Skip to content

Commit 214d905

Browse files
apoelstraapoelstra
committed
fuzz: replace every fuzzer-controlled loop with a LIMITED_WHILE loop
Blindly chose a cap of 10000 iterations for every loop, except for the two in script_ops.cpp and scriptnum_ops.cpp which appeared to (sometimes) be deserializing individual bytes; capped those to one million to ensure that sometimes we try working with massive scripts. There was also one fuzzer-controlled loop in timedata.cpp which was already capped, so I left that alone. git grep 'while (fuzz' should now run clean except for timedata.cpp
1 parent 22a9018 commit 214d905

29 files changed

+34
-34
lines changed

‎src/test/fuzz/addrman.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ FUZZ_TARGET_INIT(addrman, initialize_addrman)
236236
}
237237
}
238238
AddrManDeterministic& addr_man = *addr_man_ptr;
239-
while (fuzzed_data_provider.ConsumeBool()) {
239+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
240240
CallOneOf(
241241
fuzzed_data_provider,
242242
[&] {
@@ -247,7 +247,7 @@ FUZZ_TARGET_INIT(addrman, initialize_addrman)
247247
},
248248
[&] {
249249
std::vector<CAddress> addresses;
250-
while (fuzzed_data_provider.ConsumeBool()) {
250+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
251251
const std::optional<CAddress> opt_address = ConsumeDeserializable<CAddress>(fuzzed_data_provider);
252252
if (!opt_address) {
253253
break;

‎src/test/fuzz/autofile.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ FUZZ_TARGET(autofile)
1919
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
2020
FuzzedAutoFileProvider fuzzed_auto_file_provider = ConsumeAutoFile(fuzzed_data_provider);
2121
CAutoFile auto_file = fuzzed_auto_file_provider.open();
22-
while (fuzzed_data_provider.ConsumeBool()) {
22+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2323
CallOneOf(
2424
fuzzed_data_provider,
2525
[&] {

‎src/test/fuzz/bloom_filter.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ FUZZ_TARGET(bloom_filter)
2424
1.0 / fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(1, std::numeric_limits<unsigned int>::max()),
2525
fuzzed_data_provider.ConsumeIntegral<unsigned int>(),
2626
static_cast<unsigned char>(fuzzed_data_provider.PickValueInArray({BLOOM_UPDATE_NONE, BLOOM_UPDATE_ALL, BLOOM_UPDATE_P2PUBKEY_ONLY, BLOOM_UPDATE_MASK}))};
27-
while (fuzzed_data_provider.remaining_bytes() > 0) {
27+
LIMITED_WHILE(fuzzed_data_provider.remaining_bytes() > 0, 10000) {
2828
CallOneOf(
2929
fuzzed_data_provider,
3030
[&] {

‎src/test/fuzz/buffered_file.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ FUZZ_TARGET(buffered_file)
2929
}
3030
if (opt_buffered_file && fuzzed_file != nullptr) {
3131
bool setpos_fail = false;
32-
while (fuzzed_data_provider.ConsumeBool()) {
32+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
3333
CallOneOf(
3434
fuzzed_data_provider,
3535
[&] {

‎src/test/fuzz/chain.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ FUZZ_TARGET(chain)
3535
(void)CDiskBlockIndex{*disk_block_index};
3636
(void)disk_block_index->BuildSkip();
3737

38-
while (fuzzed_data_provider.ConsumeBool()) {
38+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
3939
const BlockStatus block_status = fuzzed_data_provider.PickValueInArray({
4040
BlockStatus::BLOCK_VALID_UNKNOWN,
4141
BlockStatus::BLOCK_VALID_RESERVED,

‎src/test/fuzz/coins_view.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ FUZZ_TARGET_INIT(coins_view, initialize_coins_view)
5151
COutPoint random_out_point;
5252
Coin random_coin;
5353
CMutableTransaction random_mutable_transaction;
54-
while (fuzzed_data_provider.ConsumeBool()) {
54+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
5555
CallOneOf(
5656
fuzzed_data_provider,
5757
[&] {
@@ -114,7 +114,7 @@ FUZZ_TARGET_INIT(coins_view, initialize_coins_view)
114114
},
115115
[&] {
116116
CCoinsMap coins_map;
117-
while (fuzzed_data_provider.ConsumeBool()) {
117+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
118118
CCoinsCacheEntry coins_cache_entry;
119119
coins_cache_entry.flags = fuzzed_data_provider.ConsumeIntegral<unsigned char>();
120120
if (fuzzed_data_provider.ConsumeBool()) {

‎src/test/fuzz/connman.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ FUZZ_TARGET_INIT(connman, initialize_connman)
3131
CNode random_node = ConsumeNode(fuzzed_data_provider);
3232
CSubNet random_subnet;
3333
std::string random_string;
34-
while (fuzzed_data_provider.ConsumeBool()) {
34+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
3535
CallOneOf(
3636
fuzzed_data_provider,
3737
[&] {

‎src/test/fuzz/crypto_aes256.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ FUZZ_TARGET(crypto_aes256)
1919
AES256Encrypt encrypt{key.data()};
2020
AES256Decrypt decrypt{key.data()};
2121

22-
while (fuzzed_data_provider.ConsumeBool()) {
22+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2323
const std::vector<uint8_t> plaintext = ConsumeFixedLengthByteVector(fuzzed_data_provider, AES_BLOCKSIZE);
2424
std::vector<uint8_t> ciphertext(AES_BLOCKSIZE);
2525
encrypt.Encrypt(ciphertext.data(), plaintext.data());

‎src/test/fuzz/crypto_aes256cbc.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ FUZZ_TARGET(crypto_aes256cbc)
2121
AES256CBCEncrypt encrypt{key.data(), iv.data(), pad};
2222
AES256CBCDecrypt decrypt{key.data(), iv.data(), pad};
2323

24-
while (fuzzed_data_provider.ConsumeBool()) {
24+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2525
const std::vector<uint8_t> plaintext = ConsumeRandomLengthByteVector(fuzzed_data_provider);
2626
std::vector<uint8_t> ciphertext(plaintext.size() + AES_BLOCKSIZE);
2727
const int encrypt_ret = encrypt.Encrypt(plaintext.data(), plaintext.size(), ciphertext.data());

‎src/test/fuzz/crypto_chacha20.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ FUZZ_TARGET(crypto_chacha20)
1919
const std::vector<unsigned char> key = ConsumeFixedLengthByteVector(fuzzed_data_provider, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(16, 32));
2020
chacha20 = ChaCha20{key.data(), key.size()};
2121
}
22-
while (fuzzed_data_provider.ConsumeBool()) {
22+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2323
CallOneOf(
2424
fuzzed_data_provider,
2525
[&] {

‎src/test/fuzz/crypto_chacha20_poly1305_aead.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ FUZZ_TARGET(crypto_chacha20_poly1305_aead)
2828
std::vector<uint8_t> in(buffer_size + CHACHA20_POLY1305_AEAD_AAD_LEN + POLY1305_TAGLEN, 0);
2929
std::vector<uint8_t> out(buffer_size + CHACHA20_POLY1305_AEAD_AAD_LEN + POLY1305_TAGLEN, 0);
3030
bool is_encrypt = fuzzed_data_provider.ConsumeBool();
31-
while (fuzzed_data_provider.ConsumeBool()) {
31+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
3232
CallOneOf(
3333
fuzzed_data_provider,
3434
[&] {

‎src/test/fuzz/crypto_hkdf_hmac_sha256_l32.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ FUZZ_TARGET(crypto_hkdf_hmac_sha256_l32)
1818
const std::vector<uint8_t> initial_key_material = ConsumeRandomLengthByteVector(fuzzed_data_provider);
1919

2020
CHKDF_HMAC_SHA256_L32 hkdf_hmac_sha256_l32(initial_key_material.data(), initial_key_material.size(), fuzzed_data_provider.ConsumeRandomLengthString(1024));
21-
while (fuzzed_data_provider.ConsumeBool()) {
21+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2222
std::vector<uint8_t> out(32);
2323
hkdf_hmac_sha256_l32.Expand32(fuzzed_data_provider.ConsumeRandomLengthString(128), out.data());
2424
}

‎src/test/fuzz/cuckoocache.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ FUZZ_TARGET(cuckoocache)
3737
} else {
3838
cuckoo_cache.setup(fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, 4096));
3939
}
40-
while (fuzzed_data_provider.ConsumeBool()) {
40+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
4141
if (fuzzed_data_provider.ConsumeBool()) {
4242
cuckoo_cache.insert(fuzzed_data_provider.ConsumeBool());
4343
} else {

‎src/test/fuzz/fees.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ FUZZ_TARGET(fees)
1818
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
1919
const CFeeRate minimal_incremental_fee{ConsumeMoney(fuzzed_data_provider)};
2020
FeeFilterRounder fee_filter_rounder{minimal_incremental_fee};
21-
while (fuzzed_data_provider.ConsumeBool()) {
21+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2222
const CAmount current_minimum_fee = ConsumeMoney(fuzzed_data_provider);
2323
const CAmount rounded_fee = fee_filter_rounder.round(current_minimum_fee);
2424
assert(MoneyRange(rounded_fee));

‎src/test/fuzz/merkleblock.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ FUZZ_TARGET(merkleblock)
3434
if (fuzzed_data_provider.ConsumeBool()) {
3535
merkle_block = CMerkleBlock{*opt_block, bloom_filter};
3636
} else if (fuzzed_data_provider.ConsumeBool()) {
37-
while (fuzzed_data_provider.ConsumeBool()) {
37+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
3838
txids.insert(ConsumeUInt256(fuzzed_data_provider));
3939
}
4040
merkle_block = CMerkleBlock{*opt_block, txids};

‎src/test/fuzz/net.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ FUZZ_TARGET_INIT(net, initialize_net)
3232
SetMockTime(ConsumeTime(fuzzed_data_provider));
3333
CNode node{ConsumeNode(fuzzed_data_provider)};
3434
node.SetCommonVersion(fuzzed_data_provider.ConsumeIntegral<int>());
35-
while (fuzzed_data_provider.ConsumeBool()) {
35+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
3636
CallOneOf(
3737
fuzzed_data_provider,
3838
[&] {

‎src/test/fuzz/netbase_dns_lookup.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ FUZZ_TARGET(netbase_dns_lookup)
2222

2323
auto fuzzed_dns_lookup_function = [&](const std::string&, bool) {
2424
std::vector<CNetAddr> resolved_addresses;
25-
while (fuzzed_data_provider.ConsumeBool()) {
25+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2626
resolved_addresses.push_back(ConsumeNetAddr(fuzzed_data_provider));
2727
}
2828
return resolved_addresses;

‎src/test/fuzz/node_eviction.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ FUZZ_TARGET(node_eviction)
1818
{
1919
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
2020
std::vector<NodeEvictionCandidate> eviction_candidates;
21-
while (fuzzed_data_provider.ConsumeBool()) {
21+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2222
eviction_candidates.push_back({
2323
/* id */ fuzzed_data_provider.ConsumeIntegral<NodeId>(),
2424
/* nTimeConnected */ fuzzed_data_provider.ConsumeIntegral<int64_t>(),

‎src/test/fuzz/policy_estimator.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ FUZZ_TARGET_INIT(policy_estimator, initialize_policy_estimator)
2424
{
2525
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
2626
CBlockPolicyEstimator block_policy_estimator;
27-
while (fuzzed_data_provider.ConsumeBool()) {
27+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2828
CallOneOf(
2929
fuzzed_data_provider,
3030
[&] {
@@ -40,7 +40,7 @@ FUZZ_TARGET_INIT(policy_estimator, initialize_policy_estimator)
4040
},
4141
[&] {
4242
std::vector<CTxMemPoolEntry> mempool_entries;
43-
while (fuzzed_data_provider.ConsumeBool()) {
43+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
4444
const std::optional<CMutableTransaction> mtx = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
4545
if (!mtx) {
4646
break;

‎src/test/fuzz/pow.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ FUZZ_TARGET_INIT(pow, initialize_pow)
2727
std::vector<CBlockIndex> blocks;
2828
const uint32_t fixed_time = fuzzed_data_provider.ConsumeIntegral<uint32_t>();
2929
const uint32_t fixed_bits = fuzzed_data_provider.ConsumeIntegral<uint32_t>();
30-
while (fuzzed_data_provider.remaining_bytes() > 0) {
30+
LIMITED_WHILE(fuzzed_data_provider.remaining_bytes() > 0, 10000) {
3131
const std::optional<CBlockHeader> block_header = ConsumeDeserializable<CBlockHeader>(fuzzed_data_provider);
3232
if (!block_header) {
3333
continue;

‎src/test/fuzz/process_messages.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ FUZZ_TARGET_INIT(process_messages, initialize_process_messages)
5555
connman.AddTestNode(p2p_node);
5656
}
5757

58-
while (fuzzed_data_provider.ConsumeBool()) {
58+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
5959
const std::string random_message_type{fuzzed_data_provider.ConsumeBytesAsString(CMessageHeader::COMMAND_SIZE).c_str()};
6060

6161
const auto mock_time = ConsumeTime(fuzzed_data_provider);

‎src/test/fuzz/rbf.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ FUZZ_TARGET(rbf)
2424
return;
2525
}
2626
CTxMemPool pool;
27-
while (fuzzed_data_provider.ConsumeBool()) {
27+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2828
const std::optional<CMutableTransaction> another_mtx = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
2929
if (!another_mtx) {
3030
break;

‎src/test/fuzz/rpc.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ std::string ConsumeScalarRPCArgument(FuzzedDataProvider& fuzzed_data_provider)
294294
std::string ConsumeArrayRPCArgument(FuzzedDataProvider& fuzzed_data_provider)
295295
{
296296
std::vector<std::string> scalar_arguments;
297-
while (fuzzed_data_provider.ConsumeBool()) {
297+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 100) {
298298
scalar_arguments.push_back(ConsumeScalarRPCArgument(fuzzed_data_provider));
299299
}
300300
return "[\"" + Join(scalar_arguments, "\",\"") + "\"]";
@@ -348,7 +348,7 @@ FUZZ_TARGET_INIT(rpc, initialize_rpc)
348348
return;
349349
}
350350
std::vector<std::string> arguments;
351-
while (fuzzed_data_provider.ConsumeBool()) {
351+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 100) {
352352
arguments.push_back(ConsumeRPCArgument(fuzzed_data_provider));
353353
}
354354
try {

‎src/test/fuzz/script_descriptor_cache.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ FUZZ_TARGET(script_descriptor_cache)
1717
{
1818
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
1919
DescriptorCache descriptor_cache;
20-
while (fuzzed_data_provider.ConsumeBool()) {
20+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
2121
const std::vector<uint8_t> code = fuzzed_data_provider.ConsumeBytes<uint8_t>(BIP32_EXTKEY_SIZE);
2222
if (code.size() == BIP32_EXTKEY_SIZE) {
2323
CExtPubKey xpub;

‎src/test/fuzz/script_ops.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ FUZZ_TARGET(script_ops)
1515
{
1616
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
1717
CScript script_mut = ConsumeScript(fuzzed_data_provider);
18-
while (fuzzed_data_provider.remaining_bytes() > 0) {
18+
LIMITED_WHILE(fuzzed_data_provider.remaining_bytes() > 0, 1000000) {
1919
CallOneOf(
2020
fuzzed_data_provider,
2121
[&] {

‎src/test/fuzz/script_sign.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ FUZZ_TARGET_INIT(script_sign, initialize_script_sign)
4848

4949
{
5050
std::map<CPubKey, KeyOriginInfo> hd_keypaths;
51-
while (fuzzed_data_provider.ConsumeBool()) {
51+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
5252
const std::optional<CPubKey> pub_key = ConsumeDeserializable<CPubKey>(fuzzed_data_provider);
5353
if (!pub_key) {
5454
break;
@@ -125,7 +125,7 @@ FUZZ_TARGET_INIT(script_sign, initialize_script_sign)
125125
(void)signature_creator.CreateSig(provider, vch_sig, address, ConsumeScript(fuzzed_data_provider), fuzzed_data_provider.PickValueInArray({SigVersion::BASE, SigVersion::WITNESS_V0}));
126126
}
127127
std::map<COutPoint, Coin> coins;
128-
while (fuzzed_data_provider.ConsumeBool()) {
128+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
129129
const std::optional<COutPoint> outpoint = ConsumeDeserializable<COutPoint>(fuzzed_data_provider);
130130
if (!outpoint) {
131131
break;

‎src/test/fuzz/scriptnum_ops.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ FUZZ_TARGET(scriptnum_ops)
2828
{
2929
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
3030
CScriptNum script_num = ConsumeScriptNum(fuzzed_data_provider);
31-
while (fuzzed_data_provider.remaining_bytes() > 0) {
31+
LIMITED_WHILE(fuzzed_data_provider.remaining_bytes() > 0, 1000000) {
3232
CallOneOf(
3333
fuzzed_data_provider,
3434
[&] {

‎src/test/fuzz/torcontrol.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ FUZZ_TARGET_INIT(torcontrol, initialize_torcontrol)
4444
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
4545

4646
TorController tor_controller;
47-
while (fuzzed_data_provider.ConsumeBool()) {
47+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
4848
TorControlReply tor_control_reply;
4949
CallOneOf(
5050
fuzzed_data_provider,

‎src/test/fuzz/versionbits.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ FUZZ_TARGET_INIT(versionbits, initialize)
199199
const uint32_t signalling_mask = fuzzed_data_provider.ConsumeIntegral<uint32_t>();
200200

201201
// mine prior periods
202-
while (fuzzed_data_provider.remaining_bytes() > 0) {
202+
while (fuzzed_data_provider.remaining_bytes() > 0) { // early exit; no need for LIMITED_WHILE
203203
// all blocks in these periods either do or don't signal
204204
bool signal = fuzzed_data_provider.ConsumeBool();
205205
for (int b = 0; b < period; ++b) {

0 commit comments

Comments
 (0)