Skip to content

Commit 3c7e983

Browse files
kwvgkwvg
committed
merge bitcoin#18455: Add fuzzing harness for functions/classes in flatfile.h, merkleblock.h, random.h, serialize.h and span.h
1 parent b00fc11 commit 3c7e983

8 files changed

+208
-9
lines changed

‎src/Makefile.test.include

+28
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ FUZZ_TARGETS = \
3737
test/fuzz/fee_rate \
3838
test/fuzz/fee_rate_deserialize \
3939
test/fuzz/flat_file_pos_deserialize \
40+
test/fuzz/flatfile \
4041
test/fuzz/float \
4142
test/fuzz/hex \
4243
test/fuzz/integer \
@@ -46,6 +47,7 @@ FUZZ_TARGETS = \
4647
test/fuzz/key_origin_info_deserialize \
4748
test/fuzz/locale \
4849
test/fuzz/merkle_block_deserialize \
50+
test/fuzz/merkleblock \
4951
test/fuzz/messageheader_deserialize \
5052
test/fuzz/multiplication_overflow \
5153
test/fuzz/netaddr_deserialize \
@@ -66,13 +68,15 @@ FUZZ_TARGETS = \
6668
test/fuzz/psbt_input_deserialize \
6769
test/fuzz/psbt_output_deserialize \
6870
test/fuzz/pub_key_deserialize \
71+
test/fuzz/random \
6972
test/fuzz/rolling_bloom_filter \
7073
test/fuzz/script \
7174
test/fuzz/script_deserialize \
7275
test/fuzz/script_flags \
7376
test/fuzz/script_ops \
7477
test/fuzz/scriptnum_ops \
7578
test/fuzz/service_deserialize \
79+
test/fuzz/span \
7680
test/fuzz/spanparsing \
7781
test/fuzz/string \
7882
test/fuzz/strprintf \
@@ -476,6 +480,12 @@ test_fuzz_flat_file_pos_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
476480
test_fuzz_flat_file_pos_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
477481
test_fuzz_flat_file_pos_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
478482

483+
test_fuzz_flatfile_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
484+
test_fuzz_flatfile_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
485+
test_fuzz_flatfile_LDADD = $(FUZZ_SUITE_LD_COMMON)
486+
test_fuzz_flatfile_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
487+
test_fuzz_flatfile_SOURCES = $(FUZZ_SUITE) test/fuzz/flatfile.cpp
488+
479489
test_fuzz_float_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
480490
test_fuzz_float_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
481491
test_fuzz_float_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -530,6 +540,12 @@ test_fuzz_merkle_block_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
530540
test_fuzz_merkle_block_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
531541
test_fuzz_merkle_block_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
532542

543+
test_fuzz_merkleblock_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
544+
test_fuzz_merkleblock_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
545+
test_fuzz_merkleblock_LDADD = $(FUZZ_SUITE_LD_COMMON)
546+
test_fuzz_merkleblock_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
547+
test_fuzz_merkleblock_SOURCES = $(FUZZ_SUITE) test/fuzz/merkleblock.cpp
548+
533549
test_fuzz_messageheader_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGEHEADER_DESERIALIZE=1
534550
test_fuzz_messageheader_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
535551
test_fuzz_messageheader_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -650,6 +666,12 @@ test_fuzz_pub_key_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
650666
test_fuzz_pub_key_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
651667
test_fuzz_pub_key_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
652668

669+
test_fuzz_random_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
670+
test_fuzz_random_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
671+
test_fuzz_random_LDADD = $(FUZZ_SUITE_LD_COMMON)
672+
test_fuzz_random_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
673+
test_fuzz_random_SOURCES = $(FUZZ_SUITE) test/fuzz/random.cpp
674+
653675
test_fuzz_rolling_bloom_filter_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
654676
test_fuzz_rolling_bloom_filter_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
655677
test_fuzz_rolling_bloom_filter_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -692,6 +714,12 @@ test_fuzz_service_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
692714
test_fuzz_service_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
693715
test_fuzz_service_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
694716

717+
test_fuzz_span_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
718+
test_fuzz_span_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
719+
test_fuzz_span_LDADD = $(FUZZ_SUITE_LD_COMMON)
720+
test_fuzz_span_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
721+
test_fuzz_span_SOURCES = $(FUZZ_SUITE) test/fuzz/span.cpp
722+
695723
test_fuzz_spanparsing_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
696724
test_fuzz_spanparsing_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
697725
test_fuzz_spanparsing_LDADD = $(FUZZ_SUITE_LD_COMMON)

‎src/random.h

+9-5
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,8 @@ void RandAddEvent(const uint32_t event_info) noexcept;
106106
*
107107
* This class is not thread-safe.
108108
*/
109-
class FastRandomContext {
109+
class FastRandomContext
110+
{
110111
private:
111112
bool requires_seed;
112113
ChaCha20 rng;
@@ -158,7 +159,8 @@ class FastRandomContext {
158159
}
159160

160161
/** Generate a random (bits)-bit integer. */
161-
uint64_t randbits(int bits) noexcept {
162+
uint64_t randbits(int bits) noexcept
163+
{
162164
if (bits == 0) {
163165
return 0;
164166
} else if (bits > 32) {
@@ -172,7 +174,9 @@ class FastRandomContext {
172174
}
173175
}
174176

175-
/** Generate a random integer in the range [0..range). */
177+
/** Generate a random integer in the range [0..range).
178+
* Precondition: range > 0.
179+
*/
176180
uint64_t randrange(uint64_t range) noexcept
177181
{
178182
assert(range);
@@ -221,7 +225,7 @@ class FastRandomContext {
221225
* debug mode detects and panics on. This is a known issue, see
222226
* https://stackoverflow.com/questions/22915325/avoiding-self-assignment-in-stdshuffle
223227
*/
224-
template<typename I, typename R>
228+
template <typename I, typename R>
225229
void Shuffle(I first, I last, R&& rng)
226230
{
227231
while (first != last) {
@@ -244,7 +248,7 @@ static const int NUM_OS_RANDOM_BYTES = 32;
244248
/** Get 32 bytes of system entropy. Do not use this in application code: use
245249
* GetStrongRandBytes instead.
246250
*/
247-
void GetOSRand(unsigned char *ent32);
251+
void GetOSRand(unsigned char* ent32);
248252

249253
/** Check that OS randomness is available and returning the requested number
250254
* of bytes.

‎src/test/fuzz/flatfile.cpp

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <flatfile.h>
6+
#include <optional.h>
7+
#include <test/fuzz/FuzzedDataProvider.h>
8+
#include <test/fuzz/fuzz.h>
9+
#include <test/fuzz/util.h>
10+
11+
#include <cassert>
12+
#include <cstdint>
13+
#include <string>
14+
#include <vector>
15+
16+
void test_one_input(const std::vector<uint8_t>& buffer)
17+
{
18+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
19+
Optional<FlatFilePos> flat_file_pos = ConsumeDeserializable<FlatFilePos>(fuzzed_data_provider);
20+
if (!flat_file_pos) {
21+
return;
22+
}
23+
Optional<FlatFilePos> another_flat_file_pos = ConsumeDeserializable<FlatFilePos>(fuzzed_data_provider);
24+
if (another_flat_file_pos) {
25+
assert((*flat_file_pos == *another_flat_file_pos) != (*flat_file_pos != *another_flat_file_pos));
26+
}
27+
(void)flat_file_pos->ToString();
28+
flat_file_pos->SetNull();
29+
assert(flat_file_pos->IsNull());
30+
}

‎src/test/fuzz/merkleblock.cpp

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <merkleblock.h>
6+
#include <optional.h>
7+
#include <test/fuzz/FuzzedDataProvider.h>
8+
#include <test/fuzz/fuzz.h>
9+
#include <test/fuzz/util.h>
10+
#include <uint256.h>
11+
12+
#include <cstdint>
13+
#include <string>
14+
#include <vector>
15+
16+
void test_one_input(const std::vector<uint8_t>& buffer)
17+
{
18+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
19+
Optional<CPartialMerkleTree> partial_merkle_tree = ConsumeDeserializable<CPartialMerkleTree>(fuzzed_data_provider);
20+
if (!partial_merkle_tree) {
21+
return;
22+
}
23+
(void)partial_merkle_tree->GetNumTransactions();
24+
std::vector<uint256> matches;
25+
std::vector<unsigned int> indices;
26+
(void)partial_merkle_tree->ExtractMatches(matches, indices);
27+
}

‎src/test/fuzz/random.cpp

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <random.h>
6+
#include <test/fuzz/FuzzedDataProvider.h>
7+
#include <test/fuzz/fuzz.h>
8+
#include <test/fuzz/util.h>
9+
10+
#include <algorithm>
11+
#include <cstdint>
12+
#include <string>
13+
#include <vector>
14+
15+
void test_one_input(const std::vector<uint8_t>& buffer)
16+
{
17+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
18+
FastRandomContext fast_random_context{ConsumeUInt256(fuzzed_data_provider)};
19+
(void)fast_random_context.rand64();
20+
(void)fast_random_context.randbits(fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 64));
21+
(void)fast_random_context.randrange(fuzzed_data_provider.ConsumeIntegralInRange<uint64_t>(FastRandomContext::min() + 1, FastRandomContext::max()));
22+
(void)fast_random_context.randbytes(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 1024));
23+
(void)fast_random_context.rand32();
24+
(void)fast_random_context.rand256();
25+
(void)fast_random_context.randbool();
26+
(void)fast_random_context();
27+
28+
std::vector<int64_t> integrals = ConsumeRandomLengthIntegralVector<int64_t>(fuzzed_data_provider);
29+
Shuffle(integrals.begin(), integrals.end(), fast_random_context);
30+
std::shuffle(integrals.begin(), integrals.end(), fast_random_context);
31+
}

‎src/test/fuzz/span.cpp

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <span.h>
6+
#include <test/fuzz/FuzzedDataProvider.h>
7+
#include <test/fuzz/fuzz.h>
8+
#include <test/fuzz/util.h>
9+
10+
#include <cassert>
11+
#include <cstddef>
12+
#include <cstdint>
13+
#include <string>
14+
#include <vector>
15+
16+
void test_one_input(const std::vector<uint8_t>& buffer)
17+
{
18+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
19+
20+
std::string str = fuzzed_data_provider.ConsumeBytesAsString(32);
21+
const Span<const char> span = MakeSpan(str);
22+
(void)span.data();
23+
(void)span.begin();
24+
(void)span.end();
25+
if (span.size() > 0) {
26+
const std::ptrdiff_t idx = fuzzed_data_provider.ConsumeIntegralInRange<std::ptrdiff_t>(0U, span.size() - 1U);
27+
(void)span.first(idx);
28+
(void)span.last(idx);
29+
(void)span.subspan(idx);
30+
(void)span.subspan(idx, span.size() - idx);
31+
(void)span[idx];
32+
}
33+
34+
std::string another_str = fuzzed_data_provider.ConsumeBytesAsString(32);
35+
const Span<const char> another_span = MakeSpan(another_str);
36+
assert((span <= another_span) != (span > another_span));
37+
assert((span == another_span) != (span != another_span));
38+
assert((span >= another_span) != (span < another_span));
39+
}

‎src/test/fuzz/string.cpp

+29
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
#include <rpc/server.h>
1212
#include <rpc/util.h>
1313
#include <script/descriptor.h>
14+
#include <serialize.h>
15+
#include <streams.h>
1416
#include <test/fuzz/FuzzedDataProvider.h>
1517
#include <test/fuzz/fuzz.h>
1618
#include <test/fuzz/util.h>
@@ -22,6 +24,7 @@
2224
#include <util/system.h>
2325
#include <util/translation.h>
2426
#include <util/url.h>
27+
#include <version.h>
2528

2629
#include <cstdint>
2730
#include <string>
@@ -81,4 +84,30 @@ void test_one_input(const std::vector<uint8_t>& buffer)
8184
(void)urlDecode(random_string_1);
8285
(void)ValidAsCString(random_string_1);
8386
(void)_(random_string_1.c_str());
87+
88+
{
89+
CDataStream data_stream{SER_NETWORK, INIT_PROTO_VERSION};
90+
std::string s;
91+
auto limited_string = LIMITED_STRING(s, 10);
92+
data_stream << random_string_1;
93+
try {
94+
data_stream >> limited_string;
95+
assert(data_stream.empty());
96+
assert(s.size() <= random_string_1.size());
97+
assert(s.size() <= 10);
98+
if (!random_string_1.empty()) {
99+
assert(!s.empty());
100+
}
101+
} catch (const std::ios_base::failure&) {
102+
}
103+
}
104+
{
105+
CDataStream data_stream{SER_NETWORK, INIT_PROTO_VERSION};
106+
const auto limited_string = LIMITED_STRING(random_string_1, 10);
107+
data_stream << limited_string;
108+
std::string deserialized_string;
109+
data_stream >> deserialized_string;
110+
assert(data_stream.empty());
111+
assert(deserialized_string == random_string_1);
112+
}
84113
}

‎src/test/fuzz/util.h

+15-4
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@
2121
#include <string>
2222
#include <vector>
2323

24-
[[ nodiscard ]] inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, size_t max_length = 4096) noexcept
24+
[[ nodiscard ]] inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
2525
{
2626
const std::string s = fuzzed_data_provider.ConsumeRandomLengthString(max_length);
2727
return {s.begin(), s.end()};
2828
}
2929

30-
[[ nodiscard ]] inline std::vector<std::string> ConsumeRandomLengthStringVector(FuzzedDataProvider& fuzzed_data_provider, size_t max_vector_size = 16, size_t max_string_length = 16) noexcept
30+
[[ nodiscard ]] inline std::vector<std::string> ConsumeRandomLengthStringVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_vector_size = 16, const size_t max_string_length = 16) noexcept
3131
{
3232
const size_t n_elements = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_vector_size);
3333
std::vector<std::string> r;
@@ -38,7 +38,18 @@
3838
}
3939

4040
template <typename T>
41-
[[ nodiscard ]] inline Optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, size_t max_length = 4096) noexcept
41+
[[ nodiscard ]] inline std::vector<T> ConsumeRandomLengthIntegralVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_vector_size = 16) noexcept
42+
{
43+
const size_t n_elements = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_vector_size);
44+
std::vector<T> r;
45+
for (size_t i = 0; i < n_elements; ++i) {
46+
r.push_back(fuzzed_data_provider.ConsumeIntegral<T>());
47+
}
48+
return r;
49+
}
50+
51+
template <typename T>
52+
[[ nodiscard ]] inline Optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
4253
{
4354
const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
4455
CDataStream ds{buffer, SER_NETWORK, INIT_PROTO_VERSION};
@@ -87,7 +98,7 @@ template <typename T>
8798
}
8899

89100
template <typename T>
90-
bool MultiplicationOverflow(T i, T j)
101+
[[ nodiscard ]] bool MultiplicationOverflow(const T i, const T j) noexcept
91102
{
92103
static_assert(std::is_integral<T>::value, "Integral required.");
93104
if (std::numeric_limits<T>::is_signed) {

0 commit comments

Comments
 (0)