Skip to content

Commit 2aa937e

Browse files
author
MarcoFalke
committed
Merge bitcoin/bitcoin#22453: fuzz: Limit max ops in rolling_bloom_filter fuzz target
faa86b7 fuzz: Use ConsumeUInt256 helper to simplify rolling_bloom_filter fuzz test (MarcoFalke) aaaa61f fuzz: Speed up rolling_bloom_filter fuzz test (MarcoFalke) Pull request description: Without a size limit on the input data, the runtime is unbounded. Fix this by picking an upper bound on the maximum number of fuzz operations. Reproducer from OSS-Fuzz (without bug report): [clusterfuzz-testcase-rolling_bloom_filter-5980807721254912.log](https://github.com/bitcoin/bitcoin/files/6822159/clusterfuzz-testcase-rolling_bloom_filter-5980807721254912.log) ACKs for top commit: practicalswift: cr ACK faa86b7 theStack: Concept and code review ACK faa86b7 Tree-SHA512: eace588509dfddb2ba97baf86379fa713fa6eb758184abff676cb95807ff8ff36905eeaddeba05665b8464c35c57e2138f88caec71cbfb255e546bbe76558da0
2 parents 2735e11 + faa86b7 commit 2aa937e

File tree

1 file changed

+9
-8
lines changed

1 file changed

+9
-8
lines changed

src/test/fuzz/rolling_bloom_filter.cpp

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,16 @@
1616

1717
FUZZ_TARGET(rolling_bloom_filter)
1818
{
19+
// Pick an arbitrary upper bound to limit the runtime and avoid timeouts on
20+
// inputs.
21+
int limit_max_ops{3000};
22+
1923
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
2024

2125
CRollingBloomFilter rolling_bloom_filter{
2226
fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(1, 1000),
2327
0.999 / fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(1, std::numeric_limits<unsigned int>::max())};
24-
while (fuzzed_data_provider.remaining_bytes() > 0) {
28+
while (--limit_max_ops >= 0 && fuzzed_data_provider.remaining_bytes() > 0) {
2529
CallOneOf(
2630
fuzzed_data_provider,
2731
[&] {
@@ -32,13 +36,10 @@ FUZZ_TARGET(rolling_bloom_filter)
3236
assert(present);
3337
},
3438
[&] {
35-
const std::optional<uint256> u256 = ConsumeDeserializable<uint256>(fuzzed_data_provider);
36-
if (!u256) {
37-
return;
38-
}
39-
(void)rolling_bloom_filter.contains(*u256);
40-
rolling_bloom_filter.insert(*u256);
41-
const bool present = rolling_bloom_filter.contains(*u256);
39+
const uint256 u256{ConsumeUInt256(fuzzed_data_provider)};
40+
(void)rolling_bloom_filter.contains(u256);
41+
rolling_bloom_filter.insert(u256);
42+
const bool present = rolling_bloom_filter.contains(u256);
4243
assert(present);
4344
},
4445
[&] {

0 commit comments

Comments
 (0)