Solidity: [evmone] interpreter returns "EVMC_BAD_JUMP_DESTINATION" on contract deployment

[bshastry]

Abstract

oss-fuzz issue: 19056

After update to evmone v0.2.0/v0.3.0, the following function returns the status code in the subject line

https://github.com/ethereum/solidity/blob/3f67912cf41a44a0f69ea1b495a76a30bb365855/test/tools/ossfuzz/abiV2ProtoFuzzer.cpp#L89-L98

The solidity byte code is generated from this source file without optimization: https://gist.github.com/bshastry/f9e89e07a1a92dcbe9edc90855332721

Here's the byte code being deployed (targeted at petersburg): https://gist.github.com/bshastry/65ad1a1e6609d967b0b79fbdf628200b

Deploy failure can be reproduced for both petersburg and istanbul. Still trying to figure out what changed between v0.1.0 and v0.2.0/v0.3.0 that leads to this. CC @chfast @axic @chriseth

There seem to be other problems in evmone related to the same root cause i.e., code size in create transaction in violation of EIP 170 (24KB). See for example the CI failures in https://github.com/ethereum/evmone/pull/215

[chfast]

To confirm, the same bytecode executed gives different results in evmone 0.2 and 0.3?

[bshastry]

To confirm, the same bytecode executed gives different results in evmone 0.2 and 0.3?

That's right. The same solidity contract gives different results. I'm yet to make sure if the bytecode is identical.

0.2

• deployContract succeeds

0.3

• deployContract returns EVMC_BAD_JUMP_DESTINATION

I'm trying to figure out why. Do you have any hints? ;)

[chfast]

@bshastry, if that is not blocker for you, I will debug it on my own.

[chfast]

I'm yet to make sure if the bytecode is identical.

Yes, please confirm that.

[chfast]

Hey, I have taken the bytecode you attached and have run it in both evmone/master and evmone/0.2. In both cases I get EVMC_BAD_JUMP_DESTINATION exception. So bug not confirmed in evmone so far.

[bshastry]

Hey, I have taken the bytecode you attached and have run it in both evmone/master and evmone/0.2. In both cases I get EVMC_BAD_JUMP_DESTINATION exception. So bug not confirmed in evmone so far.

Ah I see, I was just getting my setup ready to replay the same byte code on both evmone versions. It is possible that a change in the compiler caused it. Still debugging.

[chfast]

Here is a unit tests added to evmone: https://github.com/ethereum/evmone/pull/214
The same patch can be applied to v0.2.0. In both cases it returns EVMC_BAD_JUMP_DESTINATION.

[bshastry]

To confirm, the same bytecode executed gives different results in evmone 0.2 and 0.3?

The same bytecode gives the same result (EVMC_BAD_JUMP_DESTINATION) for both evmone 0.2 and 0.3. So I was wrong with my initial assessment. Will edit title and description.

[bshastry]

Will now try to execute the bytecode on evmone 0.1

[bshastry]

Identical byte code successfully runs on evmone 0.1. So I think this may be an evmone issue that was introduced in 0.2

[chfast]

I've found the issue in evmone. It wrongly assumed the code is always within the 0x6000 limit, but the limit do not apply to create transactions.

If a workaround is needed, can you limit the size of the bytecode?

[bshastry]

@chfast Ah I see. The main issue is that Fuzzing the abiv2 coder requires somewhat elaborate programs (especially when we are en/decoding multi dimensional arrays as in this issue).

My concern is that, if we limit byte code size to 0x6000, then we won't be able to thoroughly test the abiv2 coder.

@chriseth @ekpyron Do you have other opinions/suggestions?

[bshastry]

Related https://github.com/ethereum/evmone/issues/205#issuecomment-558136843

[chfast]

Please try this fix: https://github.com/ethereum/evmone/pull/217.
There are some other case not related to jumpdest where evmone can fail, but it is unlikely solidity fuzzer will hit these.

[axic]

@bshastry this was fixed in evmone, is there anything to discuss here?

@chfast will there be an evmone release we can use?

[chfast]

@chfast will there be an evmone release we can use?

I will try to make the release this week, but there is more work there needed.

[bshastry]

Summary from the call: Update oss-fuzz docker file once the new release is made.

[bshastry]

Thank you @chfast for the timely fixes!

[chfast]

The evmone 0.4.0 has been released: https://github.com/ethereum/evmone/releases/tag/v0.4.0

[bshastry]

Updated oss-fuzz docker file (see https://github.com/google/oss-fuzz/pull/3100)

Pending: Upgrade to evmone v0.4.0 in CI docker images (see #7936 )

[bshastry]

Fixed by #7936