Skip to content

Conversation

@pkillarjun
Copy link
Contributor

Adding seed corpus for FuzzVerifyReply

@pkillarjun
Copy link
Contributor Author

How did i get it?

diff --git a/protocol/protocol_test.go b/protocol/protocol_test.go
index eda8453..2b4aa2c 100644
--- a/protocol/protocol_test.go
+++ b/protocol/protocol_test.go
@@ -207,6 +207,10 @@ func TestRunTestVectors(t *testing.T) {
                                if !bytes.Equal(replies[i], expectedReply) {
                                        t.Error("unexpected reply")
                                }
+                               // Print out the bytes before verification
+                               t.Logf("replyBytes=%x", replies[i])
+                               t.Logf("publicKey=%x", rootPublicKey)
+                               t.Logf("nonce=%x", requests[i].Nonce)
 
                                // Make sure the responses verify properly.
                                _, _, err = VerifyReply([]Version{responseVer}, replies[i], rootPublicKey, requests[i].Nonce)

Why is this important?

For these FP(false positive) crash, I guess.

https://oss-fuzz.com/testcase-detail/6652266200760320
https://oss-fuzz.com/testcase-detail/5822721788805120


for _, ver := range allVersions {
_, _, _ = VerifyReply([]Version{ver}, replyBytes, publicKey, nonce)
_, _, _ = VerifyReply([]Version{ver}, parts[0], parts[1], parts[2])
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does the error returned by VerifyReply should be catched and reported as t.Fatal(err)?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NO.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically, this patch isn't even needed in the first place, but it is required for OSS-Fuzz.
So, it's not an actual bug but a bug in the OSS-Fuzz infrastructure.

@pkillarjun pkillarjun closed this May 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants