From 7fff6d5b59564ae1c69204d74b719a2213cc00ac Mon Sep 17 00:00:00 2001 From: Outcry <843648230@qq.com> Date: Mon, 2 Mar 2026 09:00:03 +0000 Subject: [PATCH] feat: add some fuzz seed case --- AGENTS.md | 20 ++++++++++++++++++ test/fuzzer/corpus/seed_add_mul_div.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_add_tangerine.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_addmod_mulmod.bin | Bin 0 -> 300 bytes .../seed_address_caller_origin_gasprice.bin | Bin 0 -> 300 bytes .../fuzzer/corpus/seed_and_or_xor_shl_shr.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_blockhash.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_byte_swap.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_call_return.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_call_zero_all.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_call_zero_value.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_callcode.bin | Bin 0 -> 300 bytes .../corpus/seed_calldataload_dispatcher.bin | Bin 0 -> 300 bytes .../corpus/seed_calldatasize_calldataload.bin | Bin 0 -> 300 bytes .../seed_callvalue_selfbalance_basefee.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_codesize_codecopy.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_difficulty_xor.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_dup_swap_add.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_empty_code.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_empty_large_input.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_exp.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_extcodecopy.bin | Bin 0 -> 300 bytes .../corpus/seed_extcodesize_extcodehash.bin | Bin 0 -> 300 bytes .../corpus/seed_invalid_sload_sstore.bin | Bin 0 -> 300 bytes .../fuzzer/corpus/seed_invalid_with_input.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_jumpi_jumpdest.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_loop_jumpdest.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_lt_gt_eq_iszero.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_mstore8_multi.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_mstore8_storage.bin | Bin 0 -> 300 bytes .../corpus/seed_mstore_large_offset.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_mstore_log0.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_mstore_log2.bin | Bin 0 -> 300 bytes .../fuzzer/corpus/seed_mstore_mload_chain.bin | Bin 0 -> 300 bytes .../corpus/seed_mstore_mload_sstore.bin | Bin 0 -> 300 bytes .../corpus/seed_mstore_return_shanghai.bin | Bin 0 -> 300 bytes .../corpus/seed_mstore_return_simple.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_mstore_revert.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_mstore_sha3.bin | Bin 0 -> 300 bytes ...er_coinbase_timestamp_gaslimit_chainid.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_pc_msize_gas.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_push0_mstore.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_push14_sload.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_push17_with_input.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_signextend.bin | Bin 0 -> 300 bytes .../fuzzer/corpus/seed_signextend_slt_sgt.bin | Bin 0 -> 300 bytes .../corpus/seed_signextend_swap_shr.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_sstore_sload.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_sstore_sload_add.bin | Bin 0 -> 300 bytes test/fuzzer/corpus/seed_staticcall_cancun.bin | Bin 0 -> 300 bytes .../corpus/seed_staticcall_returndatacopy.bin | Bin 0 -> 300 bytes 51 files changed, 20 insertions(+) create mode 100644 test/fuzzer/corpus/seed_add_mul_div.bin create mode 100644 test/fuzzer/corpus/seed_add_tangerine.bin create mode 100644 test/fuzzer/corpus/seed_addmod_mulmod.bin create mode 100644 test/fuzzer/corpus/seed_address_caller_origin_gasprice.bin create mode 100644 test/fuzzer/corpus/seed_and_or_xor_shl_shr.bin create mode 100644 test/fuzzer/corpus/seed_blockhash.bin create mode 100644 test/fuzzer/corpus/seed_byte_swap.bin create mode 100644 test/fuzzer/corpus/seed_call_return.bin create mode 100644 test/fuzzer/corpus/seed_call_zero_all.bin create mode 100644 test/fuzzer/corpus/seed_call_zero_value.bin create mode 100644 test/fuzzer/corpus/seed_callcode.bin create mode 100644 test/fuzzer/corpus/seed_calldataload_dispatcher.bin create mode 100644 test/fuzzer/corpus/seed_calldatasize_calldataload.bin create mode 100644 test/fuzzer/corpus/seed_callvalue_selfbalance_basefee.bin create mode 100644 test/fuzzer/corpus/seed_codesize_codecopy.bin create mode 100644 test/fuzzer/corpus/seed_difficulty_xor.bin create mode 100644 test/fuzzer/corpus/seed_dup_swap_add.bin create mode 100644 test/fuzzer/corpus/seed_empty_code.bin create mode 100644 test/fuzzer/corpus/seed_empty_large_input.bin create mode 100644 test/fuzzer/corpus/seed_exp.bin create mode 100644 test/fuzzer/corpus/seed_extcodecopy.bin create mode 100644 test/fuzzer/corpus/seed_extcodesize_extcodehash.bin create mode 100644 test/fuzzer/corpus/seed_invalid_sload_sstore.bin create mode 100644 test/fuzzer/corpus/seed_invalid_with_input.bin create mode 100644 test/fuzzer/corpus/seed_jumpi_jumpdest.bin create mode 100644 test/fuzzer/corpus/seed_loop_jumpdest.bin create mode 100644 test/fuzzer/corpus/seed_lt_gt_eq_iszero.bin create mode 100644 test/fuzzer/corpus/seed_mstore8_multi.bin create mode 100644 test/fuzzer/corpus/seed_mstore8_storage.bin create mode 100644 test/fuzzer/corpus/seed_mstore_large_offset.bin create mode 100644 test/fuzzer/corpus/seed_mstore_log0.bin create mode 100644 test/fuzzer/corpus/seed_mstore_log2.bin create mode 100644 test/fuzzer/corpus/seed_mstore_mload_chain.bin create mode 100644 test/fuzzer/corpus/seed_mstore_mload_sstore.bin create mode 100644 test/fuzzer/corpus/seed_mstore_return_shanghai.bin create mode 100644 test/fuzzer/corpus/seed_mstore_return_simple.bin create mode 100644 test/fuzzer/corpus/seed_mstore_revert.bin create mode 100644 test/fuzzer/corpus/seed_mstore_sha3.bin create mode 100644 test/fuzzer/corpus/seed_number_coinbase_timestamp_gaslimit_chainid.bin create mode 100644 test/fuzzer/corpus/seed_pc_msize_gas.bin create mode 100644 test/fuzzer/corpus/seed_push0_mstore.bin create mode 100644 test/fuzzer/corpus/seed_push14_sload.bin create mode 100644 test/fuzzer/corpus/seed_push17_with_input.bin create mode 100644 test/fuzzer/corpus/seed_signextend.bin create mode 100644 test/fuzzer/corpus/seed_signextend_slt_sgt.bin create mode 100644 test/fuzzer/corpus/seed_signextend_swap_shr.bin create mode 100644 test/fuzzer/corpus/seed_sstore_sload.bin create mode 100644 test/fuzzer/corpus/seed_sstore_sload_add.bin create mode 100644 test/fuzzer/corpus/seed_staticcall_cancun.bin create mode 100644 test/fuzzer/corpus/seed_staticcall_returndatacopy.bin diff --git a/AGENTS.md b/AGENTS.md index b652ff7dc6..8e9148de3c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -53,3 +53,23 @@ All tests can be run via CTest. Make sure the build is up to date. - `ctest --test-dir build/debug --output-on-failure` - to filter tests use `-R ` + +## Fuzzing + +The fuzzer compares an external EVMC-compatible VM against evmone (the reference). + +### Run fuzzer with seed corpus + +```bash +EVMONE_EXTERNAL_OPTIONS= ./build/bin/evmone-fuzzer test/fuzzer/corpus/ +``` + +### Reproduce a single crash file + +```bash +EVMONE_EXTERNAL_OPTIONS= ./build/bin/evmone-fuzzer crash_files/ +``` + +### Seed corpus + +The seed corpus lives in `test/fuzzer/corpus/`. Each seed file name describes the EVM opcodes it exercises (e.g. `seed_sstore_sload.bin`, `seed_call_return.bin`). diff --git a/test/fuzzer/corpus/seed_add_mul_div.bin b/test/fuzzer/corpus/seed_add_mul_div.bin new file mode 100644 index 0000000000000000000000000000000000000000..48e954ed4fb0f0a10b7c124d0ee0cb290a38b7ab GIT binary patch literal 300 zcmdnMzEFXIfsu)UL4cWsE2SZT@joMz00UzJSAqy*0y9$rD{}%9O9DesfE5(_{=bp0RXS^ B2?hWF literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_address_caller_origin_gasprice.bin b/test/fuzzer/corpus/seed_address_caller_origin_gasprice.bin new file mode 100644 index 0000000000000000000000000000000000000000..4c723cd1e1eb2354f8ae458926b1f03779efa133 GIT binary patch literal 300 zcmdnMzEFXIfsu)UL4cWsE2SZT@joMz00W~z0z;5-fIC@-QV9$}2?_}epBY90Fa!W$9SEKP literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_call_return.bin b/test/fuzzer/corpus/seed_call_return.bin new file mode 100644 index 0000000000000000000000000000000000000000..7339acf3ccdf6ed320565f6b291c312603ac30ff GIT binary patch literal 300 tcmdnM@8rP1z{teFAi&JRmC_Kv_@9wUfPpbVA%Ou5oua;g*q<3j0RY4{2@wDQ literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_call_zero_all.bin b/test/fuzzer/corpus/seed_call_zero_all.bin new file mode 100644 index 0000000000000000000000000000000000000000..6f2aca939f53415529dda2500172139e47851b87 GIT binary patch literal 300 zcmdnM@8rP1z{teFAi&JRmC_Kv_@9wUfPpcA0S=uK4+nfqUd`w^nN>E5(_{=bZ0RVhm B3%vjU literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_callcode.bin b/test/fuzzer/corpus/seed_callcode.bin new file mode 100644 index 0000000000000000000000000000000000000000..e646c47e5e4289b6f1e4f91377eb2f2406d68f6b GIT binary patch literal 300 wcmdnM@8rP1z{teFAi&JRmC_Kv_@9wUfPpbVA%Ou3oe~cRd;;-5GmLBi06QZJi2wiq literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_calldataload_dispatcher.bin b/test/fuzzer/corpus/seed_calldataload_dispatcher.bin new file mode 100644 index 0000000000000000000000000000000000000000..b15eb942e337e90fbcfe3e1c414b5ce9a148f445 GIT binary patch literal 300 zcmdnM@8rP1!pOwHAi&JRmC_Kv_@9wUfPwMC+y`9=45kSWWEzq|Y>@<&@Z?;dXEq`U jM&Stz2@HRu6Bt4g7#R~7LK(nJhM)w61cuKH!xsPm1`HR~ literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_calldatasize_calldataload.bin b/test/fuzzer/corpus/seed_calldatasize_calldataload.bin new file mode 100644 index 0000000000000000000000000000000000000000..69b95854047f0c59bec7ac784b6cd50367657472 GIT binary patch literal 300 zcmdnMzEFWdfsu)UL4cWsE2SZT@joMz00Scf0brKEV9J=l5R{;h!0?%X+TkJ%0G+D` ARsaA1 literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_callvalue_selfbalance_basefee.bin b/test/fuzzer/corpus/seed_callvalue_selfbalance_basefee.bin new file mode 100644 index 0000000000000000000000000000000000000000..93dcff80b779e4a2b8d87787322287941fbf59b8 GIT binary patch literal 300 zcmdnMzEFXIfsv_!L4cWsE2SZT@joMz00W~*0z;5{fzv&TNZ{VueecmRk~9`3^NR!q(}V{y n$snUd66C@Y7!nx%MklD4CNP91FeWerB`72?e8!@4unGYH(={Tf literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_jumpi_jumpdest.bin b/test/fuzzer/corpus/seed_jumpi_jumpdest.bin new file mode 100644 index 0000000000000000000000000000000000000000..e1a46ae3a0fe62583af178bb9a770da8b30855da GIT binary patch literal 300 zcmdnMzEFXIfsu)UL4cWsE2SZT@joMz00UzJLjt2<0#7)QW(Z19NMQIJod6VsFd0TB F002Y`3!nf1 literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_loop_jumpdest.bin b/test/fuzzer/corpus/seed_loop_jumpdest.bin new file mode 100644 index 0000000000000000000000000000000000000000..279e686370ab4f607aa15259debdc2330250abfc GIT binary patch literal 300 zcmdnM@8rP1z{teFAi&JRmC_Kv_@9wUfPpcAA-W-fRUknyJb{rhfhjCHfgvbCA%WpD H!^i~y$6^W~ literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_lt_gt_eq_iszero.bin b/test/fuzzer/corpus/seed_lt_gt_eq_iszero.bin new file mode 100644 index 0000000000000000000000000000000000000000..78d8eb53685489cbadaa68744026df1848c2acbf GIT binary patch literal 300 zcmdnMzEFXIfsu)UL4cWsE2SZT@joMz00UzJYXX-*0#^d7AY%fPh-d;sP=Z1N!)Jz( F3;f>MG)P=axSLr?-kV1hy*V}b(^ PCj=!ZBqV%h7;yjqFoO-7 literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_mstore_mload_sstore.bin b/test/fuzzer/corpus/seed_mstore_mload_sstore.bin new file mode 100644 index 0000000000000000000000000000000000000000..27fe85038d1de101bbc56e317de9712b7cbe0a29 GIT binary patch literal 300 zcmdnMzEFXIfsu)UL4cWsE2SZT@joMz00U#fy#$7!gtZ9@K?(a39D)-V0uvMh850tM N5)={=J~NC+002%Y4vhc+ literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_mstore_return_shanghai.bin b/test/fuzzer/corpus/seed_mstore_return_shanghai.bin new file mode 100644 index 0000000000000000000000000000000000000000..45bbf320b9951b773e35f04c39fd5361a151f38b GIT binary patch literal 300 ucmdnN@8rP1z{teFAi&JRmC_Kv_@9wUfPpc=DS;s? E0E(Rp)c^nh literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_signextend_swap_shr.bin b/test/fuzzer/corpus/seed_signextend_swap_shr.bin new file mode 100644 index 0000000000000000000000000000000000000000..219cb37ab7c8c0631d6d28da093d82273f0d2dc0 GIT binary patch literal 300 zcmdnMzEFXIfsu)UL4cWsE2SZT@joMz00Uz}LjnVL0?P#11csmlg#?Dr45I)5fcyx? literal 0 HcmV?d00001 diff --git a/test/fuzzer/corpus/seed_sstore_sload.bin b/test/fuzzer/corpus/seed_sstore_sload.bin new file mode 100644 index 0000000000000000000000000000000000000000..0051bab7f82377deec422eefb2774beb76973def GIT binary patch literal 300 zcmdnM@8rP1z{teFAi&JRmC_Kv_@9wUfPpb#RRTk3!tMmd(1bGyOrZ&P6PQC2-X*Yv eCNP8~ForNDFaa?$5VHU=Lr{W30>fv9VGaO