Skip to content

Commit 35571d8

Browse files
committed
[fuzz] Occasional valid checksum for transport serialization fuzz test
Before commit: Unable to deserialize: 0% Wrong message start : ~1.27% Header too large : ~0.5% Wrong checksum : ~67.99% Invalid message type : ~30.1% 303389 NEW cov: 1202 ft: 8382 corp: 157/382Kb lim: 68189 exec/s: 1451 rss: 447Mb L: 1386/65459 MS: 1 CopyPart- 1428759 REDUCE cov: 1202 ft: 8512 corp: 169/389Kb lim: 78749 exec/s: 1528 rss: 463Mb L: 1627/60488 MS: 1 EraseBytes- After commit(new seeds; old seeds invalidated): Unable to deserialize: 0% Wrong message start : ~45.62% Header too large : ~14.5% Wrong checksum : ~38.13% Invalid message type : ~1.78% 304820 NEW cov: 1440 ft: 4452 corp: 92/12551b lim: 2237 exec/s: 3386 rss: 486Mb L: 47/1111 MS: 1 ChangeByte- 1416181 REDUCE cov: 1442 ft: 5681 corp: 125/59Kb lim: 4096 exec/s: 3522 rss: 535Mb L: 2164/4049 MS: 1 EraseBytes-
1 parent 654472a commit 35571d8

File tree

1 file changed

+22
-2
lines changed

1 file changed

+22
-2
lines changed

src/test/fuzz/p2p_transport_serialization.cpp

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@
33
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
44

55
#include <chainparams.h>
6+
#include <hash.h>
67
#include <net.h>
78
#include <netmessagemaker.h>
89
#include <protocol.h>
10+
#include <test/fuzz/FuzzedDataProvider.h>
911
#include <test/fuzz/fuzz.h>
1012

1113
#include <cassert>
@@ -24,7 +26,25 @@ FUZZ_TARGET_INIT(p2p_transport_serialization, initialize_p2p_transport_serializa
2426
// Construct deserializer, with a dummy NodeId
2527
V1TransportDeserializer deserializer{Params(), (NodeId)0, SER_NETWORK, INIT_PROTO_VERSION};
2628
V1TransportSerializer serializer{};
27-
Span<const uint8_t> msg_bytes{buffer};
29+
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
30+
31+
auto checksum_assist = fuzzed_data_provider.ConsumeBool();
32+
int header_random_bytes_count = checksum_assist ? CMessageHeader::CHECKSUM_OFFSET : CMessageHeader :: HEADER_SIZE;
33+
auto mutable_msg_bytes = fuzzed_data_provider.ConsumeBytes<uint8_t>(header_random_bytes_count);
34+
auto payload_bytes = fuzzed_data_provider.ConsumeRemainingBytes<uint8_t>();
35+
36+
if (checksum_assist && mutable_msg_bytes.size() == CMessageHeader::CHECKSUM_OFFSET) {
37+
CHash256 hasher;
38+
unsigned char hsh[32];
39+
hasher.Write(payload_bytes);
40+
hasher.Finalize(hsh);
41+
for (size_t i = 0; i < CMessageHeader::CHECKSUM_SIZE; ++i) {
42+
mutable_msg_bytes.push_back(hsh[i]);
43+
}
44+
}
45+
46+
mutable_msg_bytes.insert(mutable_msg_bytes.end(), payload_bytes.begin(), payload_bytes.end());
47+
Span<const uint8_t> msg_bytes{mutable_msg_bytes};
2848
while (msg_bytes.size() > 0) {
2949
const int handled = deserializer.Read(msg_bytes);
3050
if (handled < 0) {
@@ -36,7 +56,7 @@ FUZZ_TARGET_INIT(p2p_transport_serialization, initialize_p2p_transport_serializa
3656
std::optional<CNetMessage> result{deserializer.GetMessage(m_time, out_err_raw_size)};
3757
if (result) {
3858
assert(result->m_command.size() <= CMessageHeader::COMMAND_SIZE);
39-
assert(result->m_raw_message_size <= buffer.size());
59+
assert(result->m_raw_message_size <= mutable_msg_bytes.size());
4060
assert(result->m_raw_message_size == CMessageHeader::HEADER_SIZE + result->m_message_size);
4161
assert(result->m_time == m_time);
4262

0 commit comments

Comments
 (0)