Skip to content

Commit 95a9165

Browse files
author
MarcoFalke
committed
Merge #18736: test: Add fuzzing harnesses for various classes/functions in util/
32b6b38 tests: Sort fuzzing harnesses (practicalswift) e1e181f tests: Add fuzzing coverage for JSONRPCTransactionError(...) and RPCErrorFromTransactionError(...) (practicalswift) 103b6ec tests: Add fuzzing coverage for TransactionErrorString(...) (practicalswift) dde508b tests: Add fuzzing coverage for ParseFixedPoint(...) (practicalswift) 1532259 tests: Add fuzzing coverage for FormatHDKeypath(...) and WriteHDKeypath(...) (practicalswift) 90b635e tests: Add fuzzing coverage for CHECK_NONFATAL(...) (practicalswift) a4e3d13 tests: Add fuzzing coverage for StringForFeeReason(...) (practicalswift) a19598c tests: Add fuzzing harness for functions in system.h (ArgsManager) (practicalswift) Pull request description: Add fuzzing harnesses for various classes/functions in `util/`. See [`doc/fuzzing.md`](https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md) for information on how to fuzz Bitcoin Core. Don't forget to contribute any coverage increasing inputs you find to the [Bitcoin Core fuzzing corpus repo](https://github.com/bitcoin-core/qa-assets). Happy fuzzing :) Top commit has no ACKs. Tree-SHA512: d27947220850c2a202c7740f44140c17545f45522596912452ccab0c2f5379abeb07cc769982c7855cb465059425206371a2b75ee1c285b03984161c9619d0b0
2 parents 0f204dd + 32b6b38 commit 95a9165

File tree

7 files changed

+189
-5
lines changed

7 files changed

+189
-5
lines changed

src/Makefile.test.include

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ FUZZ_TARGETS = \
4949
test/fuzz/key \
5050
test/fuzz/key_io \
5151
test/fuzz/key_origin_info_deserialize \
52+
test/fuzz/kitchen_sink \
5253
test/fuzz/locale \
5354
test/fuzz/merkle_block_deserialize \
5455
test/fuzz/merkleblock \
@@ -64,13 +65,12 @@ FUZZ_TARGETS = \
6465
test/fuzz/parse_numbers \
6566
test/fuzz/parse_script \
6667
test/fuzz/parse_univalue \
67-
test/fuzz/prevector \
6868
test/fuzz/partial_merkle_tree_deserialize \
6969
test/fuzz/partially_signed_transaction_deserialize \
7070
test/fuzz/pow \
7171
test/fuzz/prefilled_transaction_deserialize \
72+
test/fuzz/prevector \
7273
test/fuzz/primitives_transaction \
73-
test/fuzz/process_messages \
7474
test/fuzz/process_message \
7575
test/fuzz/process_message_addr \
7676
test/fuzz/process_message_block \
@@ -96,6 +96,7 @@ FUZZ_TARGETS = \
9696
test/fuzz/process_message_tx \
9797
test/fuzz/process_message_verack \
9898
test/fuzz/process_message_version \
99+
test/fuzz/process_messages \
99100
test/fuzz/protocol \
100101
test/fuzz/psbt \
101102
test/fuzz/psbt_input_deserialize \
@@ -116,6 +117,7 @@ FUZZ_TARGETS = \
116117
test/fuzz/string \
117118
test/fuzz/strprintf \
118119
test/fuzz/sub_net_deserialize \
120+
test/fuzz/system \
119121
test/fuzz/timedata \
120122
test/fuzz/transaction \
121123
test/fuzz/tx_in \
@@ -567,6 +569,12 @@ test_fuzz_key_origin_info_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
567569
test_fuzz_key_origin_info_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
568570
test_fuzz_key_origin_info_deserialize_SOURCES = test/fuzz/deserialize.cpp
569571

572+
test_fuzz_kitchen_sink_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
573+
test_fuzz_kitchen_sink_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
574+
test_fuzz_kitchen_sink_LDADD = $(FUZZ_SUITE_LD_COMMON)
575+
test_fuzz_kitchen_sink_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
576+
test_fuzz_kitchen_sink_SOURCES = test/fuzz/kitchen_sink.cpp
577+
570578
test_fuzz_locale_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
571579
test_fuzz_locale_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
572580
test_fuzz_locale_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -969,6 +977,12 @@ test_fuzz_sub_net_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
969977
test_fuzz_sub_net_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
970978
test_fuzz_sub_net_deserialize_SOURCES = test/fuzz/deserialize.cpp
971979

980+
test_fuzz_system_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
981+
test_fuzz_system_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
982+
test_fuzz_system_LDADD = $(FUZZ_SUITE_LD_COMMON)
983+
test_fuzz_system_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
984+
test_fuzz_system_SOURCES = test/fuzz/system.cpp
985+
972986
test_fuzz_timedata_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
973987
test_fuzz_timedata_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
974988
test_fuzz_timedata_LDADD = $(FUZZ_SUITE_LD_COMMON)

src/test/fuzz/fees.cpp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
#include <test/fuzz/FuzzedDataProvider.h>
99
#include <test/fuzz/fuzz.h>
1010
#include <test/fuzz/util.h>
11+
#include <util/fees.h>
1112

1213
#include <cstdint>
1314
#include <string>
@@ -23,4 +24,6 @@ void test_one_input(const std::vector<uint8_t>& buffer)
2324
const CAmount rounded_fee = fee_filter_rounder.round(current_minimum_fee);
2425
assert(MoneyRange(rounded_fee));
2526
}
27+
const FeeReason fee_reason = fuzzed_data_provider.PickValueInArray({FeeReason::NONE, FeeReason::HALF_ESTIMATE, FeeReason::FULL_ESTIMATE, FeeReason::DOUBLE_ESTIMATE, FeeReason::CONSERVATIVE, FeeReason::MEMPOOL_MIN, FeeReason::PAYTXFEE, FeeReason::FALLBACK, FeeReason::REQUIRED});
28+
(void)StringForFeeReason(fee_reason);
2629
}

src/test/fuzz/integer.cpp

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@
2424
#include <test/fuzz/FuzzedDataProvider.h>
2525
#include <test/fuzz/fuzz.h>
2626
#include <test/fuzz/util.h>
27-
#include <time.h>
2827
#include <uint256.h>
28+
#include <util/check.h>
2929
#include <util/moneystr.h>
3030
#include <util/strencodings.h>
3131
#include <util/string.h>
@@ -35,6 +35,7 @@
3535

3636
#include <cassert>
3737
#include <chrono>
38+
#include <ctime>
3839
#include <limits>
3940
#include <set>
4041
#include <vector>
@@ -287,8 +288,12 @@ void test_one_input(const std::vector<uint8_t>& buffer)
287288
try {
288289
const uint64_t deserialized_u64 = ReadCompactSize(stream);
289290
assert(u64 == deserialized_u64 && stream.empty());
291+
} catch (const std::ios_base::failure&) {
290292
}
291-
catch (const std::ios_base::failure&) {
292-
}
293+
}
294+
295+
try {
296+
CHECK_NONFATAL(b);
297+
} catch (const NonFatalCheckError&) {
293298
}
294299
}

src/test/fuzz/kitchen_sink.cpp

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <rpc/util.h>
6+
#include <test/fuzz/FuzzedDataProvider.h>
7+
#include <test/fuzz/fuzz.h>
8+
#include <test/fuzz/util.h>
9+
#include <util/error.h>
10+
11+
#include <cstdint>
12+
#include <vector>
13+
14+
// The fuzzing kitchen sink: Fuzzing harness for functions that need to be
15+
// fuzzed but a.) don't belong in any existing fuzzing harness file, and
16+
// b.) are not important enough to warrant their own fuzzing harness file.
17+
void test_one_input(const std::vector<uint8_t>& buffer)
18+
{
19+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
20+
21+
const TransactionError transaction_error = fuzzed_data_provider.PickValueInArray<TransactionError>({TransactionError::OK, TransactionError::MISSING_INPUTS, TransactionError::ALREADY_IN_CHAIN, TransactionError::P2P_DISABLED, TransactionError::MEMPOOL_REJECTED, TransactionError::MEMPOOL_ERROR, TransactionError::INVALID_PSBT, TransactionError::PSBT_MISMATCH, TransactionError::SIGHASH_MISMATCH, TransactionError::MAX_FEE_EXCEEDED});
22+
(void)JSONRPCTransactionError(transaction_error);
23+
(void)RPCErrorFromTransactionError(transaction_error);
24+
(void)TransactionErrorString(transaction_error);
25+
}

src/test/fuzz/parse_hd_keypath.cpp

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,22 @@
22
// Distributed under the MIT software license, see the accompanying
33
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
44

5+
#include <test/fuzz/FuzzedDataProvider.h>
56
#include <test/fuzz/fuzz.h>
7+
#include <test/fuzz/util.h>
68
#include <util/bip32.h>
79

10+
#include <cstdint>
11+
#include <vector>
12+
813
void test_one_input(const std::vector<uint8_t>& buffer)
914
{
1015
const std::string keypath_str(buffer.begin(), buffer.end());
1116
std::vector<uint32_t> keypath;
1217
(void)ParseHDKeypath(keypath_str, keypath);
18+
19+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
20+
const std::vector<uint32_t> random_keypath = ConsumeRandomLengthIntegralVector<uint32_t>(fuzzed_data_provider);
21+
(void)FormatHDKeypath(random_keypath);
22+
(void)WriteHDKeypath(random_keypath);
1323
}

src/test/fuzz/string.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,4 +115,8 @@ void test_one_input(const std::vector<uint8_t>& buffer)
115115
assert(data_stream.empty());
116116
assert(deserialized_string == random_string_1);
117117
}
118+
{
119+
int64_t amount_out;
120+
(void)ParseFixedPoint(random_string_1, fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 1024), &amount_out);
121+
}
118122
}

src/test/fuzz/system.cpp

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <test/fuzz/FuzzedDataProvider.h>
6+
#include <test/fuzz/fuzz.h>
7+
#include <test/fuzz/util.h>
8+
#include <util/system.h>
9+
10+
#include <cstdint>
11+
#include <string>
12+
#include <vector>
13+
14+
namespace {
15+
std::string GetArgumentName(const std::string& name)
16+
{
17+
size_t idx = name.find('=');
18+
if (idx == std::string::npos) {
19+
idx = name.size();
20+
}
21+
return name.substr(0, idx);
22+
}
23+
} // namespace
24+
25+
void test_one_input(const std::vector<uint8_t>& buffer)
26+
{
27+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
28+
ArgsManager args_manager{};
29+
30+
if (fuzzed_data_provider.ConsumeBool()) {
31+
SetupHelpOptions(args_manager);
32+
}
33+
34+
while (fuzzed_data_provider.ConsumeBool()) {
35+
switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 7)) {
36+
case 0: {
37+
args_manager.SelectConfigNetwork(fuzzed_data_provider.ConsumeRandomLengthString(16));
38+
break;
39+
}
40+
case 1: {
41+
args_manager.SoftSetArg(fuzzed_data_provider.ConsumeRandomLengthString(16), fuzzed_data_provider.ConsumeRandomLengthString(16));
42+
break;
43+
}
44+
case 2: {
45+
args_manager.ForceSetArg(fuzzed_data_provider.ConsumeRandomLengthString(16), fuzzed_data_provider.ConsumeRandomLengthString(16));
46+
break;
47+
}
48+
case 3: {
49+
args_manager.SoftSetBoolArg(fuzzed_data_provider.ConsumeRandomLengthString(16), fuzzed_data_provider.ConsumeBool());
50+
break;
51+
}
52+
case 4: {
53+
const OptionsCategory options_category = fuzzed_data_provider.PickValueInArray<OptionsCategory>({OptionsCategory::OPTIONS, OptionsCategory::CONNECTION, OptionsCategory::WALLET, OptionsCategory::WALLET_DEBUG_TEST, OptionsCategory::ZMQ, OptionsCategory::DEBUG_TEST, OptionsCategory::CHAINPARAMS, OptionsCategory::NODE_RELAY, OptionsCategory::BLOCK_CREATION, OptionsCategory::RPC, OptionsCategory::GUI, OptionsCategory::COMMANDS, OptionsCategory::REGISTER_COMMANDS, OptionsCategory::HIDDEN});
54+
// Avoid hitting:
55+
// util/system.cpp:425: void ArgsManager::AddArg(const std::string &, const std::string &, unsigned int, const OptionsCategory &): Assertion `ret.second' failed.
56+
const std::string argument_name = GetArgumentName(fuzzed_data_provider.ConsumeRandomLengthString(16));
57+
if (args_manager.GetArgFlags(argument_name) != nullopt) {
58+
break;
59+
}
60+
args_manager.AddArg(argument_name, fuzzed_data_provider.ConsumeRandomLengthString(16), fuzzed_data_provider.ConsumeIntegral<unsigned int>(), options_category);
61+
break;
62+
}
63+
case 5: {
64+
// Avoid hitting:
65+
// util/system.cpp:425: void ArgsManager::AddArg(const std::string &, const std::string &, unsigned int, const OptionsCategory &): Assertion `ret.second' failed.
66+
const std::vector<std::string> names = ConsumeRandomLengthStringVector(fuzzed_data_provider);
67+
std::vector<std::string> hidden_arguments;
68+
for (const std::string& name : names) {
69+
const std::string hidden_argument = GetArgumentName(name);
70+
if (args_manager.GetArgFlags(hidden_argument) != nullopt) {
71+
continue;
72+
}
73+
if (std::find(hidden_arguments.begin(), hidden_arguments.end(), hidden_argument) != hidden_arguments.end()) {
74+
continue;
75+
}
76+
hidden_arguments.push_back(hidden_argument);
77+
}
78+
args_manager.AddHiddenArgs(hidden_arguments);
79+
break;
80+
}
81+
case 6: {
82+
args_manager.ClearArgs();
83+
break;
84+
}
85+
case 7: {
86+
const std::vector<std::string> random_arguments = ConsumeRandomLengthStringVector(fuzzed_data_provider);
87+
std::vector<const char*> argv;
88+
argv.resize(random_arguments.size());
89+
for (const std::string& random_argument : random_arguments) {
90+
argv.push_back(random_argument.c_str());
91+
}
92+
try {
93+
std::string error;
94+
(void)args_manager.ParseParameters(argv.size(), argv.data(), error);
95+
} catch (const std::logic_error&) {
96+
}
97+
break;
98+
}
99+
}
100+
}
101+
102+
const std::string s1 = fuzzed_data_provider.ConsumeRandomLengthString(16);
103+
const std::string s2 = fuzzed_data_provider.ConsumeRandomLengthString(16);
104+
const int64_t i64 = fuzzed_data_provider.ConsumeIntegral<int64_t>();
105+
const bool b = fuzzed_data_provider.ConsumeBool();
106+
107+
(void)args_manager.GetArg(s1, i64);
108+
(void)args_manager.GetArg(s1, s2);
109+
(void)args_manager.GetArgFlags(s1);
110+
(void)args_manager.GetArgs(s1);
111+
(void)args_manager.GetBoolArg(s1, b);
112+
try {
113+
(void)args_manager.GetChainName();
114+
} catch (const std::runtime_error&) {
115+
}
116+
(void)args_manager.GetHelpMessage();
117+
(void)args_manager.GetUnrecognizedSections();
118+
(void)args_manager.GetUnsuitableSectionOnlyArgs();
119+
(void)args_manager.IsArgNegated(s1);
120+
(void)args_manager.IsArgSet(s1);
121+
122+
(void)HelpRequested(args_manager);
123+
}

0 commit comments

Comments
 (0)