ChainSafe / ChainSafe/gossamer
Fuzzing result for DecodeBabePreDigest target
- Dominant language
- Go
- Stars
- 454
- Forks
- 144
- PR merge metrics
- No merged PRs in 30d
Description
# Target
### ```Substrate```
```rust
#[derive(Clone, RuntimeDebug, Encode, Decode, MaxEncodedLen, TypeInfo)]
pub enum PreDigest {
/// A primary VRF-based slot assignment.
#[codec(index = 1)]
Primary(PrimaryPreDigest),
/// A secondary deterministic slot assignment.
#[codec(index = 2)]
SecondaryPlain(SecondaryPlainPreDigest),
/// A secondary deterministic slot assignment with VRF outputs.
#[codec(index = 3)]
SecondaryVRF(SecondaryVRFPreDigest),
}
```
### ```Smoldot```
```rust
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum BabePreDigestRef<'a> {
/// A primary VRF-based slot assignment.
Primary(BabePrimaryPreDigestRef<'a>),
/// A secondary deterministic slot assignment.
SecondaryPlain(BabeSecondaryPlainPreDigest),
/// A secondary deterministic slot assignment with VRF outputs.
SecondaryVRF(BabeSecondaryVRFPreDigestRef<'a>),
}
/// Decodes a [`BabePreDigestRef`] from a slice of bytes.
pub fn from_slice(slice: &'a [u8]) -> Result {
Ok(match slice.first() {
Some(1) => BabePreDigestRef::Primary(BabePrimaryPreDigestRef::from_slice(&slice[1..])?),
Some(2) => {
BabePreDigestRef::SecondaryPlain(BabeSecondaryPlainPreDigest::from_slice(&slice[1..])?)
}
Some(3) => {
BabePreDigestRef::SecondaryVRF(BabeSecondaryVRFPreDigestRef::from_slice(&slice[1..])?)
}
Some(_) => return Err(Error::BadBabePreDigestRefType),
None => return Err(Error::TooShort),
})
}
```
### ```Gossamer```
```go
// DecodeBabePreDigest decodes the input into a BabePreRuntimeDigest
func DecodeBabePreDigest(in []byte) (scale.VaryingDataTypeValue, error) {
babeDigest := NewBabeDigest()
err := scale.Unmarshal(in, &babeDigest)
if err != nil {
return nil, err
}
babeDigestValue, err := babeDigest.Value()
if err != nil {
return nil, fmt.Errorf("getting babe digest value: %w", err)
}
switch msg := babeDigestValue.(type) {
case BabePrimaryPreDigest, BabeSecondaryPlainPreDigest, BabeSecondaryVRFPreDigest:
return msg, nil
}
return nil, errors.New("cannot decode data with invalid BABE pre-runtime digest type")
}
```
# ```DecodeBabePreDigest``` Reproducing Scripts
### ```Substrate```
```rust
pub fn substrate_decode_babepredigest(file_name: &String) {
println!("[+] Substrate Result:");
let buf = read_bytes(file_name).unwrap();
let mut data: &[u8] = buf.as_ref();
let ret = PreDigest::decode(&mut data);
if let Err(_) = ret {
println!("[-] BabePredigest decode result: {:?}", ret);
} else {
println!("[+] BabePredigest decode result: {:?}", ret);
}
}
```
### ```Smoldot```
```rust
pub fn smoldot_decode_babepredigest(file_name: &String) {
println!("[+] Smoldot Result:");
let buf = read_bytes(file_name).unwrap();
let ret = smoldot::header::BabePreDigestRef::from_slice(&buf);
if let Err(_) = ret {
println!("[-] BabePredigest from_slice result: {:?}", ret);
} else {
println!("[+] BabePredigest from_slice result: {:?}", ret);
}
}
```
### ```Gossamer```
```go
func glib_decode_babepredigest(data_ptr unsafe.Pointer, data_size int) {
fmt.Println("[+] Gossamer Result:")
var data []byte
sh := (*reflect.SliceHeader)(unsafe.Pointer(&data))
sh.Data = uintptr(data_ptr)
sh.Len = data_size
sh.Cap = data_size
ret, err := types.DecodeBabePreDigest(data)
if err != nil {
fmt.Println("[-] BabePreDigest DecodeBabePreDigest result:", err)
} else {
fmt.Println("[+] BabePreDigest DecodeBabePreDigest result:", ret)
}
}
```
# Crash 1
The differential fuzzer catches a crash. The ```Substrate``` and ```Smoldot``` target give an error message but the ```Gossamer``` target executes the given data successfully.
### ```Reproducer```
```
./reproducer run all DecodeBabePreDigest /crash-326bcddbb29ae0dc136b662182ac87320cd7a20b
[+] Smoldot Result:
[-] BabePredigest from_slice result: Err(DigestItemDecodeError)
[+] Substrate Result:
[-] BabePredigest decode result: Err(Error { cause: Some(Error { cause: Some(Error { cause: Some(Error { cause: None, desc: "Not enough data to fill buffer" }), desc: "Could not decode `Slot.0`" }), desc: "Could not decode `SecondaryPlainPreDigest::slot`" }), desc: "Could not decode `PreDigest::SecondaryPlain.0`" })
[+] Gossamer Result:
[+] BabePreDigest DecodeBabePreDigest result: {13612 39}
```
### Artifacts 1
[decodebabepredigest_crash1.zip](https://github.com/ChainSafe/gossamer/files/10724014/decodebabepredigest_crash1.zip)
# Crash 2
The differential fuzzer catches a crash. The ```Substrate``` target gives an error message but the ```Gossamer``` and ```Smoldot``` targets execute the given data successfully.
### ```Reproducer```
```
./reproducer run all DecodeBabePreDigest /5eaffab8277aab40
[+] Smoldot Result:
[+] BabePredigest from_slice result: Ok(Primary(BabePrimaryPreDigestRef { authority_index: 2617245697, slot_number: 3192770661088533608, vrf_output: [104, 104, 104, 8, 104, 156, 156, 156, 156, 156, 156, 156, 156, 156, 228, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 156, 156, 156, 156, 120], vrf_proof: [15, 0, 0, 41, 79, 104, 104, 104, 0, 0, 44, 104, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 156, 156, 156, 156, 120, 15, 0, 0, 41, 79, 104, 104, 104, 0, 0, 44, 104, 104, 104, 104, 120, 79, 255, 255, 255, 255, 255, 0, 0, 79, 44, 104, 104, 120] }))
[+] Substrate Result:
[-] BabePredigest decode result: Err(Error { cause: Some(Error { cause: Some(Error { cause: None, desc: "Signature error: `ScalarFormatError`" }), desc: "Could not decode `PrimaryPreDigest::vrf_proof`" }), desc: "Could not decode `PreDigest::Primary.0`" })
[+] Gossamer Result:
[+] BabePreDigest DecodeBabePreDigest result: {2617245697 3192770661088533608 [104 104 104 8 104 156 156 156 156 156 156 156 156 156 228 255 255 255 255 255 255 255 255 255 255 255 255 156 156 156 156 120] [15 0 0 41 79 104 104 104 0 0 44 104 255 255 255 255 255 255 255 255 255 255 255 255 255 255 255 255 255 255 156 156 156 156 120 15 0 0 41 79 104 104 104 0 0 44 104 104 104 104 120 79 255 255 255 255 255 0 0 79 44 104 104 120]}
```
### Artifacts 2
[decodebabepredigest_crash2.zip](https://github.com/ChainSafe/gossamer/files/10724015/decodebabepredigest_crash2.zip)
Contributor guide
Assessment
This issue has not been assessed yet.