solfuzzer terminates with a crash on inputs containing invalid UTF-8 (mild obstacle to fuzzing)
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 29
Description
Given any .sol input from standard input that contains invalid UTF-8 (which will frequently be produced by byte-mutating fuzzers like AFL), solfuzzer fails like this:
```
Testing compiler with optimizer.
terminate called after throwing an instance of 'nlohmann::json_abi_v3_11_3::detail::type_error'
what(): [json.exception.type_error.316] invalid UTF-8 byte at index 35: 0x80
Aborted
```
This looks like a crash to the fuzzer, so produces lots of spurious crashes and an annoying burden for triage. The solc executable does not crash on such inputs, as far as I can see. This isn't a major problem, fuzzing still works, but it definitely imposes a cost (of 9 million executions of solfuzzer in one fuzzing run, over 3 million have been crashes due to this UTF-8 issue, and with a larger starting corpus especially the crash set is composed of a huge number of ways to reach this uninteresting non-bug crash).
This is on the latest solc/solidity (0.8.24 github main branch)
## Steps to Reproduce
Just run solfuzzer on an input like:
```
contract test {
f\200^@ction g() pu\203lic { f(); }
}
```
`build/test/tools/solfuzzer < crash.sol`
Contributor guide
Research direction
Start with the build/test/tools/solfuzzer entry point and reproduce the failure using the provided crash.sol input and stdin command. Trace the invalid-input path through the JSON error shown in the report, then compare it with solc's behavior; done means invalid UTF-8 no longer terminates solfuzzer as a spurious crash.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, json
- Domain
- compilers, testing-qa
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100