Skip to content

Commit 8514e39

Browse files
kwvgkwvg
committed
merge bitcoin#18455: Add fuzzing harness for functions/classes in flatfile.h, merkleblock.h, random.h, serialize.h and span.h
1 parent a35d9aa commit 8514e39

8 files changed

+208
-9
lines changed

‎src/Makefile.test.include

+28
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ FUZZ_TARGETS = \
3737
test/fuzz/fee_rate \
3838
test/fuzz/fee_rate_deserialize \
3939
test/fuzz/flat_file_pos_deserialize \
40+
test/fuzz/flatfile \
4041
test/fuzz/float \
4142
test/fuzz/hex \
4243
test/fuzz/integer \
@@ -46,6 +47,7 @@ FUZZ_TARGETS = \
4647
test/fuzz/key_origin_info_deserialize \
4748
test/fuzz/locale \
4849
test/fuzz/merkle_block_deserialize \
50+
test/fuzz/merkleblock \
4951
test/fuzz/messageheader_deserialize \
5052
test/fuzz/multiplication_overflow \
5153
test/fuzz/netaddr_deserialize \
@@ -66,13 +68,15 @@ FUZZ_TARGETS = \
6668
test/fuzz/psbt_input_deserialize \
6769
test/fuzz/psbt_output_deserialize \
6870
test/fuzz/pub_key_deserialize \
71+
test/fuzz/random \
6972
test/fuzz/rolling_bloom_filter \
7073
test/fuzz/script \
7174
test/fuzz/script_deserialize \
7275
test/fuzz/script_flags \
7376
test/fuzz/script_ops \
7477
test/fuzz/scriptnum_ops \
7578
test/fuzz/service_deserialize \
79+
test/fuzz/span \
7680
test/fuzz/spanparsing \
7781
test/fuzz/string \
7882
test/fuzz/strprintf \
@@ -472,6 +476,12 @@ test_fuzz_flat_file_pos_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
472476
test_fuzz_flat_file_pos_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
473477
test_fuzz_flat_file_pos_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
474478

479+
test_fuzz_flatfile_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
480+
test_fuzz_flatfile_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
481+
test_fuzz_flatfile_LDADD = $(FUZZ_SUITE_LD_COMMON)
482+
test_fuzz_flatfile_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
483+
test_fuzz_flatfile_SOURCES = $(FUZZ_SUITE) test/fuzz/flatfile.cpp
484+
475485
test_fuzz_float_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
476486
test_fuzz_float_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
477487
test_fuzz_float_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -526,6 +536,12 @@ test_fuzz_merkle_block_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
526536
test_fuzz_merkle_block_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
527537
test_fuzz_merkle_block_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
528538

539+
test_fuzz_merkleblock_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
540+
test_fuzz_merkleblock_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
541+
test_fuzz_merkleblock_LDADD = $(FUZZ_SUITE_LD_COMMON)
542+
test_fuzz_merkleblock_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
543+
test_fuzz_merkleblock_SOURCES = $(FUZZ_SUITE) test/fuzz/merkleblock.cpp
544+
529545
test_fuzz_messageheader_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGEHEADER_DESERIALIZE=1
530546
test_fuzz_messageheader_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
531547
test_fuzz_messageheader_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -646,6 +662,12 @@ test_fuzz_pub_key_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
646662
test_fuzz_pub_key_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
647663
test_fuzz_pub_key_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
648664

665+
test_fuzz_random_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
666+
test_fuzz_random_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
667+
test_fuzz_random_LDADD = $(FUZZ_SUITE_LD_COMMON)
668+
test_fuzz_random_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
669+
test_fuzz_random_SOURCES = $(FUZZ_SUITE) test/fuzz/random.cpp
670+
649671
test_fuzz_rolling_bloom_filter_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
650672
test_fuzz_rolling_bloom_filter_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
651673
test_fuzz_rolling_bloom_filter_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -688,6 +710,12 @@ test_fuzz_service_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
688710
test_fuzz_service_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
689711
test_fuzz_service_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
690712

713+
test_fuzz_span_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
714+
test_fuzz_span_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
715+
test_fuzz_span_LDADD = $(FUZZ_SUITE_LD_COMMON)
716+
test_fuzz_span_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
717+
test_fuzz_span_SOURCES = $(FUZZ_SUITE) test/fuzz/span.cpp
718+
691719
test_fuzz_spanparsing_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
692720
test_fuzz_spanparsing_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
693721
test_fuzz_spanparsing_LDADD = $(FUZZ_SUITE_LD_COMMON)

‎src/random.h

+9-5
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,8 @@ void RandAddPeriodic() noexcept;
9797
*
9898
* This class is not thread-safe.
9999
*/
100-
class FastRandomContext {
100+
class FastRandomContext
101+
{
101102
private:
102103
bool requires_seed;
103104
ChaCha20 rng;
@@ -149,7 +150,8 @@ class FastRandomContext {
149150
}
150151

151152
/** Generate a random (bits)-bit integer. */
152-
uint64_t randbits(int bits) noexcept {
153+
uint64_t randbits(int bits) noexcept
154+
{
153155
if (bits == 0) {
154156
return 0;
155157
} else if (bits > 32) {
@@ -163,7 +165,9 @@ class FastRandomContext {
163165
}
164166
}
165167

166-
/** Generate a random integer in the range [0..range). */
168+
/** Generate a random integer in the range [0..range).
169+
* Precondition: range > 0.
170+
*/
167171
uint64_t randrange(uint64_t range) noexcept
168172
{
169173
assert(range);
@@ -212,7 +216,7 @@ class FastRandomContext {
212216
* debug mode detects and panics on. This is a known issue, see
213217
* https://stackoverflow.com/questions/22915325/avoiding-self-assignment-in-stdshuffle
214218
*/
215-
template<typename I, typename R>
219+
template <typename I, typename R>
216220
void Shuffle(I first, I last, R&& rng)
217221
{
218222
while (first != last) {
@@ -235,7 +239,7 @@ static const int NUM_OS_RANDOM_BYTES = 32;
235239
/** Get 32 bytes of system entropy. Do not use this in application code: use
236240
* GetStrongRandBytes instead.
237241
*/
238-
void GetOSRand(unsigned char *ent32);
242+
void GetOSRand(unsigned char* ent32);
239243

240244
/** Check that OS randomness is available and returning the requested number
241245
* of bytes.

‎src/test/fuzz/flatfile.cpp

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <flatfile.h>
6+
#include <optional.h>
7+
#include <test/fuzz/FuzzedDataProvider.h>
8+
#include <test/fuzz/fuzz.h>
9+
#include <test/fuzz/util.h>
10+
11+
#include <cassert>
12+
#include <cstdint>
13+
#include <string>
14+
#include <vector>
15+
16+
void test_one_input(const std::vector<uint8_t>& buffer)
17+
{
18+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
19+
Optional<FlatFilePos> flat_file_pos = ConsumeDeserializable<FlatFilePos>(fuzzed_data_provider);
20+
if (!flat_file_pos) {
21+
return;
22+
}
23+
Optional<FlatFilePos> another_flat_file_pos = ConsumeDeserializable<FlatFilePos>(fuzzed_data_provider);
24+
if (another_flat_file_pos) {
25+
assert((*flat_file_pos == *another_flat_file_pos) != (*flat_file_pos != *another_flat_file_pos));
26+
}
27+
(void)flat_file_pos->ToString();
28+
flat_file_pos->SetNull();
29+
assert(flat_file_pos->IsNull());
30+
}

‎src/test/fuzz/merkleblock.cpp

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <merkleblock.h>
6+
#include <optional.h>
7+
#include <test/fuzz/FuzzedDataProvider.h>
8+
#include <test/fuzz/fuzz.h>
9+
#include <test/fuzz/util.h>
10+
#include <uint256.h>
11+
12+
#include <cstdint>
13+
#include <string>
14+
#include <vector>
15+
16+
void test_one_input(const std::vector<uint8_t>& buffer)
17+
{
18+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
19+
Optional<CPartialMerkleTree> partial_merkle_tree = ConsumeDeserializable<CPartialMerkleTree>(fuzzed_data_provider);
20+
if (!partial_merkle_tree) {
21+
return;
22+
}
23+
(void)partial_merkle_tree->GetNumTransactions();
24+
std::vector<uint256> matches;
25+
std::vector<unsigned int> indices;
26+
(void)partial_merkle_tree->ExtractMatches(matches, indices);
27+
}

‎src/test/fuzz/random.cpp

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <random.h>
6+
#include <test/fuzz/FuzzedDataProvider.h>
7+
#include <test/fuzz/fuzz.h>
8+
#include <test/fuzz/util.h>
9+
10+
#include <algorithm>
11+
#include <cstdint>
12+
#include <string>
13+
#include <vector>
14+
15+
void test_one_input(const std::vector<uint8_t>& buffer)
16+
{
17+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
18+
FastRandomContext fast_random_context{ConsumeUInt256(fuzzed_data_provider)};
19+
(void)fast_random_context.rand64();
20+
(void)fast_random_context.randbits(fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 64));
21+
(void)fast_random_context.randrange(fuzzed_data_provider.ConsumeIntegralInRange<uint64_t>(FastRandomContext::min() + 1, FastRandomContext::max()));
22+
(void)fast_random_context.randbytes(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 1024));
23+
(void)fast_random_context.rand32();
24+
(void)fast_random_context.rand256();
25+
(void)fast_random_context.randbool();
26+
(void)fast_random_context();
27+
28+
std::vector<int64_t> integrals = ConsumeRandomLengthIntegralVector<int64_t>(fuzzed_data_provider);
29+
Shuffle(integrals.begin(), integrals.end(), fast_random_context);
30+
std::shuffle(integrals.begin(), integrals.end(), fast_random_context);
31+
}

‎src/test/fuzz/span.cpp

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <span.h>
6+
#include <test/fuzz/FuzzedDataProvider.h>
7+
#include <test/fuzz/fuzz.h>
8+
#include <test/fuzz/util.h>
9+
10+
#include <cassert>
11+
#include <cstddef>
12+
#include <cstdint>
13+
#include <string>
14+
#include <vector>
15+
16+
void test_one_input(const std::vector<uint8_t>& buffer)
17+
{
18+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
19+
20+
std::string str = fuzzed_data_provider.ConsumeBytesAsString(32);
21+
const Span<const char> span = MakeSpan(str);
22+
(void)span.data();
23+
(void)span.begin();
24+
(void)span.end();
25+
if (span.size() > 0) {
26+
const std::ptrdiff_t idx = fuzzed_data_provider.ConsumeIntegralInRange<std::ptrdiff_t>(0U, span.size() - 1U);
27+
(void)span.first(idx);
28+
(void)span.last(idx);
29+
(void)span.subspan(idx);
30+
(void)span.subspan(idx, span.size() - idx);
31+
(void)span[idx];
32+
}
33+
34+
std::string another_str = fuzzed_data_provider.ConsumeBytesAsString(32);
35+
const Span<const char> another_span = MakeSpan(another_str);
36+
assert((span <= another_span) != (span > another_span));
37+
assert((span == another_span) != (span != another_span));
38+
assert((span >= another_span) != (span < another_span));
39+
}

‎src/test/fuzz/string.cpp

+29
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
#include <rpc/server.h>
1313
#include <rpc/util.h>
1414
#include <script/descriptor.h>
15+
#include <serialize.h>
16+
#include <streams.h>
1517
#include <test/fuzz/FuzzedDataProvider.h>
1618
#include <test/fuzz/fuzz.h>
1719
#include <test/fuzz/util.h>
@@ -24,6 +26,7 @@
2426
#include <util/system.h>
2527
#include <util/translation.h>
2628
#include <util/url.h>
29+
#include <version.h>
2730

2831
#include <cstdint>
2932
#include <string>
@@ -86,4 +89,30 @@ void test_one_input(const std::vector<uint8_t>& buffer)
8689
(void)urlDecode(random_string_1);
8790
(void)ValidAsCString(random_string_1);
8891
(void)_(random_string_1.c_str());
92+
93+
{
94+
CDataStream data_stream{SER_NETWORK, INIT_PROTO_VERSION};
95+
std::string s;
96+
LimitedString<10> limited_string = LIMITED_STRING(s, 10);
97+
data_stream << random_string_1;
98+
try {
99+
data_stream >> limited_string;
100+
assert(data_stream.empty());
101+
assert(s.size() <= random_string_1.size());
102+
assert(s.size() <= 10);
103+
if (!random_string_1.empty()) {
104+
assert(!s.empty());
105+
}
106+
} catch (const std::ios_base::failure&) {
107+
}
108+
}
109+
{
110+
CDataStream data_stream{SER_NETWORK, INIT_PROTO_VERSION};
111+
const LimitedString<10> limited_string = LIMITED_STRING(random_string_1, 10);
112+
data_stream << limited_string;
113+
std::string deserialized_string;
114+
data_stream >> deserialized_string;
115+
assert(data_stream.empty());
116+
assert(deserialized_string == random_string_1);
117+
}
89118
}

‎src/test/fuzz/util.h

+15-4
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@
2121
#include <string>
2222
#include <vector>
2323

24-
[[ nodiscard ]] inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, size_t max_length = 4096) noexcept
24+
[[ nodiscard ]] inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
2525
{
2626
const std::string s = fuzzed_data_provider.ConsumeRandomLengthString(max_length);
2727
return {s.begin(), s.end()};
2828
}
2929

30-
[[ nodiscard ]] inline std::vector<std::string> ConsumeRandomLengthStringVector(FuzzedDataProvider& fuzzed_data_provider, size_t max_vector_size = 16, size_t max_string_length = 16) noexcept
30+
[[ nodiscard ]] inline std::vector<std::string> ConsumeRandomLengthStringVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_vector_size = 16, const size_t max_string_length = 16) noexcept
3131
{
3232
const size_t n_elements = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_vector_size);
3333
std::vector<std::string> r;
@@ -38,7 +38,18 @@
3838
}
3939

4040
template <typename T>
41-
[[ nodiscard ]] inline Optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, size_t max_length = 4096) noexcept
41+
[[ nodiscard ]] inline std::vector<T> ConsumeRandomLengthIntegralVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_vector_size = 16) noexcept
42+
{
43+
const size_t n_elements = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_vector_size);
44+
std::vector<T> r;
45+
for (size_t i = 0; i < n_elements; ++i) {
46+
r.push_back(fuzzed_data_provider.ConsumeIntegral<T>());
47+
}
48+
return r;
49+
}
50+
51+
template <typename T>
52+
[[ nodiscard ]] inline Optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
4253
{
4354
const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
4455
CDataStream ds{buffer, SER_NETWORK, INIT_PROTO_VERSION};
@@ -87,7 +98,7 @@ template <typename T>
8798
}
8899

89100
template <typename T>
90-
bool MultiplicationOverflow(T i, T j)
101+
[[ nodiscard ]] bool MultiplicationOverflow(const T i, const T j) noexcept
91102
{
92103
static_assert(std::is_integral<T>::value, "Integral required.");
93104
if (std::numeric_limits<T>::is_signed) {

0 commit comments

Comments
 (0)