mirror of
https://github.com/bitcoin/bitcoin.git
synced 2025-04-29 06:49:38 -04:00
7bc7af9951
https://github.com/bitcoin/bitcoin/pull/30746#discussion_r1817851827 introduced an unsequenced operations with side-effects - which is undefined behavior, i.e. the right hand side can be evaluated before the left hand side, which happens to mutate it.
Tried:
```
clang++ --analyze -std=c++20 -I./src -I./src/test -I./src/test/fuzz src/test/fuzz/base_encode_decode.cpp src/psbt.cpp
```
but it didn't warn about UB.
Grepped for similar ones, but could find any other one in the codebase:
> grep -rnE --include='*.cpp' --include='*.h' '\b(\w+)\(([^)]*\b(\w+)\b[^)]*)\)\s*==\s*\3\.' .
```
./src/test/arith_uint256_tests.cpp:373: BOOST_CHECK(R1L.GetHex() == R1L.ToString());
./src/test/arith_uint256_tests.cpp:374: BOOST_CHECK(R2L.GetHex() == R2L.ToString());
./src/test/arith_uint256_tests.cpp:375: BOOST_CHECK(OneL.GetHex() == OneL.ToString());
./src/test/arith_uint256_tests.cpp:376: BOOST_CHECK(MaxL.GetHex() == MaxL.ToString());
./src/test/fuzz/cluster_linearize.cpp:565: assert(depgraph.FeeRate(best_anc.transactions) == best_anc.feerate);
./src/test/fuzz/cluster_linearize.cpp:646: assert(depgraph.FeeRate(found.transactions) == found.feerate);
./src/test/fuzz/cluster_linearize.cpp:765: assert(depgraph.FeeRate(chunk_info.transactions) == chunk_info.feerate);
./src/test/fuzz/base_encode_decode.cpp:95: assert(DecodeBase64PSBT(psbt, random_string, error) == error.empty());
./src/test/fuzz/key.cpp:102: assert(pubkey.data() == pubkey.begin());
./src/test/skiplist_tests.cpp:42: BOOST_CHECK(vIndex[from].GetAncestor(0) == vIndex.data());
./src/script/signingprovider.cpp:535: ComputeTapbranchHash(node.sub[1]->hash, node.sub[1]->hash) == node.hash) {
./src/pubkey.h:78: return vch.size() > 0 && GetLen(vch[0]) == vch.size();
./src/cluster_linearize.h:881: Assume(elem.inc.feerate.IsEmpty() == elem.pot_feerate.IsEmpty());
```
Hodlinator deduced the UB on Windows in https://github.com/bitcoin/bitcoin/issues/32135#issuecomment-2751723855
Github-Pull: #32141
Rebased-From: b1de59e896
Co-authored-by: Hodlinator <172445034+hodlinator@users.noreply.github.com>
97 lines
3.5 KiB
C++
97 lines
3.5 KiB
C++
// Copyright (c) 2019-2022 The Bitcoin Core developers
|
|
// Distributed under the MIT software license, see the accompanying
|
|
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
|
|
#include <test/fuzz/fuzz.h>
|
|
|
|
#include <base58.h>
|
|
#include <psbt.h>
|
|
#include <span.h>
|
|
#include <test/fuzz/FuzzedDataProvider.h>
|
|
#include <util/strencodings.h>
|
|
#include <util/string.h>
|
|
|
|
#include <cassert>
|
|
#include <string>
|
|
#include <vector>
|
|
#include <ranges>
|
|
|
|
using util::TrimStringView;
|
|
|
|
FUZZ_TARGET(base58_encode_decode)
|
|
{
|
|
FuzzedDataProvider provider{buffer.data(), buffer.size()};
|
|
const auto random_string{provider.ConsumeRandomLengthString(100)};
|
|
|
|
const auto encoded{EncodeBase58(MakeUCharSpan(random_string))};
|
|
const auto decode_input{provider.ConsumeBool() ? random_string : encoded};
|
|
const int max_ret_len{provider.ConsumeIntegralInRange<int>(-1, decode_input.size() + 1)};
|
|
if (std::vector<unsigned char> decoded; DecodeBase58(decode_input, decoded, max_ret_len)) {
|
|
const auto encoded_string{EncodeBase58(decoded)};
|
|
assert(encoded_string == TrimStringView(decode_input));
|
|
if (decoded.size() > 0) {
|
|
assert(max_ret_len > 0);
|
|
assert(decoded.size() <= static_cast<size_t>(max_ret_len));
|
|
assert(!DecodeBase58(encoded_string, decoded, provider.ConsumeIntegralInRange<int>(0, decoded.size() - 1)));
|
|
}
|
|
}
|
|
}
|
|
|
|
FUZZ_TARGET(base58check_encode_decode)
|
|
{
|
|
FuzzedDataProvider provider{buffer.data(), buffer.size()};
|
|
const auto random_string{provider.ConsumeRandomLengthString(100)};
|
|
|
|
const auto encoded{EncodeBase58Check(MakeUCharSpan(random_string))};
|
|
const auto decode_input{provider.ConsumeBool() ? random_string : encoded};
|
|
const int max_ret_len{provider.ConsumeIntegralInRange<int>(-1, decode_input.size() + 1)};
|
|
if (std::vector<unsigned char> decoded; DecodeBase58Check(decode_input, decoded, max_ret_len)) {
|
|
const auto encoded_string{EncodeBase58Check(decoded)};
|
|
assert(encoded_string == TrimStringView(decode_input));
|
|
if (decoded.size() > 0) {
|
|
assert(max_ret_len > 0);
|
|
assert(decoded.size() <= static_cast<size_t>(max_ret_len));
|
|
assert(!DecodeBase58Check(encoded_string, decoded, provider.ConsumeIntegralInRange<int>(0, decoded.size() - 1)));
|
|
}
|
|
}
|
|
}
|
|
|
|
FUZZ_TARGET(base32_encode_decode)
|
|
{
|
|
const std::string random_string{buffer.begin(), buffer.end()};
|
|
|
|
// Decode/Encode roundtrip
|
|
if (auto result{DecodeBase32(random_string)}) {
|
|
const auto encoded_string{EncodeBase32(*result)};
|
|
assert(encoded_string == ToLower(TrimStringView(random_string)));
|
|
}
|
|
// Encode/Decode roundtrip
|
|
const auto encoded{EncodeBase32(buffer)};
|
|
const auto decoded{DecodeBase32(encoded)};
|
|
assert(decoded && std::ranges::equal(*decoded, buffer));
|
|
}
|
|
|
|
FUZZ_TARGET(base64_encode_decode)
|
|
{
|
|
const std::string random_string{buffer.begin(), buffer.end()};
|
|
|
|
// Decode/Encode roundtrip
|
|
if (auto result{DecodeBase64(random_string)}) {
|
|
const auto encoded_string{EncodeBase64(*result)};
|
|
assert(encoded_string == TrimStringView(random_string));
|
|
}
|
|
// Encode/Decode roundtrip
|
|
const auto encoded{EncodeBase64(buffer)};
|
|
const auto decoded{DecodeBase64(encoded)};
|
|
assert(decoded && std::ranges::equal(*decoded, buffer));
|
|
}
|
|
|
|
FUZZ_TARGET(psbt_base64_decode)
|
|
{
|
|
const std::string random_string{buffer.begin(), buffer.end()};
|
|
|
|
PartiallySignedTransaction psbt;
|
|
std::string error;
|
|
const bool ok{DecodeBase64PSBT(psbt, random_string, error)};
|
|
assert(ok == error.empty());
|
|
}
|