argotorg / argotorg/solidity

solfuzzer terminates with a crash on inputs containing invalid UTF-8 (mild obstacle to fuzzing)

Open
#16,173 4 comments 0 reactions 0 assignees View on GitHub
bug :bug: low effort low impact
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
2d 19h
Merged PRs (30d)
29

Description

Given any .sol input from standard input that contains invalid UTF-8 (which will frequently be produced by byte-mutating fuzzers like AFL), solfuzzer fails like this:

```
Testing compiler with optimizer.
terminate called after throwing an instance of 'nlohmann::json_abi_v3_11_3::detail::type_error'
what(): [json.exception.type_error.316] invalid UTF-8 byte at index 35: 0x80
Aborted
```

This looks like a crash to the fuzzer, so produces lots of spurious crashes and an annoying burden for triage. The solc executable does not crash on such inputs, as far as I can see. This isn't a major problem, fuzzing still works, but it definitely imposes a cost (of 9 million executions of solfuzzer in one fuzzing run, over 3 million have been crashes due to this UTF-8 issue, and with a larger starting corpus especially the crash set is composed of a huge number of ways to reach this uninteresting non-bug crash).

This is on the latest solc/solidity (0.8.24 github main branch)

## Steps to Reproduce

Just run solfuzzer on an input like:

```
contract test {
f\200^@ction g() pu\203lic { f(); }
}
```

`build/test/tools/solfuzzer < crash.sol`

Contributor guide

Open the contributing guide

Research direction

Start with the build/test/tools/solfuzzer entry point and reproduce the failure using the provided crash.sol input and stdin command. Trace the invalid-input path through the JSON error shown in the report, then compare it with solc's behavior; done means invalid UTF-8 no longer terminates solfuzzer as a spurious crash.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, json
Domain
compilers, testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.