Add fuzzing setup to quantum resistant lock

Author: xxuejie

.gitignore

@@ -2,3 +2,12 @@ build/
 /target
 /tests/failed_txs
 /test-vector*
+
+/fuzzing/fuzzing_syscalls_all_in_one.h
+/fuzzing/dumps
+/fuzzing/corpus*
+/fuzzing/*.o
+/fuzzing/leaf*.complete
+/fuzzing/leaf*intermediate/
+/fuzzing/*_fuzzer
+/fuzzing/binary_to_text_converter

Cargo.lock

@@ -5,6 +5,7 @@ members = [
   "contracts/hybrid-sphincs-all-in-one-lock",
   "contracts/sphincs-all-in-one-lock",
   "crates/ckb-fips205-utils",
+  "crates/fuzzing-corpus-generator",
   "crates/intermediate-source-generator",
   "crates/script-merge-tool",
   "tests/multisig-tests",
@@ -15,6 +16,10 @@ members = [
   "tools/ckb-sphincs-utils",
 ]
 
+exclude = [
+  "fuzzing/ckb-script-fuzzing-toolkit/tools/flattener"
+]
+
 [profile.release]
 overflow-checks = true
 strip = false

Cargo.toml

@@ -68,12 +68,14 @@ $(CUR_BUILD)/nist-vector-tester: nist-vector-tester.c $(CUR_BUILD)/params-finder
 		--root-actual $@-root.debug \
 		--leaves $(CUR_BUILD)/leaves_debug \
 		--output $@.debug \
+		--metadata-file $@_metadata_debug.json \
 		--merge
 	$(TOP)/target/$(MODE)/script-merge-tool --prefix CKB_ merge \
 		--root-debug $@-root.debug \
 		--root-actual $@-root.stripped \
 		--leaves $(CUR_BUILD)/leaves_stripped \
 		--output $@ \
+		--metadata-file $@_metadata_stripped.json \
 		--merge
 
 $(CUR_BUILD)/$(BINARY): $(CUR_BUILD)/root.complete $(CUR_BUILD)/leaf.complete $(HEADERS)
@@ -82,12 +84,14 @@ $(CUR_BUILD)/$(BINARY): $(CUR_BUILD)/root.complete $(CUR_BUILD)/leaf.complete $(
 		--root-actual $(CUR_BUILD)/root.debug \
 		--leaves $(CUR_BUILD)/leaves_debug \
 		--output $@.debug \
+		--metadata-file $@_metadata_debug.json \
 		--merge
 	$(TOP)/target/$(MODE)/script-merge-tool --prefix CKB_ merge \
 		--root-debug $(CUR_BUILD)/root.debug \
 		--root-actual $(CUR_BUILD)/root.stripped \
 		--leaves $(CUR_BUILD)/leaves_stripped \
 		--output $@ \
+		--metadata-file $@_metadata_stripped.json \
 		--merge
 
 $(CUR_BUILD)/root.complete: ckb-sphincsplus-root-lock.c $(CUR_BUILD)/params-finder.h $(CUR_BUILD)/leaf-vars.h

contracts/c-sphincs-all-in-one-lock/Makefile

@@ -1,3 +1,7 @@
+#ifdef FUZZING
+#define mol2_printf(...)
+#include <fuzzing_syscalls_all_in_one.h>
+#else
 /*
  * Leaf lock takes calculated message hash, together with a range in
  * witness as input. It runs sphincs+ signature verifications based on
@@ -20,6 +24,8 @@
 #undef CKB_DECLARATION_ONLY
 #include "entry.h"
 #define CKB_DECLARATION_ONLY
+#include <ckb_syscalls.h>
+#endif
 
 #include "ckb-sphincsplus-common.h"
 

contracts/c-sphincs-all-in-one-lock/ckb-sphincsplus-leaf-lock.c

@@ -1,3 +1,7 @@
+#ifdef FUZZING
+#define mol2_printf(...)
+#include <fuzzing_syscalls_all_in_one.h>
+#else
 /*
  * Root lock calculates signing message hash, validates multisig
  * structure & logics, ensures multisig config hash is correctly calculated.
@@ -16,11 +20,12 @@
 #undef CKB_DECLARATION_ONLY
 #include "entry.h"
 #define CKB_DECLARATION_ONLY
+#include <ckb_syscalls.h>
+#endif
 
 #include "ckb-sphincsplus-common.h"
 
 #include <blake2b.h>
-#include <ckb_syscalls.h>
 #include <molecule/blockchain-api2.h>
 
 #define CKB_SCRIPT_MERGE_TOOL_DEFINE_VARS
@@ -292,14 +297,17 @@ int main(int argc, char *argv[]) {
       CHECK(mol2_read_and_advance(&signatures, &flag, 1));
 
       uint8_t param_index = MULTISIG_FLAG_TO_PARAM_INDEX(flag);
+      CHECK2(
+          param_index >= 0 && param_index < CKB_SPHINCS_SUPPORTED_PARAMS_COUNT,
+          ERROR_SPHINCSPLUS_WITNESS);
       if (all_params[param_index] == NULL) {
         CHECK(fetch_params(MULTISIG_FLAG_TO_PARAM_ID(flag),
                            &all_params[param_index]));
       }
       uint32_t pk_size = all_params[param_index]->pk_bytes;
       uint32_t sign_size = all_params[param_index]->sign_bytes;
       CHECK2(pk_size + sign_size + 1 == (size_t)pk_size + (size_t)sign_size + 1,
-             ERROR_SPHINCSPLUS_WITNESS;);
+             ERROR_SPHINCSPLUS_WITNESS);
 
       if (MULTISIG_HAS_SIGNATURE(flag)) {
         /*

contracts/c-sphincs-all-in-one-lock/ckb-sphincsplus-root-lock.c

@@ -63,7 +63,6 @@ uint32_t sphincs_plus_get_seed_size() { return CRYPTO_SEEDBYTES; }
 
 #endif  // CKB_VM
 
-#include <stdio.h>
 int sphincs_plus_verify(const uint8_t *sign, uint32_t sign_size,
                         const uint8_t *message, uint32_t message_size,
                         const uint8_t *pubkey, uint32_t pubkey_size) {
@@ -75,7 +74,6 @@ int sphincs_plus_verify(const uint8_t *sign, uint32_t sign_size,
   int err = crypto_sign_verify(sign, SPHINCS_PLUS_SIGN_SIZE, message,
                                message_size, pubkey);
   if (err != 0) {
-    printf("Verify faliure: %d\n", err);
     return SphincsPlusError_Verify;
   }
 

contracts/c-sphincs-all-in-one-lock/ckb-sphincsplus.c

@@ -1,7 +1,7 @@
 #ifndef CKB_CKB_TX_MESSAGE_ALL_H_
 #define CKB_CKB_TX_MESSAGE_ALL_H_
 
-#include <ckb_syscalls.h>
+#include <ckb_syscall_utils.h>
 
 #include "witness_args_lazy_utils.h"
 

contracts/c-sphincs-all-in-one-lock/utils/ckb_tx_message_all.h

@@ -23,7 +23,7 @@
  * and cursor has been provided.
  */
 
-#include <ckb_syscalls.h>
+#include <ckb_syscall_utils.h>
 #include <molecule/blockchain-api2.h>
 
 void mol2_advance(mol2_cursor_t *cursor, uint32_t len) {

contracts/c-sphincs-all-in-one-lock/utils/witness_args_lazy_utils.h

@@ -52,12 +52,14 @@ build: src/generated/sizes.rs src/generated/offsets.rs src/generated/params.rs
 				--root-actual build/$${binary}_root.debug \
 				--leaves $(C_BUILD_DIR)/leaves_debug \
 				--output build/$${binary}.debug \
+				--metadata-file build/$${binary}_metadata_debug.json \
 				--merge; \
 			$(TOP)/target/$(MODE)/script-merge-tool --prefix CKB_ merge \
 				--root-debug build/$${binary}_root.debug \
 				--root-actual build/$${binary}_root.stripped \
 				--leaves $(C_BUILD_DIR)/leaves_stripped \
 				--output build/$${binary} \
+				--metadata-file build/$${binary}_metadata_stripped.json \
 				--merge; \
 			cp build/$${binary}.debug $(TOP)/$(BUILD_DIR)/$${binary}.debug; \
 			cp build/$${binary} $(TOP)/$(BUILD_DIR)/$${binary}; \