Skip to content

Commit 0e8d4a1

Browse files
kwvgPastaPastaPasta
kwvg
authored and
PastaPastaPasta
committed
partial bitcoin#21798: Create a block template in tx_pool targets
excludes: - fa03d0a (except ubsan suppression entry)
1 parent ad71db2 commit 0e8d4a1

File tree

4 files changed

+55
-19
lines changed

4 files changed

+55
-19
lines changed

‎src/test/fuzz/tx_pool.cpp‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,13 +76,21 @@ void SetMempoolConstraints(ArgsManager& args, FuzzedDataProvider& fuzzed_data_pr
7676
ToString(fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 999)));
7777
}
7878

79+
void MockTime(FuzzedDataProvider& fuzzed_data_provider, const CChainState& chainstate)
80+
{
81+
const auto time = ConsumeTime(fuzzed_data_provider,
82+
chainstate.m_chain.Tip()->GetMedianTimePast() + 1,
83+
std::numeric_limits<decltype(chainstate.m_chain.Tip()->nTime)>::max());
84+
SetMockTime(time);
85+
}
86+
7987
FUZZ_TARGET_INIT(tx_pool_standard, initialize_tx_pool)
8088
{
8189
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
8290
const auto& node = g_setup->m_node;
8391
auto& chainstate = node.chainman->ActiveChainstate();
8492

85-
SetMockTime(ConsumeTime(fuzzed_data_provider));
93+
MockTime(fuzzed_data_provider, chainstate);
8694
SetMempoolConstraints(*node.args, fuzzed_data_provider);
8795

8896
// All RBF-spendable outpoints
@@ -161,7 +169,7 @@ FUZZ_TARGET_INIT(tx_pool_standard, initialize_tx_pool)
161169
}();
162170

163171
if (fuzzed_data_provider.ConsumeBool()) {
164-
SetMockTime(ConsumeTime(fuzzed_data_provider));
172+
MockTime(fuzzed_data_provider, chainstate);
165173
}
166174
if (fuzzed_data_provider.ConsumeBool()) {
167175
SetMempoolConstraints(*node.args, fuzzed_data_provider);
@@ -262,6 +270,10 @@ FUZZ_TARGET_INIT(tx_pool, initialize_tx_pool)
262270
{
263271
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
264272
const auto& node = g_setup->m_node;
273+
auto& chainstate = node.chainman->ActiveChainstate();
274+
275+
MockTime(fuzzed_data_provider, chainstate);
276+
SetMempoolConstraints(*node.args, fuzzed_data_provider);
265277

266278
std::vector<uint256> txids;
267279
for (const auto& outpoint : g_outpoints_coinbase_init_mature) {
@@ -273,12 +285,30 @@ FUZZ_TARGET_INIT(tx_pool, initialize_tx_pool)
273285
txids.push_back(ConsumeUInt256(fuzzed_data_provider));
274286
}
275287

276-
CTxMemPool tx_pool{/* estimator */ nullptr, /* check_ratio */ 1};
288+
CTxMemPool tx_pool_{/* estimator */ nullptr, /* check_ratio */ 1};
289+
MockedTxPool& tx_pool = *static_cast<MockedTxPool*>(&tx_pool_);
277290

278291
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 300)
279292
{
280293
const auto mut_tx = ConsumeTransaction(fuzzed_data_provider, txids);
281294

295+
if (fuzzed_data_provider.ConsumeBool()) {
296+
MockTime(fuzzed_data_provider, chainstate);
297+
}
298+
if (fuzzed_data_provider.ConsumeBool()) {
299+
SetMempoolConstraints(*node.args, fuzzed_data_provider);
300+
}
301+
if (fuzzed_data_provider.ConsumeBool()) {
302+
tx_pool.RollingFeeUpdate();
303+
}
304+
if (fuzzed_data_provider.ConsumeBool()) {
305+
const auto& txid = fuzzed_data_provider.ConsumeBool() ?
306+
mut_tx.GetHash() :
307+
PickValue(fuzzed_data_provider, txids);
308+
const auto delta = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-50 * COIN, +50 * COIN);
309+
tx_pool.PrioritiseTransaction(txid, delta);
310+
}
311+
282312
const auto tx = MakeTransactionRef(mut_tx);
283313
const bool bypass_limits = fuzzed_data_provider.ConsumeBool();
284314
::fRequireStandard = fuzzed_data_provider.ConsumeBool();

‎src/test/fuzz/util.cpp‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
#include <test/util/script.h>
88
#include <util/overflow.h>
9+
#include <util/time.h>
910
#include <version.h>
1011

1112
FuzzedSock::FuzzedSock(FuzzedDataProvider& fuzzed_data_provider)
@@ -217,6 +218,14 @@ void FillNode(FuzzedDataProvider& fuzzed_data_provider, CNode& node, bool init_v
217218
}
218219
}
219220

221+
int64_t ConsumeTime(FuzzedDataProvider& fuzzed_data_provider, const std::optional<int64_t>& min, const std::optional<int64_t>& max) noexcept
222+
{
223+
// Avoid t=0 (1970-01-01T00:00:00Z) since SetMockTime(0) disables mocktime.
224+
static const int64_t time_min = ParseISO8601DateTime("1970-01-01T00:00:01Z");
225+
static const int64_t time_max = ParseISO8601DateTime("9999-12-31T23:59:59Z");
226+
return fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(min.value_or(time_min), max.value_or(time_max));
227+
}
228+
220229
CMutableTransaction ConsumeTransaction(FuzzedDataProvider& fuzzed_data_provider, const std::optional<std::vector<uint256>>& prevout_txids, const int max_num_in, const int max_num_out) noexcept
221230
{
222231
CMutableTransaction tx_mut;
@@ -248,7 +257,7 @@ CMutableTransaction ConsumeTransaction(FuzzedDataProvider& fuzzed_data_provider,
248257
return tx_mut;
249258
}
250259

251-
CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length) noexcept
260+
CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length) noexcept
252261
{
253262
const std::vector<uint8_t> b = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
254263
return {b.begin(), b.end()};

‎src/test/fuzz/util.h‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828
#include <txmempool.h>
2929
#include <uint256.h>
3030
#include <util/overflow.h>
31-
#include <util/time.h>
3231
#include <util/vector.h>
3332
#include <version.h>
3433

@@ -61,18 +60,20 @@ auto& PickValue(FuzzedDataProvider& fuzzed_data_provider, Collection& col)
6160
return *it;
6261
}
6362

64-
[[ nodiscard ]] inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
63+
[[ nodiscard ]] inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt) noexcept
6564
{
66-
const std::string s = fuzzed_data_provider.ConsumeRandomLengthString(max_length);
65+
const std::string s = max_length ?
66+
fuzzed_data_provider.ConsumeRandomLengthString(*max_length) :
67+
fuzzed_data_provider.ConsumeRandomLengthString();
6768
return {s.begin(), s.end()};
6869
}
6970

70-
[[ nodiscard ]] inline std::vector<bool> ConsumeRandomLengthBitVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
71+
[[ nodiscard ]] inline std::vector<bool> ConsumeRandomLengthBitVector(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt) noexcept
7172
{
7273
return BytesToBits(ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length));
7374
}
7475

75-
[[ nodiscard ]] inline CDataStream ConsumeDataStream(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
76+
[[ nodiscard ]] inline CDataStream ConsumeDataStream(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt) noexcept
7677
{
7778
return CDataStream{ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length), SER_NETWORK, INIT_PROTO_VERSION};
7879
}
@@ -99,7 +100,7 @@ template <typename T>
99100
}
100101

101102
template <typename T>
102-
[[ nodiscard ]] inline std::optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
103+
[[ nodiscard ]] inline std::optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt) noexcept
103104
{
104105
const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
105106
CDataStream ds{buffer, SER_NETWORK, INIT_PROTO_VERSION};
@@ -113,7 +114,7 @@ template <typename T>
113114
}
114115

115116
template <typename WeakEnumType, size_t size>
116-
[[nodiscard]] WeakEnumType ConsumeWeakEnum(FuzzedDataProvider& fuzzed_data_provider, const WeakEnumType (&all_types)[size]) noexcept
117+
[[ nodiscard ]] WeakEnumType ConsumeWeakEnum(FuzzedDataProvider& fuzzed_data_provider, const WeakEnumType (&all_types)[size]) noexcept
117118
{
118119
return fuzzed_data_provider.ConsumeBool() ?
119120
fuzzed_data_provider.PickValueInArray<WeakEnumType>(all_types) :
@@ -130,17 +131,11 @@ template <typename WeakEnumType, size_t size>
130131
return fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, MAX_MONEY);
131132
}
132133

133-
[[ nodiscard ]] inline int64_t ConsumeTime(FuzzedDataProvider& fuzzed_data_provider) noexcept
134-
{
135-
// Avoid t=0 (1970-01-01T00:00:00Z) since SetMockTime(0) is a no-op.
136-
static const int64_t time_min = ParseISO8601DateTime("1970-01-01T00:00:01Z");
137-
static const int64_t time_max = ParseISO8601DateTime("9999-12-31T23:59:59Z");
138-
return fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(time_min, time_max);
139-
}
134+
[[ nodiscard ]] int64_t ConsumeTime(FuzzedDataProvider& fuzzed_data_provider, const std::optional<int64_t>& min = std::nullopt, const std::optional<int64_t>& max = std::nullopt) noexcept;
140135

141136
[[ nodiscard ]] CMutableTransaction ConsumeTransaction(FuzzedDataProvider& fuzzed_data_provider, const std::optional<std::vector<uint256>>& prevout_txids, const int max_num_in = 10, const int max_num_out = 10) noexcept;
142137

143-
[[ nodiscard ]] CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept;
138+
[[ nodiscard ]] CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt) noexcept;
144139

145140
[[ nodiscard ]] uint32_t ConsumeSequence(FuzzedDataProvider& fuzzed_data_provider) noexcept;
146141

‎test/sanitizer_suppressions/ubsan‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
# names can be used.
66
# See https://github.com/google/sanitizers/issues/1364
77
signed-integer-overflow:txmempool.cpp
8+
# https://github.com/bitcoin/bitcoin/pull/21798#issuecomment-829180719
9+
signed-integer-overflow:policy/feerate.cpp
810

911
# -fsanitize=integer suppressions
1012
# ===============================

0 commit comments

Comments
 (0)