mirror of
https://github.com/bitcoin/bitcoin.git
synced 2025-01-25 02:33:24 -03:00
fuzz: Link all targets once
This commit is contained in:
parent
751ffaabad
commit
44444ba759
97 changed files with 434 additions and 1306 deletions
|
@ -12,7 +12,7 @@ $ CC=clang CXX=clang++ ./configure --enable-fuzz --with-sanitizers=address,fuzze
|
|||
# macOS users: If you have problem with this step then make sure to read "macOS hints for
|
||||
# libFuzzer" on https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md#macos-hints-for-libfuzzer
|
||||
$ make
|
||||
$ src/test/fuzz/process_message
|
||||
$ FUZZ=process_message src/test/fuzz/fuzz
|
||||
# abort fuzzing using ctrl-c
|
||||
```
|
||||
|
||||
|
@ -26,7 +26,7 @@ If you specify a corpus directory then any new coverage increasing inputs will b
|
|||
|
||||
```sh
|
||||
$ mkdir -p process_message-seeded-from-thin-air/
|
||||
$ src/test/fuzz/process_message process_message-seeded-from-thin-air/
|
||||
$ FUZZ=process_message src/test/fuzz/fuzz process_message-seeded-from-thin-air/
|
||||
INFO: Seed: 840522292
|
||||
INFO: Loaded 1 modules (424174 inline 8-bit counters): 424174 [0x55e121ef9ab8, 0x55e121f613a6),
|
||||
INFO: Loaded 1 PC tables (424174 PCs): 424174 [0x55e121f613a8,0x55e1225da288),
|
||||
|
@ -70,7 +70,7 @@ To fuzz `process_message` using the [`bitcoin-core/qa-assets`](https://github.co
|
|||
|
||||
```sh
|
||||
$ git clone https://github.com/bitcoin-core/qa-assets
|
||||
$ src/test/fuzz/process_message qa-assets/fuzz_seed_corpus/process_message/
|
||||
$ FUZZ=process_message src/test/fuzz/fuzz qa-assets/fuzz_seed_corpus/process_message/
|
||||
INFO: Seed: 1346407872
|
||||
INFO: Loaded 1 modules (424174 inline 8-bit counters): 424174 [0x55d8a9004ab8, 0x55d8a906c3a6),
|
||||
INFO: Loaded 1 PC tables (424174 PCs): 424174 [0x55d8a906c3a8,0x55d8a96e5288),
|
||||
|
@ -129,7 +129,7 @@ $ make
|
|||
# try compiling using: AFL_NO_X86=1 make
|
||||
$ mkdir -p inputs/ outputs/
|
||||
$ echo A > inputs/thin-air-input
|
||||
$ afl/afl-fuzz -i inputs/ -o outputs/ -- src/test/fuzz/bech32
|
||||
$ FUZZ=bech32 afl/afl-fuzz -i inputs/ -o outputs/ -- src/test/fuzz/fuzz
|
||||
# You may have to change a few kernel parameters to test optimally - afl-fuzz
|
||||
# will print an error and suggestion if so.
|
||||
```
|
||||
|
@ -153,7 +153,7 @@ $ cd ..
|
|||
$ CC=$(pwd)/honggfuzz/hfuzz_cc/hfuzz-clang CXX=$(pwd)/honggfuzz/hfuzz_cc/hfuzz-clang++ ./configure --enable-fuzz --with-sanitizers=address,undefined
|
||||
$ make
|
||||
$ mkdir -p inputs/
|
||||
$ honggfuzz/honggfuzz -i inputs/ -- src/test/fuzz/process_message
|
||||
$ FUZZ=process_message honggfuzz/honggfuzz -i inputs/ -- src/test/fuzz/fuzz
|
||||
```
|
||||
|
||||
Read the [Honggfuzz documentation](https://github.com/google/honggfuzz/blob/master/docs/USAGE.md) for more information.
|
||||
|
|
File diff suppressed because it is too large
Load diff
|
@ -40,7 +40,7 @@ void TestAdditionOverflow(FuzzedDataProvider& fuzzed_data_provider)
|
|||
}
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(addition_overflow)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
TestAdditionOverflow<int64_t>(fuzzed_data_provider);
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(addrdb)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -17,7 +17,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_addrman()
|
||||
{
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
@ -32,7 +32,7 @@ public:
|
|||
}
|
||||
};
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(addrman, initialize_addrman)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
SetMockTime(ConsumeTime(fuzzed_data_provider));
|
||||
|
|
|
@ -27,7 +27,7 @@ static const std::vector<bool> IPV4_PREFIX_ASMAP = {
|
|||
true, true, false, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true // Match 0xFF
|
||||
};
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(asmap)
|
||||
{
|
||||
// Encoding: [7 bits: asmap size] [1 bit: ipv6?] [3-130 bytes: asmap] [4 or 16 bytes: addr]
|
||||
if (buffer.size() < 1 + 3 + 4) return;
|
||||
|
|
|
@ -11,7 +11,7 @@
|
|||
|
||||
#include <assert.h>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(asmap_direct)
|
||||
{
|
||||
// Encoding: [asmap using 1 bit / byte] 0xFF [addr using 1 bit / byte]
|
||||
std::optional<size_t> sep_pos_opt;
|
||||
|
|
|
@ -15,7 +15,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(autofile)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
FuzzedAutoFileProvider fuzzed_auto_file_provider = ConsumeAutoFile(fuzzed_data_provider);
|
||||
|
|
|
@ -24,12 +24,12 @@ int64_t ConsumeBanTimeOffset(FuzzedDataProvider& fuzzed_data_provider) noexcept
|
|||
}
|
||||
} // namespace
|
||||
|
||||
void initialize()
|
||||
void initialize_banman()
|
||||
{
|
||||
InitializeFuzzingContext();
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(banman, initialize_banman)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
const fs::path banlist_file = GetDataDir() / "fuzzed_banlist.dat";
|
||||
|
|
|
@ -14,7 +14,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(base_encode_decode)
|
||||
{
|
||||
const std::string random_encoded_string(buffer.begin(), buffer.end());
|
||||
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <utility>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(bech32)
|
||||
{
|
||||
const std::string random_string(buffer.begin(), buffer.end());
|
||||
const std::pair<std::string, std::vector<uint8_t>> r1 = bech32::Decode(random_string);
|
||||
|
|
|
@ -17,13 +17,13 @@
|
|||
#include <cassert>
|
||||
#include <string>
|
||||
|
||||
void initialize()
|
||||
void initialize_block()
|
||||
{
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(block, initialize_block)
|
||||
{
|
||||
CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
|
||||
CBlock block;
|
||||
|
|
|
@ -14,7 +14,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(block_header)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::optional<CBlockHeader> block_header = ConsumeDeserializable<CBlockHeader>(fuzzed_data_provider);
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(blockfilter)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::optional<BlockFilter> block_filter = ConsumeDeserializable<BlockFilter>(fuzzed_data_provider);
|
||||
|
|
|
@ -15,7 +15,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(bloom_filter)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -15,7 +15,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(buffered_file)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
FuzzedFileProvider fuzzed_file_provider = ConsumeFile(fuzzed_data_provider);
|
||||
|
|
|
@ -11,7 +11,7 @@
|
|||
#include <optional>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(chain)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
std::optional<CDiskBlockIndex> disk_block_index = ConsumeDeserializable<CDiskBlockIndex>(fuzzed_data_provider);
|
||||
|
|
|
@ -32,7 +32,7 @@ struct DumbCheck {
|
|||
};
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(checkqueue)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -34,14 +34,14 @@ bool operator==(const Coin& a, const Coin& b)
|
|||
}
|
||||
} // namespace
|
||||
|
||||
void initialize()
|
||||
void initialize_coins_view()
|
||||
{
|
||||
static const ECCVerifyHandle ecc_verify_handle;
|
||||
ECC_Start();
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(coins_view, initialize_coins_view)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
CCoinsView backend_coins_view;
|
||||
|
|
|
@ -15,12 +15,12 @@
|
|||
#include <cstdint>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_connman()
|
||||
{
|
||||
InitializeFuzzingContext();
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(connman, initialize_connman)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
CConnman connman{fuzzed_data_provider.ConsumeIntegral<uint64_t>(), fuzzed_data_provider.ConsumeIntegral<uint64_t>(), fuzzed_data_provider.ConsumeBool()};
|
||||
|
|
|
@ -17,7 +17,7 @@
|
|||
#include <cstdint>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(crypto)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
std::vector<uint8_t> data = ConsumeRandomLengthByteVector(fuzzed_data_provider);
|
||||
|
|
|
@ -11,7 +11,7 @@
|
|||
#include <cstdint>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(crypto_aes256)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
const std::vector<uint8_t> key = ConsumeFixedLengthByteVector(fuzzed_data_provider, AES256_KEYSIZE);
|
||||
|
|
|
@ -11,7 +11,7 @@
|
|||
#include <cstdint>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(crypto_aes256cbc)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
const std::vector<uint8_t> key = ConsumeFixedLengthByteVector(fuzzed_data_provider, AES256_KEYSIZE);
|
||||
|
|
|
@ -10,7 +10,7 @@
|
|||
#include <cstdint>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(crypto_chacha20)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <limits>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(crypto_chacha20_poly1305_aead)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <cstring>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(crypto_common)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
const uint16_t random_u16 = fuzzed_data_provider.ConsumeIntegral<uint16_t>();
|
||||
|
|
|
@ -11,7 +11,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(crypto_hkdf_hmac_sha256_l32)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
|
||||
|
|
|
@ -10,7 +10,7 @@
|
|||
#include <cstdint>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(crypto_poly1305)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
|
||||
|
|
|
@ -26,7 +26,7 @@ struct RandomHasher {
|
|||
};
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(cuckoocache)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
fuzzed_data_provider_ptr = &fuzzed_data_provider;
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(decode_tx)
|
||||
{
|
||||
const std::string tx_hex = HexStr(buffer);
|
||||
CMutableTransaction mtx;
|
||||
|
|
|
@ -8,14 +8,14 @@
|
|||
#include <test/fuzz/fuzz.h>
|
||||
#include <util/memory.h>
|
||||
|
||||
void initialize()
|
||||
void initialize_descriptor_parse()
|
||||
{
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
ECC_Start();
|
||||
SelectParams(CBaseChainParams::MAIN);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(descriptor_parse, initialize_descriptor_parse)
|
||||
{
|
||||
const std::string descriptor(buffer.begin(), buffer.end());
|
||||
FlatSigningProvider signing_provider;
|
||||
|
|
|
@ -34,12 +34,21 @@
|
|||
|
||||
#include <test/fuzz/fuzz.h>
|
||||
|
||||
void initialize()
|
||||
void initialize_deserialize()
|
||||
{
|
||||
// Fuzzers using pubkey must hold an ECCVerifyHandle.
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
}
|
||||
|
||||
#define FUZZ_TARGET_DESERIALIZE(name, code) \
|
||||
FUZZ_TARGET_INIT(name, initialize_deserialize) \
|
||||
{ \
|
||||
try { \
|
||||
code \
|
||||
} catch (const invalid_fuzzing_input_exception&) { \
|
||||
} \
|
||||
}
|
||||
|
||||
namespace {
|
||||
|
||||
struct invalid_fuzzing_input_exception : public std::exception {
|
||||
|
@ -92,44 +101,51 @@ void AssertEqualAfterSerializeDeserialize(const T& obj, const int version = INIT
|
|||
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
{
|
||||
try {
|
||||
#if BLOCK_FILTER_DESERIALIZE
|
||||
FUZZ_TARGET_DESERIALIZE(block_filter_deserialize, {
|
||||
BlockFilter block_filter;
|
||||
DeserializeFromFuzzingInput(buffer, block_filter);
|
||||
#elif ADDR_INFO_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(addr_info_deserialize, {
|
||||
CAddrInfo addr_info;
|
||||
DeserializeFromFuzzingInput(buffer, addr_info);
|
||||
#elif BLOCK_FILE_INFO_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(block_file_info_deserialize, {
|
||||
CBlockFileInfo block_file_info;
|
||||
DeserializeFromFuzzingInput(buffer, block_file_info);
|
||||
#elif BLOCK_HEADER_AND_SHORT_TXIDS_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(block_header_and_short_txids_deserialize, {
|
||||
CBlockHeaderAndShortTxIDs block_header_and_short_txids;
|
||||
DeserializeFromFuzzingInput(buffer, block_header_and_short_txids);
|
||||
#elif FEE_RATE_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(fee_rate_deserialize, {
|
||||
CFeeRate fee_rate;
|
||||
DeserializeFromFuzzingInput(buffer, fee_rate);
|
||||
AssertEqualAfterSerializeDeserialize(fee_rate);
|
||||
#elif MERKLE_BLOCK_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(merkle_block_deserialize, {
|
||||
CMerkleBlock merkle_block;
|
||||
DeserializeFromFuzzingInput(buffer, merkle_block);
|
||||
#elif OUT_POINT_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(out_point_deserialize, {
|
||||
COutPoint out_point;
|
||||
DeserializeFromFuzzingInput(buffer, out_point);
|
||||
AssertEqualAfterSerializeDeserialize(out_point);
|
||||
#elif PARTIAL_MERKLE_TREE_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(partial_merkle_tree_deserialize, {
|
||||
CPartialMerkleTree partial_merkle_tree;
|
||||
DeserializeFromFuzzingInput(buffer, partial_merkle_tree);
|
||||
#elif PUB_KEY_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(pub_key_deserialize, {
|
||||
CPubKey pub_key;
|
||||
DeserializeFromFuzzingInput(buffer, pub_key);
|
||||
// TODO: The following equivalence should hold for CPubKey? Fix.
|
||||
// AssertEqualAfterSerializeDeserialize(pub_key);
|
||||
#elif SCRIPT_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(script_deserialize, {
|
||||
CScript script;
|
||||
DeserializeFromFuzzingInput(buffer, script);
|
||||
#elif SUB_NET_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(sub_net_deserialize, {
|
||||
CSubNet sub_net_1;
|
||||
DeserializeFromFuzzingInput(buffer, sub_net_1, INIT_PROTO_VERSION);
|
||||
AssertEqualAfterSerializeDeserialize(sub_net_1, INIT_PROTO_VERSION);
|
||||
|
@ -139,67 +155,85 @@ void test_one_input(const std::vector<uint8_t>& buffer)
|
|||
CSubNet sub_net_3;
|
||||
DeserializeFromFuzzingInput(buffer, sub_net_3);
|
||||
AssertEqualAfterSerializeDeserialize(sub_net_3, INIT_PROTO_VERSION | ADDRV2_FORMAT);
|
||||
#elif TX_IN_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(tx_in_deserialize, {
|
||||
CTxIn tx_in;
|
||||
DeserializeFromFuzzingInput(buffer, tx_in);
|
||||
AssertEqualAfterSerializeDeserialize(tx_in);
|
||||
#elif FLAT_FILE_POS_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(flat_file_pos_deserialize, {
|
||||
FlatFilePos flat_file_pos;
|
||||
DeserializeFromFuzzingInput(buffer, flat_file_pos);
|
||||
AssertEqualAfterSerializeDeserialize(flat_file_pos);
|
||||
#elif KEY_ORIGIN_INFO_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(key_origin_info_deserialize, {
|
||||
KeyOriginInfo key_origin_info;
|
||||
DeserializeFromFuzzingInput(buffer, key_origin_info);
|
||||
AssertEqualAfterSerializeDeserialize(key_origin_info);
|
||||
#elif PARTIALLY_SIGNED_TRANSACTION_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(partially_signed_transaction_deserialize, {
|
||||
PartiallySignedTransaction partially_signed_transaction;
|
||||
DeserializeFromFuzzingInput(buffer, partially_signed_transaction);
|
||||
#elif PREFILLED_TRANSACTION_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(prefilled_transaction_deserialize, {
|
||||
PrefilledTransaction prefilled_transaction;
|
||||
DeserializeFromFuzzingInput(buffer, prefilled_transaction);
|
||||
#elif PSBT_INPUT_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(psbt_input_deserialize, {
|
||||
PSBTInput psbt_input;
|
||||
DeserializeFromFuzzingInput(buffer, psbt_input);
|
||||
#elif PSBT_OUTPUT_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(psbt_output_deserialize, {
|
||||
PSBTOutput psbt_output;
|
||||
DeserializeFromFuzzingInput(buffer, psbt_output);
|
||||
#elif BLOCK_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(block_deserialize, {
|
||||
CBlock block;
|
||||
DeserializeFromFuzzingInput(buffer, block);
|
||||
#elif BLOCKLOCATOR_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(blocklocator_deserialize, {
|
||||
CBlockLocator bl;
|
||||
DeserializeFromFuzzingInput(buffer, bl);
|
||||
#elif BLOCKMERKLEROOT
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(blockmerkleroot, {
|
||||
CBlock block;
|
||||
DeserializeFromFuzzingInput(buffer, block);
|
||||
bool mutated;
|
||||
BlockMerkleRoot(block, &mutated);
|
||||
#elif ADDRMAN_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(addrman_deserialize, {
|
||||
CAddrMan am;
|
||||
DeserializeFromFuzzingInput(buffer, am);
|
||||
#elif BLOCKHEADER_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(blockheader_deserialize, {
|
||||
CBlockHeader bh;
|
||||
DeserializeFromFuzzingInput(buffer, bh);
|
||||
#elif BANENTRY_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(banentry_deserialize, {
|
||||
CBanEntry be;
|
||||
DeserializeFromFuzzingInput(buffer, be);
|
||||
#elif TXUNDO_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(txundo_deserialize, {
|
||||
CTxUndo tu;
|
||||
DeserializeFromFuzzingInput(buffer, tu);
|
||||
#elif BLOCKUNDO_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(blockundo_deserialize, {
|
||||
CBlockUndo bu;
|
||||
DeserializeFromFuzzingInput(buffer, bu);
|
||||
#elif COINS_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(coins_deserialize, {
|
||||
Coin coin;
|
||||
DeserializeFromFuzzingInput(buffer, coin);
|
||||
#elif NETADDR_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(netaddr_deserialize, {
|
||||
CNetAddr na;
|
||||
DeserializeFromFuzzingInput(buffer, na);
|
||||
if (na.IsAddrV1Compatible()) {
|
||||
AssertEqualAfterSerializeDeserialize(na);
|
||||
}
|
||||
AssertEqualAfterSerializeDeserialize(na, INIT_PROTO_VERSION | ADDRV2_FORMAT);
|
||||
#elif SERVICE_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(service_deserialize, {
|
||||
CService s;
|
||||
DeserializeFromFuzzingInput(buffer, s);
|
||||
if (s.IsAddrV1Compatible()) {
|
||||
|
@ -213,50 +247,56 @@ void test_one_input(const std::vector<uint8_t>& buffer)
|
|||
CService s2;
|
||||
DeserializeFromFuzzingInput(buffer, s2, INIT_PROTO_VERSION | ADDRV2_FORMAT);
|
||||
AssertEqualAfterSerializeDeserialize(s2, INIT_PROTO_VERSION | ADDRV2_FORMAT);
|
||||
#elif MESSAGEHEADER_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(messageheader_deserialize, {
|
||||
CMessageHeader mh;
|
||||
DeserializeFromFuzzingInput(buffer, mh);
|
||||
(void)mh.IsCommandValid();
|
||||
#elif ADDRESS_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(address_deserialize, {
|
||||
CAddress a;
|
||||
DeserializeFromFuzzingInput(buffer, a);
|
||||
#elif INV_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(inv_deserialize, {
|
||||
CInv i;
|
||||
DeserializeFromFuzzingInput(buffer, i);
|
||||
#elif BLOOMFILTER_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(bloomfilter_deserialize, {
|
||||
CBloomFilter bf;
|
||||
DeserializeFromFuzzingInput(buffer, bf);
|
||||
#elif DISKBLOCKINDEX_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(diskblockindex_deserialize, {
|
||||
CDiskBlockIndex dbi;
|
||||
DeserializeFromFuzzingInput(buffer, dbi);
|
||||
#elif TXOUTCOMPRESSOR_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(txoutcompressor_deserialize, {
|
||||
CTxOut to;
|
||||
auto toc = Using<TxOutCompression>(to);
|
||||
DeserializeFromFuzzingInput(buffer, toc);
|
||||
#elif BLOCKTRANSACTIONS_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(blocktransactions_deserialize, {
|
||||
BlockTransactions bt;
|
||||
DeserializeFromFuzzingInput(buffer, bt);
|
||||
#elif BLOCKTRANSACTIONSREQUEST_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(blocktransactionsrequest_deserialize, {
|
||||
BlockTransactionsRequest btr;
|
||||
DeserializeFromFuzzingInput(buffer, btr);
|
||||
#elif SNAPSHOTMETADATA_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(snapshotmetadata_deserialize, {
|
||||
SnapshotMetadata snapshot_metadata;
|
||||
DeserializeFromFuzzingInput(buffer, snapshot_metadata);
|
||||
#elif UINT160_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(uint160_deserialize, {
|
||||
uint160 u160;
|
||||
DeserializeFromFuzzingInput(buffer, u160);
|
||||
AssertEqualAfterSerializeDeserialize(u160);
|
||||
#elif UINT256_DESERIALIZE
|
||||
})
|
||||
FUZZ_TARGET_DESERIALIZE(uint256_deserialize, {
|
||||
uint256 u256;
|
||||
DeserializeFromFuzzingInput(buffer, u256);
|
||||
AssertEqualAfterSerializeDeserialize(u256);
|
||||
#else
|
||||
#error Need at least one fuzz target to compile
|
||||
#endif
|
||||
})
|
||||
// Classes intentionally not covered in this file since their deserialization code is
|
||||
// fuzzed elsewhere:
|
||||
// * Deserialization of CTxOut is fuzzed in test/fuzz/tx_out.cpp
|
||||
// * Deserialization of CMutableTransaction is fuzzed in src/test/fuzz/transaction.cpp
|
||||
} catch (const invalid_fuzzing_input_exception&) {
|
||||
}
|
||||
}
|
||||
|
|
|
@ -10,12 +10,12 @@
|
|||
|
||||
#include <limits>
|
||||
|
||||
void initialize()
|
||||
void initialize_eval_script()
|
||||
{
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(eval_script, initialize_eval_script)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const unsigned int flags = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(fee_rate)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const CAmount satoshis_per_k = ConsumeMoney(fuzzed_data_provider);
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(fees)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const CFeeRate minimal_incremental_fee{ConsumeMoney(fuzzed_data_provider)};
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(flatfile)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
std::optional<FlatFilePos> flat_file_pos = ConsumeDeserializable<FlatFilePos>(fuzzed_data_provider);
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
#include <cassert>
|
||||
#include <cstdint>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(float)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -5,6 +5,7 @@
|
|||
#include <test/fuzz/fuzz.h>
|
||||
|
||||
#include <test/util/setup_common.h>
|
||||
#include <util/check.h>
|
||||
|
||||
#include <cstdint>
|
||||
#include <unistd.h>
|
||||
|
@ -12,6 +13,36 @@
|
|||
|
||||
const std::function<void(const std::string&)> G_TEST_LOG_FUN{};
|
||||
|
||||
std::map<std::string_view, std::tuple<TypeTestOneInput, TypeInitialize>>& FuzzTargets()
|
||||
{
|
||||
static std::map<std::string_view, std::tuple<TypeTestOneInput, TypeInitialize>> g_fuzz_targets;
|
||||
return g_fuzz_targets;
|
||||
}
|
||||
|
||||
void FuzzFrameworkRegisterTarget(std::string_view name, TypeTestOneInput target, TypeInitialize init)
|
||||
{
|
||||
const auto it_ins = FuzzTargets().try_emplace(name, std::move(target), std::move(init));
|
||||
Assert(it_ins.second);
|
||||
}
|
||||
|
||||
static TypeTestOneInput* g_test_one_input{nullptr};
|
||||
|
||||
void initialize()
|
||||
{
|
||||
if (std::getenv("PRINT_ALL_FUZZ_TARGETS_AND_ABORT")) {
|
||||
for (const auto& t : FuzzTargets()) {
|
||||
std::cout << t.first << std::endl;
|
||||
}
|
||||
Assert(false);
|
||||
}
|
||||
std::string_view fuzz_target{Assert(std::getenv("FUZZ"))};
|
||||
const auto it = FuzzTargets().find(fuzz_target);
|
||||
Assert(it != FuzzTargets().end());
|
||||
Assert(!g_test_one_input);
|
||||
g_test_one_input = &std::get<0>(it->second);
|
||||
std::get<1>(it->second)();
|
||||
}
|
||||
|
||||
#if defined(PROVIDE_MAIN_FUNCTION)
|
||||
static bool read_stdin(std::vector<uint8_t>& data)
|
||||
{
|
||||
|
@ -24,14 +55,10 @@ static bool read_stdin(std::vector<uint8_t>& data)
|
|||
}
|
||||
#endif
|
||||
|
||||
// Default initialization: Override using a non-weak initialize().
|
||||
__attribute__((weak)) void initialize()
|
||||
{
|
||||
}
|
||||
|
||||
// This function is used by libFuzzer
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
|
||||
{
|
||||
static const auto& test_one_input = *Assert(g_test_one_input);
|
||||
const std::vector<uint8_t> input(data, data + size);
|
||||
test_one_input(input);
|
||||
return 0;
|
||||
|
@ -48,6 +75,7 @@ extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv)
|
|||
__attribute__((weak)) int main(int argc, char** argv)
|
||||
{
|
||||
initialize();
|
||||
static const auto& test_one_input = *Assert(g_test_one_input);
|
||||
#ifdef __AFL_INIT
|
||||
// Enable AFL deferred forkserver mode. Requires compilation using
|
||||
// afl-clang-fast++. See fuzzing.md for details.
|
||||
|
|
|
@ -5,10 +5,29 @@
|
|||
#ifndef BITCOIN_TEST_FUZZ_FUZZ_H
|
||||
#define BITCOIN_TEST_FUZZ_FUZZ_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include <cstdint>
|
||||
#include <functional>
|
||||
#include <string_view>
|
||||
#include <vector>
|
||||
|
||||
void initialize();
|
||||
void test_one_input(const std::vector<uint8_t>& buffer);
|
||||
using TypeTestOneInput = std::function<void(const std::vector<uint8_t>&)>;
|
||||
using TypeInitialize = std::function<void()>;
|
||||
|
||||
void FuzzFrameworkRegisterTarget(std::string_view name, TypeTestOneInput target, TypeInitialize init);
|
||||
|
||||
void FuzzFrameworkEmptyFun() {}
|
||||
|
||||
#define FUZZ_TARGET(name) \
|
||||
FUZZ_TARGET_INIT(name, FuzzFrameworkEmptyFun)
|
||||
|
||||
#define FUZZ_TARGET_INIT(name, init_fun) \
|
||||
void name##_fuzz_target(const std::vector<uint8_t>&); \
|
||||
struct name##_Before_Main { \
|
||||
name##_Before_Main() \
|
||||
{ \
|
||||
FuzzFrameworkRegisterTarget(#name, name##_fuzz_target, init_fun); \
|
||||
} \
|
||||
} const static g_##name##_before_main; \
|
||||
void name##_fuzz_target(const std::vector<uint8_t>& buffer)
|
||||
|
||||
#endif // BITCOIN_TEST_FUZZ_FUZZ_H
|
||||
|
|
|
@ -54,7 +54,7 @@ std::vector<uint64_t> BuildHashedSet(const std::unordered_set<std::vector<uint8_
|
|||
}
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(golomb_rice)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
std::vector<uint8_t> golomb_rice_data;
|
||||
|
|
|
@ -16,12 +16,12 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_hex()
|
||||
{
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(hex, initialize_hex)
|
||||
{
|
||||
const std::string random_hex_string(buffer.begin(), buffer.end());
|
||||
const std::vector<unsigned char> data = ParseHex(random_hex_string);
|
||||
|
|
|
@ -39,7 +39,7 @@ extern "C" int evhttp_parse_headers_(struct evhttp_request*, struct evbuffer*);
|
|||
|
||||
std::string RequestMethodString(HTTPRequest::RequestMethod m);
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(http_request)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
evhttp_request* evreq = evhttp_request_new(nullptr, nullptr);
|
||||
|
|
|
@ -40,12 +40,12 @@
|
|||
#include <set>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_integer()
|
||||
{
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(integer, initialize_integer)
|
||||
{
|
||||
if (buffer.size() < sizeof(uint256) + sizeof(uint160)) {
|
||||
return;
|
||||
|
|
|
@ -26,14 +26,14 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_key()
|
||||
{
|
||||
static const ECCVerifyHandle ecc_verify_handle;
|
||||
ECC_Start();
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(key, initialize_key)
|
||||
{
|
||||
const CKey key = [&] {
|
||||
CKey k;
|
||||
|
|
|
@ -14,14 +14,14 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_key_io()
|
||||
{
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
ECC_Start();
|
||||
SelectParams(CBaseChainParams::MAIN);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(key_io, initialize_key_io)
|
||||
{
|
||||
const std::string random_string(buffer.begin(), buffer.end());
|
||||
|
||||
|
|
|
@ -15,7 +15,7 @@
|
|||
// The fuzzing kitchen sink: Fuzzing harness for functions that need to be
|
||||
// fuzzed but a.) don't belong in any existing fuzzing harness file, and
|
||||
// b.) are not important enough to warrant their own fuzzing harness file.
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(kitchen_sink)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -13,12 +13,12 @@
|
|||
#include <cstdint>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_load_external_block_file()
|
||||
{
|
||||
InitializeFuzzingContext();
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(load_external_block_file, initialize_load_external_block_file)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
FuzzedFileProvider fuzzed_file_provider = ConsumeFile(fuzzed_data_provider);
|
||||
|
|
|
@ -35,7 +35,7 @@ bool IsAvailableLocale(const std::string& locale_identifier)
|
|||
}
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(locale)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::string locale_identifier = ConsumeLocaleIdentifier(fuzzed_data_provider);
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(merkleblock)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
CPartialMerkleTree partial_merkle_tree;
|
||||
|
|
|
@ -16,14 +16,14 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_message()
|
||||
{
|
||||
static const ECCVerifyHandle ecc_verify_handle;
|
||||
ECC_Start();
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(message, initialize_message)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::string random_message = fuzzed_data_provider.ConsumeRandomLengthString(1024);
|
||||
|
|
|
@ -40,7 +40,7 @@ void TestMultiplicationOverflow(FuzzedDataProvider& fuzzed_data_provider)
|
|||
}
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(multiplication_overflow)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
TestMultiplicationOverflow<int64_t>(fuzzed_data_provider);
|
||||
|
|
|
@ -19,12 +19,12 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_net()
|
||||
{
|
||||
static const BasicTestingSetup basic_testing_setup;
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(net, initialize_net)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(net_permissions)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::string s = fuzzed_data_provider.ConsumeRandomLengthString(32);
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
#include <netinet/in.h>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(netaddress)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -12,12 +12,12 @@
|
|||
#include <limits>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_p2p_transport_deserializer()
|
||||
{
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(p2p_transport_deserializer, initialize_p2p_transport_deserializer)
|
||||
{
|
||||
// Construct deserializer, with a dummy NodeId
|
||||
V1TransportDeserializer deserializer{Params(), (NodeId)0, SER_NETWORK, INIT_PROTO_VERSION};
|
||||
|
|
|
@ -10,7 +10,7 @@
|
|||
#include <cstdint>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(parse_hd_keypath)
|
||||
{
|
||||
const std::string keypath_str(buffer.begin(), buffer.end());
|
||||
std::vector<uint32_t> keypath;
|
||||
|
|
|
@ -11,7 +11,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(parse_iso8601)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -8,7 +8,7 @@
|
|||
|
||||
#include <string>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(parse_numbers)
|
||||
{
|
||||
const std::string random_string(buffer.begin(), buffer.end());
|
||||
|
||||
|
|
|
@ -6,7 +6,7 @@
|
|||
#include <script/script.h>
|
||||
#include <test/fuzz/fuzz.h>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(parse_script)
|
||||
{
|
||||
const std::string script_string(buffer.begin(), buffer.end());
|
||||
try {
|
||||
|
|
|
@ -12,13 +12,13 @@
|
|||
#include <limits>
|
||||
#include <string>
|
||||
|
||||
void initialize()
|
||||
void initialize_parse_univalue()
|
||||
{
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(parse_univalue, initialize_parse_univalue)
|
||||
{
|
||||
const std::string random_string(buffer.begin(), buffer.end());
|
||||
bool valid = true;
|
||||
|
|
|
@ -14,12 +14,12 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_policy_estimator()
|
||||
{
|
||||
InitializeFuzzingContext();
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(policy_estimator, initialize_policy_estimator)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
CBlockPolicyEstimator block_policy_estimator;
|
||||
|
|
|
@ -10,12 +10,12 @@
|
|||
#include <cstdint>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_policy_estimator_io()
|
||||
{
|
||||
InitializeFuzzingContext();
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(policy_estimator_io, initialize_policy_estimator_io)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
FuzzedAutoFileProvider fuzzed_auto_file_provider = ConsumeAutoFile(fuzzed_data_provider);
|
||||
|
|
|
@ -15,12 +15,12 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_pow()
|
||||
{
|
||||
SelectParams(CBaseChainParams::MAIN);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(pow, initialize_pow)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const Consensus::Params& consensus_params = Params().GetConsensus();
|
||||
|
|
|
@ -204,7 +204,7 @@ public:
|
|||
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(prevector)
|
||||
{
|
||||
FuzzedDataProvider prov(buffer.data(), buffer.size());
|
||||
prevector_tester<8, int> test;
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(primitives_transaction)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const CScript script = ConsumeScript(fuzzed_data_provider);
|
||||
|
|
|
@ -32,19 +32,10 @@
|
|||
#include <vector>
|
||||
|
||||
namespace {
|
||||
|
||||
#ifdef MESSAGE_TYPE
|
||||
#define TO_STRING_(s) #s
|
||||
#define TO_STRING(s) TO_STRING_(s)
|
||||
const std::string LIMIT_TO_MESSAGE_TYPE{TO_STRING(MESSAGE_TYPE)};
|
||||
#else
|
||||
const std::string LIMIT_TO_MESSAGE_TYPE;
|
||||
#endif
|
||||
|
||||
const TestingSetup* g_setup;
|
||||
} // namespace
|
||||
|
||||
void initialize()
|
||||
void initialize_process_message()
|
||||
{
|
||||
static TestingSetup setup{
|
||||
CBaseChainParams::REGTEST,
|
||||
|
@ -60,7 +51,7 @@ void initialize()
|
|||
SyncWithValidationInterfaceQueue();
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
void fuzz_target(const std::vector<uint8_t>& buffer, const std::string& LIMIT_TO_MESSAGE_TYPE)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
ConnmanTestMsg& connman = *(ConnmanTestMsg*)g_setup->m_node.connman.get();
|
||||
|
@ -88,3 +79,29 @@ void test_one_input(const std::vector<uint8_t>& buffer)
|
|||
LOCK2(::cs_main, g_cs_orphans); // See init.cpp for rationale for implicit locking order requirement
|
||||
g_setup->m_node.connman->StopNodes();
|
||||
}
|
||||
|
||||
FUZZ_TARGET_INIT(process_message, initialize_process_message) { fuzz_target(buffer, ""); }
|
||||
FUZZ_TARGET_INIT(process_message_addr, initialize_process_message) { fuzz_target(buffer, "addr"); }
|
||||
FUZZ_TARGET_INIT(process_message_block, initialize_process_message) { fuzz_target(buffer, "block"); }
|
||||
FUZZ_TARGET_INIT(process_message_blocktxn, initialize_process_message) { fuzz_target(buffer, "blocktxn"); }
|
||||
FUZZ_TARGET_INIT(process_message_cmpctblock, initialize_process_message) { fuzz_target(buffer, "cmpctblock"); }
|
||||
FUZZ_TARGET_INIT(process_message_feefilter, initialize_process_message) { fuzz_target(buffer, "feefilter"); }
|
||||
FUZZ_TARGET_INIT(process_message_filteradd, initialize_process_message) { fuzz_target(buffer, "filteradd"); }
|
||||
FUZZ_TARGET_INIT(process_message_filterclear, initialize_process_message) { fuzz_target(buffer, "filterclear"); }
|
||||
FUZZ_TARGET_INIT(process_message_filterload, initialize_process_message) { fuzz_target(buffer, "filterload"); }
|
||||
FUZZ_TARGET_INIT(process_message_getaddr, initialize_process_message) { fuzz_target(buffer, "getaddr"); }
|
||||
FUZZ_TARGET_INIT(process_message_getblocks, initialize_process_message) { fuzz_target(buffer, "getblocks"); }
|
||||
FUZZ_TARGET_INIT(process_message_getblocktxn, initialize_process_message) { fuzz_target(buffer, "getblocktxn"); }
|
||||
FUZZ_TARGET_INIT(process_message_getdata, initialize_process_message) { fuzz_target(buffer, "getdata"); }
|
||||
FUZZ_TARGET_INIT(process_message_getheaders, initialize_process_message) { fuzz_target(buffer, "getheaders"); }
|
||||
FUZZ_TARGET_INIT(process_message_headers, initialize_process_message) { fuzz_target(buffer, "headers"); }
|
||||
FUZZ_TARGET_INIT(process_message_inv, initialize_process_message) { fuzz_target(buffer, "inv"); }
|
||||
FUZZ_TARGET_INIT(process_message_mempool, initialize_process_message) { fuzz_target(buffer, "mempool"); }
|
||||
FUZZ_TARGET_INIT(process_message_notfound, initialize_process_message) { fuzz_target(buffer, "notfound"); }
|
||||
FUZZ_TARGET_INIT(process_message_ping, initialize_process_message) { fuzz_target(buffer, "ping"); }
|
||||
FUZZ_TARGET_INIT(process_message_pong, initialize_process_message) { fuzz_target(buffer, "pong"); }
|
||||
FUZZ_TARGET_INIT(process_message_sendcmpct, initialize_process_message) { fuzz_target(buffer, "sendcmpct"); }
|
||||
FUZZ_TARGET_INIT(process_message_sendheaders, initialize_process_message) { fuzz_target(buffer, "sendheaders"); }
|
||||
FUZZ_TARGET_INIT(process_message_tx, initialize_process_message) { fuzz_target(buffer, "tx"); }
|
||||
FUZZ_TARGET_INIT(process_message_verack, initialize_process_message) { fuzz_target(buffer, "verack"); }
|
||||
FUZZ_TARGET_INIT(process_message_version, initialize_process_message) { fuzz_target(buffer, "version"); }
|
||||
|
|
|
@ -19,7 +19,7 @@
|
|||
|
||||
const TestingSetup* g_setup;
|
||||
|
||||
void initialize()
|
||||
void initialize_process_messages()
|
||||
{
|
||||
static TestingSetup setup{
|
||||
CBaseChainParams::REGTEST,
|
||||
|
@ -35,7 +35,7 @@ void initialize()
|
|||
SyncWithValidationInterfaceQueue();
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(process_messages, initialize_process_messages)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
#include <stdexcept>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(protocol)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::optional<CInv> inv = ConsumeDeserializable<CInv>(fuzzed_data_provider);
|
||||
|
|
|
@ -17,12 +17,12 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_psbt()
|
||||
{
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(psbt, initialize_psbt)
|
||||
{
|
||||
PartiallySignedTransaction psbt_mut;
|
||||
const std::string raw_psbt{buffer.begin(), buffer.end()};
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(random)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
FastRandomContext fast_random_context{ConsumeUInt256(fuzzed_data_provider)};
|
||||
|
|
|
@ -15,7 +15,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(rbf)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
std::optional<CMutableTransaction> mtx = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
|
||||
|
|
|
@ -14,7 +14,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(rolling_bloom_filter)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -29,7 +29,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_script()
|
||||
{
|
||||
// Fuzzers using pubkey must hold an ECCVerifyHandle.
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
|
@ -37,7 +37,7 @@ void initialize()
|
|||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(script, initialize_script)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::optional<CScript> script_opt = ConsumeDeserializable<CScript>(fuzzed_data_provider);
|
||||
|
|
|
@ -188,9 +188,9 @@ void Test(const std::string& str)
|
|||
|
||||
ECCVerifyHandle handle;
|
||||
|
||||
}
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(script_assets_test_minimizer)
|
||||
{
|
||||
if (buffer.size() < 2 || buffer.back() != '\n' || buffer[buffer.size() - 2] != ',') return;
|
||||
const std::string str((const char*)buffer.data(), buffer.size() - 2);
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(script_bitcoin_consensus)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::vector<uint8_t> random_bytes_1 = ConsumeRandomLengthByteVector(fuzzed_data_provider);
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(script_descriptor_cache)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
DescriptorCache descriptor_cache;
|
||||
|
|
|
@ -13,12 +13,12 @@
|
|||
/** Flags that are not forbidden by an assert */
|
||||
static bool IsValidFlagCombination(unsigned flags);
|
||||
|
||||
void initialize()
|
||||
void initialize_script_flags()
|
||||
{
|
||||
static const ECCVerifyHandle verify_handle;
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(script_flags, initialize_script_flags)
|
||||
{
|
||||
CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
|
||||
try {
|
||||
|
|
|
@ -15,7 +15,7 @@
|
|||
|
||||
bool CastToBool(const std::vector<unsigned char>& vch);
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(script_interpreter)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
{
|
||||
|
|
|
@ -11,7 +11,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(script_ops)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
CScript script = ConsumeScript(fuzzed_data_provider);
|
||||
|
|
|
@ -16,7 +16,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_script_sigcache()
|
||||
{
|
||||
static const ECCVerifyHandle ecc_verify_handle;
|
||||
ECC_Start();
|
||||
|
@ -24,7 +24,7 @@ void initialize()
|
|||
InitSignatureCache();
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(script_sigcache, initialize_script_sigcache)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -22,14 +22,14 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_script_sign()
|
||||
{
|
||||
static const ECCVerifyHandle ecc_verify_handle;
|
||||
ECC_Start();
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(script_sign, initialize_script_sign)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::vector<uint8_t> key = ConsumeRandomLengthByteVector(fuzzed_data_provider, 128);
|
||||
|
|
|
@ -24,7 +24,7 @@ bool IsValidSubtraction(const CScriptNum& lhs, const CScriptNum& rhs)
|
|||
}
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(scriptnum_ops)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
CScriptNum script_num = ConsumeScriptNum(fuzzed_data_provider);
|
||||
|
|
|
@ -14,7 +14,7 @@
|
|||
int ec_seckey_import_der(const secp256k1_context* ctx, unsigned char* out32, const unsigned char* seckey, size_t seckeylen);
|
||||
int ec_seckey_export_der(const secp256k1_context* ctx, unsigned char* seckey, size_t* seckeylen, const unsigned char* key32, bool compressed);
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(secp256k1_ec_seckey_import_export_der)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
secp256k1_context* secp256k1_context_sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
|
||||
|
|
|
@ -14,7 +14,7 @@
|
|||
bool SigHasLowR(const secp256k1_ecdsa_signature* sig);
|
||||
int ecdsa_signature_parse_der_lax(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char* input, size_t inputlen);
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(secp256k1_ecdsa_signature_parse_der_lax)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
const std::vector<uint8_t> signature_bytes = ConsumeRandomLengthByteVector(fuzzed_data_provider);
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_signature_checker()
|
||||
{
|
||||
static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
|
||||
}
|
||||
|
@ -52,7 +52,7 @@ public:
|
|||
};
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(signature_checker, initialize_signature_checker)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const unsigned int flags = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
|
||||
|
|
|
@ -15,12 +15,12 @@
|
|||
#include <optional>
|
||||
#include <vector>
|
||||
|
||||
void initialize()
|
||||
void initialize_signet()
|
||||
{
|
||||
InitializeFuzzingContext(CBaseChainParams::SIGNET);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(signet, initialize_signet)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
||||
const std::optional<CBlock> block = ConsumeDeserializable<CBlock>(fuzzed_data_provider);
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(span)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
|
||||
|
|
|
@ -6,7 +6,7 @@
|
|||
#include <test/fuzz/fuzz.h>
|
||||
#include <util/spanparsing.h>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(spanparsing)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const size_t query_size = fuzzed_data_provider.ConsumeIntegral<size_t>();
|
||||
|
|
|
@ -33,7 +33,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(string)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::string random_string_1 = fuzzed_data_provider.ConsumeRandomLengthString(32);
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(str_printf)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const std::string format_string = fuzzed_data_provider.ConsumeRandomLengthString(64);
|
||||
|
|
|
@ -22,7 +22,7 @@ std::string GetArgumentName(const std::string& name)
|
|||
}
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(system)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
ArgsManager args_manager{};
|
||||
|
|
|
@ -11,7 +11,7 @@
|
|||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(timedata)
|
||||
{
|
||||
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
||||
const unsigned int max_size = fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(0, 1000);
|
||||
|
|
|
@ -21,12 +21,12 @@
|
|||
|
||||
#include <cassert>
|
||||
|
||||
void initialize()
|
||||
void initialize_transaction()
|
||||
{
|
||||
SelectParams(CBaseChainParams::REGTEST);
|
||||
}
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET_INIT(transaction, initialize_transaction)
|
||||
{
|
||||
CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
|
||||
try {
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
|
||||
#include <cassert>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(tx_in)
|
||||
{
|
||||
CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
|
||||
CTxIn tx_in;
|
||||
|
|
|
@ -10,7 +10,7 @@
|
|||
#include <test/fuzz/fuzz.h>
|
||||
#include <version.h>
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(tx_out)
|
||||
{
|
||||
CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
|
||||
CTxOut tx_out;
|
||||
|
|
|
@ -310,7 +310,7 @@ public:
|
|||
};
|
||||
} // namespace
|
||||
|
||||
void test_one_input(const std::vector<uint8_t>& buffer)
|
||||
FUZZ_TARGET(txrequest)
|
||||
{
|
||||
// Tester object (which encapsulates a TxRequestTracker).
|
||||
Tester tester;
|
||||
|
|
|
@ -83,7 +83,7 @@ def main():
|
|||
sys.exit(1)
|
||||
|
||||
# Build list of tests
|
||||
test_list_all = parse_test_list(makefile=os.path.join(config["environment"]["SRCDIR"], 'src', 'Makefile.test.include'))
|
||||
test_list_all = parse_test_list(fuzz_bin=os.path.join(config["environment"]["BUILDDIR"], 'src', 'test', 'fuzz', 'fuzz'))
|
||||
|
||||
if not test_list_all:
|
||||
logging.error("No fuzz targets found")
|
||||
|
@ -126,9 +126,12 @@ def main():
|
|||
try:
|
||||
help_output = subprocess.run(
|
||||
args=[
|
||||
os.path.join(config["environment"]["BUILDDIR"], 'src', 'test', 'fuzz', test_list_selection[0]),
|
||||
os.path.join(config["environment"]["BUILDDIR"], 'src', 'test', 'fuzz', 'fuzz'),
|
||||
'-help=1',
|
||||
],
|
||||
env={
|
||||
'FUZZ': test_list_selection[0]
|
||||
},
|
||||
timeout=20,
|
||||
check=True,
|
||||
stderr=subprocess.PIPE,
|
||||
|
@ -177,24 +180,30 @@ def generate_corpus_seeds(*, fuzz_pool, build_dir, seed_dir, targets):
|
|||
"""
|
||||
logging.info("Generating corpus seeds to {}".format(seed_dir))
|
||||
|
||||
def job(command):
|
||||
def job(command, t):
|
||||
logging.debug("Running '{}'\n".format(" ".join(command)))
|
||||
logging.debug("Command '{}' output:\n'{}'\n".format(
|
||||
' '.join(command),
|
||||
subprocess.run(command, check=True, stderr=subprocess.PIPE,
|
||||
universal_newlines=True).stderr
|
||||
))
|
||||
subprocess.run(
|
||||
command,
|
||||
env={
|
||||
'FUZZ': t
|
||||
},
|
||||
check=True,
|
||||
stderr=subprocess.PIPE,
|
||||
universal_newlines=True,
|
||||
).stderr))
|
||||
|
||||
futures = []
|
||||
for target in targets:
|
||||
target_seed_dir = os.path.join(seed_dir, target)
|
||||
os.makedirs(target_seed_dir, exist_ok=True)
|
||||
command = [
|
||||
os.path.join(build_dir, "src", "test", "fuzz", target),
|
||||
os.path.join(build_dir, 'src', 'test', 'fuzz', 'fuzz'),
|
||||
"-runs=100000",
|
||||
target_seed_dir,
|
||||
]
|
||||
futures.append(fuzz_pool.submit(job, command))
|
||||
futures.append(fuzz_pool.submit(job, command, target))
|
||||
|
||||
for future in as_completed(futures):
|
||||
future.result()
|
||||
|
@ -205,7 +214,7 @@ def merge_inputs(*, fuzz_pool, corpus, test_list, build_dir, merge_dir):
|
|||
jobs = []
|
||||
for t in test_list:
|
||||
args = [
|
||||
os.path.join(build_dir, 'src', 'test', 'fuzz', t),
|
||||
os.path.join(build_dir, 'src', 'test', 'fuzz', 'fuzz'),
|
||||
'-merge=1',
|
||||
'-use_value_profile=1', # Also done by oss-fuzz https://github.com/google/oss-fuzz/issues/1406#issuecomment-387790487
|
||||
os.path.join(corpus, t),
|
||||
|
@ -216,7 +225,15 @@ def merge_inputs(*, fuzz_pool, corpus, test_list, build_dir, merge_dir):
|
|||
|
||||
def job(t, args):
|
||||
output = 'Run {} with args {}\n'.format(t, " ".join(args))
|
||||
output += subprocess.run(args, check=True, stderr=subprocess.PIPE, universal_newlines=True).stderr
|
||||
output += subprocess.run(
|
||||
args,
|
||||
env={
|
||||
'FUZZ': t
|
||||
},
|
||||
check=True,
|
||||
stderr=subprocess.PIPE,
|
||||
universal_newlines=True,
|
||||
).stderr
|
||||
logging.debug(output)
|
||||
|
||||
jobs.append(fuzz_pool.submit(job, t, args))
|
||||
|
@ -231,7 +248,7 @@ def run_once(*, fuzz_pool, corpus, test_list, build_dir, use_valgrind):
|
|||
corpus_path = os.path.join(corpus, t)
|
||||
os.makedirs(corpus_path, exist_ok=True)
|
||||
args = [
|
||||
os.path.join(build_dir, 'src', 'test', 'fuzz', t),
|
||||
os.path.join(build_dir, 'src', 'test', 'fuzz', 'fuzz'),
|
||||
'-runs=1',
|
||||
corpus_path,
|
||||
]
|
||||
|
@ -240,7 +257,7 @@ def run_once(*, fuzz_pool, corpus, test_list, build_dir, use_valgrind):
|
|||
|
||||
def job(t, args):
|
||||
output = 'Run {} with args {}'.format(t, args)
|
||||
result = subprocess.run(args, stderr=subprocess.PIPE, universal_newlines=True)
|
||||
result = subprocess.run(args, env={'FUZZ': t}, stderr=subprocess.PIPE, universal_newlines=True)
|
||||
output += result.stderr
|
||||
return output, result
|
||||
|
||||
|
@ -260,20 +277,16 @@ def run_once(*, fuzz_pool, corpus, test_list, build_dir, use_valgrind):
|
|||
sys.exit(1)
|
||||
|
||||
|
||||
def parse_test_list(makefile):
|
||||
with open(makefile, encoding='utf-8') as makefile_test:
|
||||
test_list_all = []
|
||||
read_targets = False
|
||||
for line in makefile_test.readlines():
|
||||
line = line.strip().replace('test/fuzz/', '').replace(' \\', '')
|
||||
if read_targets:
|
||||
if not line:
|
||||
break
|
||||
test_list_all.append(line)
|
||||
continue
|
||||
|
||||
if line == 'FUZZ_TARGETS =':
|
||||
read_targets = True
|
||||
def parse_test_list(*, fuzz_bin):
|
||||
test_list_all = subprocess.run(
|
||||
fuzz_bin,
|
||||
env={
|
||||
'PRINT_ALL_FUZZ_TARGETS_AND_ABORT': ''
|
||||
},
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=subprocess.DEVNULL,
|
||||
universal_newlines=True,
|
||||
).stdout.splitlines()
|
||||
return test_list_all
|
||||
|
||||
|
||||
|
|
Loading…
Add table
Reference in a new issue