0000000000..12b5ec2227 Binary files /dev/null and b/test/fuzzer/corpus/seed_number_coinbase_timestamp_gaslimit_chainid.bin differ diff --git a/test/fuzzer/corpus/seed_pc_msize_gas.bin b/test/fuzzer/corpus/seed_pc_msize_gas.bin new file mode 100644 index 0000000000..a9d3ad9d40 Binary files /dev/null and b/test/fuzzer/corpus/seed_pc_msize_gas.bin differ diff --git a/test/fuzzer/corpus/seed_push0_mstore.bin b/test/fuzzer/corpus/seed_push0_mstore.bin new file mode 100644 index 0000000000..387b3f25d7 Binary files /dev/null and b/test/fuzzer/corpus/seed_push0_mstore.bin differ diff --git a/test/fuzzer/corpus/seed_push14_sload.bin b/test/fuzzer/corpus/seed_push14_sload.bin new file mode 100644 index 0000000000..f463168c3d Binary files /dev/null and b/test/fuzzer/corpus/seed_push14_sload.bin differ diff --git a/test/fuzzer/corpus/seed_push17_with_input.bin b/test/fuzzer/corpus/seed_push17_with_input.bin new file mode 100644 index 0000000000..82e28454ad Binary files /dev/null and b/test/fuzzer/corpus/seed_push17_with_input.bin differ diff --git a/test/fuzzer/corpus/seed_signextend.bin b/test/fuzzer/corpus/seed_signextend.bin new file mode 100644 index 0000000000..643f1be323 Binary files /dev/null and b/test/fuzzer/corpus/seed_signextend.bin differ diff --git a/test/fuzzer/corpus/seed_signextend_slt_sgt.bin b/test/fuzzer/corpus/seed_signextend_slt_sgt.bin new file mode 100644 index 0000000000..a2139ca001 Binary files /dev/null and b/test/fuzzer/corpus/seed_signextend_slt_sgt.bin differ diff --git a/test/fuzzer/corpus/seed_signextend_swap_shr.bin b/test/fuzzer/corpus/seed_signextend_swap_shr.bin new file mode 100644 index 0000000000..219cb37ab7 Binary files /dev/null and b/test/fuzzer/corpus/seed_signextend_swap_shr.bin differ diff --git a/test/fuzzer/corpus/seed_sstore_sload.bin b/test/fuzzer/corpus/seed_sstore_sload.bin new file mode 100644 index 0000000000..0051bab7f8 Binary files /dev/null and b/test/fuzzer/corpus/seed_sstore_sload.bin differ diff --git a/test/fuzzer/corpus/seed_sstore_sload_add.bin b/test/fuzzer/corpus/seed_sstore_sload_add.bin new file mode 100644 index 0000000000..eb6fba868f Binary files /dev/null and b/test/fuzzer/corpus/seed_sstore_sload_add.bin differ diff --git a/test/fuzzer/corpus/seed_staticcall_cancun.bin b/test/fuzzer/corpus/seed_staticcall_cancun.bin new file mode 100644 index 0000000000..76d9869207 Binary files /dev/null and b/test/fuzzer/corpus/seed_staticcall_cancun.bin differ diff --git a/test/fuzzer/corpus/seed_staticcall_returndatacopy.bin b/test/fuzzer/corpus/seed_staticcall_returndatacopy.bin new file mode 100644 index 0000000000..b3a82ae7d9 Binary files /dev/null and b/test/fuzzer/corpus/seed_staticcall_returndatacopy.bin differ