Skip to content

Commit e3154aa

Browse files
author
MarcoFalke
committed
Merge #18445: tests: Add fuzzing harnesses for functions/classes in chain.h and protocol.h
7834c3b tests: Add fuzzing harness for functions/classes in chain.h (practicalswift) d7930c4 tests: Add fuzzing harness for functions/classes in protocol.h (practicalswift) Pull request description: Add fuzzing harnesses for functions/classes in `chain.h` and `protocol.h`. Top commit has no ACKs. Tree-SHA512: ac2d66bc678ebba0ffbbc42e77806eaf3bb07413ff19219c7a83b171ccd4601e0aa8546ee7ffe8018ca4de12d080f79f693d184cc337c234cde641803279f00c
2 parents 0dc6218 + 7834c3b commit e3154aa

File tree

3 files changed

+111
-0
lines changed

3 files changed

+111
-0
lines changed

src/Makefile.test.include

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ FUZZ_TARGETS = \
2626
test/fuzz/blockundo_deserialize \
2727
test/fuzz/bloom_filter \
2828
test/fuzz/bloomfilter_deserialize \
29+
test/fuzz/chain \
2930
test/fuzz/coins_deserialize \
3031
test/fuzz/decode_tx \
3132
test/fuzz/descriptor_parse \
@@ -83,6 +84,7 @@ FUZZ_TARGETS = \
8384
test/fuzz/process_message_tx \
8485
test/fuzz/process_message_verack \
8586
test/fuzz/process_message_version \
87+
test/fuzz/protocol \
8688
test/fuzz/psbt \
8789
test/fuzz/psbt_input_deserialize \
8890
test/fuzz/psbt_output_deserialize \
@@ -424,6 +426,12 @@ test_fuzz_bloomfilter_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
424426
test_fuzz_bloomfilter_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
425427
test_fuzz_bloomfilter_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
426428

429+
test_fuzz_chain_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
430+
test_fuzz_chain_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
431+
test_fuzz_chain_LDADD = $(FUZZ_SUITE_LD_COMMON)
432+
test_fuzz_chain_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
433+
test_fuzz_chain_SOURCES = $(FUZZ_SUITE) test/fuzz/chain.cpp
434+
427435
test_fuzz_coins_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DCOINS_DESERIALIZE=1
428436
test_fuzz_coins_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
429437
test_fuzz_coins_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -766,6 +774,12 @@ test_fuzz_process_message_version_LDADD = $(FUZZ_SUITE_LD_COMMON)
766774
test_fuzz_process_message_version_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
767775
test_fuzz_process_message_version_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
768776

777+
test_fuzz_protocol_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
778+
test_fuzz_protocol_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
779+
test_fuzz_protocol_LDADD = $(FUZZ_SUITE_LD_COMMON)
780+
test_fuzz_protocol_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
781+
test_fuzz_protocol_SOURCES = $(FUZZ_SUITE) test/fuzz/protocol.cpp
782+
769783
test_fuzz_psbt_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
770784
test_fuzz_psbt_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
771785
test_fuzz_psbt_LDADD = $(FUZZ_SUITE_LD_COMMON)

src/test/fuzz/chain.cpp

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <chain.h>
6+
#include <optional.h>
7+
#include <test/fuzz/FuzzedDataProvider.h>
8+
#include <test/fuzz/fuzz.h>
9+
#include <test/fuzz/util.h>
10+
11+
#include <cstdint>
12+
#include <vector>
13+
14+
void test_one_input(const std::vector<uint8_t>& buffer)
15+
{
16+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
17+
Optional<CDiskBlockIndex> disk_block_index = ConsumeDeserializable<CDiskBlockIndex>(fuzzed_data_provider);
18+
if (!disk_block_index) {
19+
return;
20+
}
21+
22+
const uint256 zero{};
23+
disk_block_index->phashBlock = &zero;
24+
(void)disk_block_index->GetBlockHash();
25+
(void)disk_block_index->GetBlockPos();
26+
(void)disk_block_index->GetBlockTime();
27+
(void)disk_block_index->GetBlockTimeMax();
28+
(void)disk_block_index->GetMedianTimePast();
29+
(void)disk_block_index->GetUndoPos();
30+
(void)disk_block_index->HaveTxsDownloaded();
31+
(void)disk_block_index->IsValid();
32+
(void)disk_block_index->ToString();
33+
34+
const CBlockHeader block_header = disk_block_index->GetBlockHeader();
35+
(void)CDiskBlockIndex{*disk_block_index};
36+
(void)disk_block_index->BuildSkip();
37+
38+
while (fuzzed_data_provider.ConsumeBool()) {
39+
const BlockStatus block_status = fuzzed_data_provider.PickValueInArray({
40+
BlockStatus::BLOCK_VALID_UNKNOWN,
41+
BlockStatus::BLOCK_VALID_RESERVED,
42+
BlockStatus::BLOCK_VALID_TREE,
43+
BlockStatus::BLOCK_VALID_TRANSACTIONS,
44+
BlockStatus::BLOCK_VALID_CHAIN,
45+
BlockStatus::BLOCK_VALID_SCRIPTS,
46+
BlockStatus::BLOCK_VALID_MASK,
47+
BlockStatus::BLOCK_HAVE_DATA,
48+
BlockStatus::BLOCK_HAVE_UNDO,
49+
BlockStatus::BLOCK_HAVE_MASK,
50+
BlockStatus::BLOCK_FAILED_VALID,
51+
BlockStatus::BLOCK_FAILED_CHILD,
52+
BlockStatus::BLOCK_FAILED_MASK,
53+
BlockStatus::BLOCK_OPT_WITNESS,
54+
});
55+
if (block_status & ~BLOCK_VALID_MASK) {
56+
continue;
57+
}
58+
(void)disk_block_index->RaiseValidity(block_status);
59+
}
60+
61+
CBlockIndex block_index{block_header};
62+
block_index.phashBlock = &zero;
63+
(void)block_index.GetBlockHash();
64+
(void)block_index.ToString();
65+
}

src/test/fuzz/protocol.cpp

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <optional.h>
6+
#include <protocol.h>
7+
#include <test/fuzz/FuzzedDataProvider.h>
8+
#include <test/fuzz/fuzz.h>
9+
#include <test/fuzz/util.h>
10+
11+
#include <cstdint>
12+
#include <stdexcept>
13+
#include <vector>
14+
15+
void test_one_input(const std::vector<uint8_t>& buffer)
16+
{
17+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
18+
const Optional<CInv> inv = ConsumeDeserializable<CInv>(fuzzed_data_provider);
19+
if (!inv) {
20+
return;
21+
}
22+
try {
23+
(void)inv->GetCommand();
24+
} catch (const std::out_of_range&) {
25+
}
26+
(void)inv->ToString();
27+
const Optional<CInv> another_inv = ConsumeDeserializable<CInv>(fuzzed_data_provider);
28+
if (!another_inv) {
29+
return;
30+
}
31+
(void)(*inv < *another_inv);
32+
}

0 commit comments

Comments
 (0)