Skip to content

Commit f898ef6

Browse files
practicalswiftpracticalswift
committed
tests: Add fuzzing harness for functions in script/sign.h
1 parent c91d2f0 commit f898ef6

File tree

2 files changed

+156
-0
lines changed

2 files changed

+156
-0
lines changed

‎src/Makefile.test.include

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ FUZZ_TARGETS = \
117117
test/fuzz/script_interpreter \
118118
test/fuzz/script_ops \
119119
test/fuzz/script_sigcache \
120+
test/fuzz/script_sign \
120121
test/fuzz/scriptnum_ops \
121122
test/fuzz/service_deserialize \
122123
test/fuzz/signature_checker \
@@ -987,6 +988,12 @@ test_fuzz_script_sigcache_LDADD = $(FUZZ_SUITE_LD_COMMON)
987988
test_fuzz_script_sigcache_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
988989
test_fuzz_script_sigcache_SOURCES = test/fuzz/script_sigcache.cpp
989990

991+
test_fuzz_script_sign_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
992+
test_fuzz_script_sign_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
993+
test_fuzz_script_sign_LDADD = $(FUZZ_SUITE_LD_COMMON)
994+
test_fuzz_script_sign_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
995+
test_fuzz_script_sign_SOURCES = test/fuzz/script_sign.cpp
996+
990997
test_fuzz_scriptnum_ops_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
991998
test_fuzz_scriptnum_ops_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
992999
test_fuzz_scriptnum_ops_LDADD = $(FUZZ_SUITE_LD_COMMON)

‎src/test/fuzz/script_sign.cpp

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <chainparams.h>
6+
#include <chainparamsbase.h>
7+
#include <key.h>
8+
#include <pubkey.h>
9+
#include <script/keyorigin.h>
10+
#include <script/sign.h>
11+
#include <script/signingprovider.h>
12+
#include <streams.h>
13+
#include <test/fuzz/FuzzedDataProvider.h>
14+
#include <test/fuzz/fuzz.h>
15+
#include <test/fuzz/util.h>
16+
17+
#include <cassert>
18+
#include <cstdint>
19+
#include <iostream>
20+
#include <map>
21+
#include <optional>
22+
#include <string>
23+
#include <vector>
24+
25+
void initialize()
26+
{
27+
static const ECCVerifyHandle ecc_verify_handle;
28+
ECC_Start();
29+
SelectParams(CBaseChainParams::REGTEST);
30+
}
31+
32+
void test_one_input(const std::vector<uint8_t>& buffer)
33+
{
34+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
35+
const std::vector<uint8_t> key = ConsumeRandomLengthByteVector(fuzzed_data_provider, 128);
36+
37+
{
38+
CDataStream random_data_stream = ConsumeDataStream(fuzzed_data_provider);
39+
std::map<CPubKey, KeyOriginInfo> hd_keypaths;
40+
try {
41+
DeserializeHDKeypaths(random_data_stream, key, hd_keypaths);
42+
} catch (const std::ios_base::failure&) {
43+
}
44+
CDataStream serialized{SER_NETWORK, PROTOCOL_VERSION};
45+
SerializeHDKeypaths(serialized, hd_keypaths, fuzzed_data_provider.ConsumeIntegral<uint8_t>());
46+
}
47+
48+
{
49+
std::map<CPubKey, KeyOriginInfo> hd_keypaths;
50+
while (fuzzed_data_provider.ConsumeBool()) {
51+
const std::optional<CPubKey> pub_key = ConsumeDeserializable<CPubKey>(fuzzed_data_provider);
52+
if (!pub_key) {
53+
break;
54+
}
55+
const std::optional<KeyOriginInfo> key_origin_info = ConsumeDeserializable<KeyOriginInfo>(fuzzed_data_provider);
56+
if (!key_origin_info) {
57+
break;
58+
}
59+
hd_keypaths[*pub_key] = *key_origin_info;
60+
}
61+
CDataStream serialized{SER_NETWORK, PROTOCOL_VERSION};
62+
try {
63+
SerializeHDKeypaths(serialized, hd_keypaths, fuzzed_data_provider.ConsumeIntegral<uint8_t>());
64+
} catch (const std::ios_base::failure&) {
65+
}
66+
std::map<CPubKey, KeyOriginInfo> deserialized_hd_keypaths;
67+
try {
68+
DeserializeHDKeypaths(serialized, key, hd_keypaths);
69+
} catch (const std::ios_base::failure&) {
70+
}
71+
assert(hd_keypaths.size() >= deserialized_hd_keypaths.size());
72+
}
73+
74+
{
75+
SignatureData signature_data_1{ConsumeScript(fuzzed_data_provider)};
76+
SignatureData signature_data_2{ConsumeScript(fuzzed_data_provider)};
77+
signature_data_1.MergeSignatureData(signature_data_2);
78+
}
79+
80+
FillableSigningProvider provider;
81+
CKey k;
82+
const std::vector<uint8_t> key_data = ConsumeRandomLengthByteVector(fuzzed_data_provider);
83+
k.Set(key_data.begin(), key_data.end(), fuzzed_data_provider.ConsumeBool());
84+
if (k.IsValid()) {
85+
provider.AddKey(k);
86+
}
87+
88+
{
89+
const std::optional<CMutableTransaction> mutable_transaction = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
90+
const std::optional<CTxOut> tx_out = ConsumeDeserializable<CTxOut>(fuzzed_data_provider);
91+
const unsigned int n_in = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
92+
if (mutable_transaction && tx_out && mutable_transaction->vin.size() > n_in) {
93+
SignatureData signature_data_1 = DataFromTransaction(*mutable_transaction, n_in, *tx_out);
94+
CTxIn input;
95+
UpdateInput(input, signature_data_1);
96+
const CScript script = ConsumeScript(fuzzed_data_provider);
97+
SignatureData signature_data_2{script};
98+
signature_data_1.MergeSignatureData(signature_data_2);
99+
}
100+
if (mutable_transaction) {
101+
CTransaction tx_from{*mutable_transaction};
102+
CMutableTransaction tx_to;
103+
const std::optional<CMutableTransaction> opt_tx_to = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
104+
if (opt_tx_to) {
105+
tx_to = *opt_tx_to;
106+
}
107+
CMutableTransaction script_tx_to = tx_to;
108+
CMutableTransaction sign_transaction_tx_to = tx_to;
109+
if (n_in < tx_to.vin.size() && tx_to.vin[n_in].prevout.n < tx_from.vout.size()) {
110+
(void)SignSignature(provider, tx_from, tx_to, n_in, fuzzed_data_provider.ConsumeIntegral<int>());
111+
}
112+
if (n_in < script_tx_to.vin.size()) {
113+
(void)SignSignature(provider, ConsumeScript(fuzzed_data_provider), script_tx_to, n_in, ConsumeMoney(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<int>());
114+
MutableTransactionSignatureCreator signature_creator{&tx_to, n_in, ConsumeMoney(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<int>()};
115+
std::vector<unsigned char> vch_sig;
116+
CKeyID address;
117+
if (fuzzed_data_provider.ConsumeBool()) {
118+
if (k.IsValid()) {
119+
address = k.GetPubKey().GetID();
120+
}
121+
} else {
122+
address = CKeyID{ConsumeUInt160(fuzzed_data_provider)};
123+
}
124+
(void)signature_creator.CreateSig(provider, vch_sig, address, ConsumeScript(fuzzed_data_provider), fuzzed_data_provider.PickValueInArray({SigVersion::BASE, SigVersion::WITNESS_V0}));
125+
}
126+
std::map<COutPoint, Coin> coins;
127+
while (fuzzed_data_provider.ConsumeBool()) {
128+
const std::optional<COutPoint> outpoint = ConsumeDeserializable<COutPoint>(fuzzed_data_provider);
129+
if (!outpoint) {
130+
break;
131+
}
132+
const std::optional<Coin> coin = ConsumeDeserializable<Coin>(fuzzed_data_provider);
133+
if (!coin) {
134+
break;
135+
}
136+
coins[*outpoint] = *coin;
137+
}
138+
std::map<int, std::string> input_errors;
139+
(void)SignTransaction(sign_transaction_tx_to, &provider, coins, fuzzed_data_provider.ConsumeIntegral<int>(), input_errors);
140+
}
141+
}
142+
143+
{
144+
SignatureData signature_data_1;
145+
(void)ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_1);
146+
SignatureData signature_data_2;
147+
(void)ProduceSignature(provider, DUMMY_MAXIMUM_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_2);
148+
}
149+
}

0 commit comments

Comments
 (0)