Skip to content

Commit f1f26b8

Browse files
author
MarcoFalke
committed
Merge bitcoin#20377: fuzz: Fill various small fuzzing gaps
4ddbcd0 fuzz: Add coverage for CDataStream consumer (practicalswift) 546a076 fuzz: Fill various small fuzzing gaps (practicalswift) Pull request description: Fill various small fuzzing gaps. See [`doc/fuzzing.md`](https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md) for information on how to fuzz Bitcoin Core. Don't forget to contribute any coverage increasing inputs you find to the [Bitcoin Core fuzzing corpus repo](https://github.com/bitcoin-core/qa-assets). Happy fuzzing :) ACKs for top commit: MarcoFalke: review ACK 4ddbcd0 Tree-SHA512: d20f2cc0172f39948673846d088121782f39b4556df8b38fa14859cfa062c1519d18ee9601d4503ef1ba9613976cc5349c1fc0f0b9601a3d68127ffce1b1854e
2 parents 069f37c + 4ddbcd0 commit f1f26b8

File tree

3 files changed

+72
-1
lines changed

3 files changed

+72
-1
lines changed

src/Makefile.test.include

+1
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,7 @@ test_fuzz_fuzz_SOURCES = \
210210
test/fuzz/crypto_hkdf_hmac_sha256_l32.cpp \
211211
test/fuzz/crypto_poly1305.cpp \
212212
test/fuzz/cuckoocache.cpp \
213+
test/fuzz/data_stream.cpp \
213214
test/fuzz/decode_tx.cpp \
214215
test/fuzz/descriptor_parse.cpp \
215216
test/fuzz/deserialize.cpp \

src/test/fuzz/data_stream.cpp

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <addrman.h>
6+
#include <net.h>
7+
#include <test/fuzz/FuzzedDataProvider.h>
8+
#include <test/fuzz/fuzz.h>
9+
#include <test/fuzz/util.h>
10+
11+
#include <cstdint>
12+
#include <vector>
13+
14+
void initialize_data_stream_addr_man()
15+
{
16+
InitializeFuzzingContext();
17+
}
18+
19+
FUZZ_TARGET_INIT(data_stream_addr_man, initialize_data_stream_addr_man)
20+
{
21+
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
22+
CDataStream data_stream = ConsumeDataStream(fuzzed_data_provider);
23+
CAddrMan addr_man;
24+
CAddrDB::Read(addr_man, data_stream);
25+
}

src/test/fuzz/kitchen_sink.cpp

+46-1
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,70 @@
22
// Distributed under the MIT software license, see the accompanying
33
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
44

5+
#include <merkleblock.h>
6+
#include <policy/fees.h>
57
#include <rpc/util.h>
68
#include <test/fuzz/FuzzedDataProvider.h>
79
#include <test/fuzz/fuzz.h>
810
#include <test/fuzz/util.h>
911
#include <util/error.h>
1012
#include <util/translation.h>
1113

14+
#include <array>
1215
#include <cstdint>
1316
#include <vector>
1417

18+
namespace {
19+
constexpr TransactionError ALL_TRANSACTION_ERROR[] = {
20+
TransactionError::OK,
21+
TransactionError::MISSING_INPUTS,
22+
TransactionError::ALREADY_IN_CHAIN,
23+
TransactionError::P2P_DISABLED,
24+
TransactionError::MEMPOOL_REJECTED,
25+
TransactionError::MEMPOOL_ERROR,
26+
TransactionError::INVALID_PSBT,
27+
TransactionError::PSBT_MISMATCH,
28+
TransactionError::SIGHASH_MISMATCH,
29+
TransactionError::MAX_FEE_EXCEEDED,
30+
};
31+
32+
constexpr FeeEstimateHorizon ALL_FEE_EST_HORIZON[] = {
33+
FeeEstimateHorizon::SHORT_HALFLIFE,
34+
FeeEstimateHorizon::MED_HALFLIFE,
35+
FeeEstimateHorizon::LONG_HALFLIFE,
36+
};
37+
38+
constexpr OutputType ALL_OUTPUT_TYPE[] = {
39+
OutputType::LEGACY,
40+
OutputType::P2SH_SEGWIT,
41+
OutputType::BECH32,
42+
};
43+
}; // namespace
44+
1545
// The fuzzing kitchen sink: Fuzzing harness for functions that need to be
1646
// fuzzed but a.) don't belong in any existing fuzzing harness file, and
1747
// b.) are not important enough to warrant their own fuzzing harness file.
1848
FUZZ_TARGET(kitchen_sink)
1949
{
2050
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
2151

22-
const TransactionError transaction_error = fuzzed_data_provider.PickValueInArray<TransactionError>({TransactionError::OK, TransactionError::MISSING_INPUTS, TransactionError::ALREADY_IN_CHAIN, TransactionError::P2P_DISABLED, TransactionError::MEMPOOL_REJECTED, TransactionError::MEMPOOL_ERROR, TransactionError::INVALID_PSBT, TransactionError::PSBT_MISMATCH, TransactionError::SIGHASH_MISMATCH, TransactionError::MAX_FEE_EXCEEDED});
52+
const TransactionError transaction_error = fuzzed_data_provider.PickValueInArray(ALL_TRANSACTION_ERROR);
2353
(void)JSONRPCTransactionError(transaction_error);
2454
(void)RPCErrorFromTransactionError(transaction_error);
2555
(void)TransactionErrorString(transaction_error);
56+
57+
(void)StringForFeeEstimateHorizon(fuzzed_data_provider.PickValueInArray(ALL_FEE_EST_HORIZON));
58+
59+
const OutputType output_type = fuzzed_data_provider.PickValueInArray(ALL_OUTPUT_TYPE);
60+
const std::string& output_type_string = FormatOutputType(output_type);
61+
OutputType output_type_parsed;
62+
const bool parsed = ParseOutputType(output_type_string, output_type_parsed);
63+
assert(parsed);
64+
assert(output_type == output_type_parsed);
65+
(void)ParseOutputType(fuzzed_data_provider.ConsumeRandomLengthString(64), output_type_parsed);
66+
67+
const std::vector<uint8_t> bytes = ConsumeRandomLengthByteVector(fuzzed_data_provider);
68+
const std::vector<bool> bits = BytesToBits(bytes);
69+
const std::vector<uint8_t> bytes_decoded = BitsToBytes(bits);
70+
assert(bytes == bytes_decoded);
2671
}

0 commit comments

Comments
 (0)