mirror of
https://github.com/bitcoin/bitcoin.git
synced 2025-01-16 06:42:37 -03:00
0f55294cc1
fab860aed4fuzz: Stop nodes in process_message* fuzzers (MarcoFalke)6666c828e0fuzz: Give CNode ownership to ConnmanTestMsg in process_message fuzz harness (MarcoFalke) Pull request description: Background is that I saw an integer overflow in net_processing ``` #30629113 REDUCE cov: 25793 ft: 142917 corp: 3421/2417Kb lim: 4096 exec/s: 89 rss: 614Mb L: 1719/4096 MS: 1 EraseBytes- net_processing.cpp:977:25: runtime error: signed integer overflow: 2147483624 + 100 cannot be represented in type 'int' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior net_processing.cpp:977:25 in net_processing.cpp:985:9: runtime error: signed integer overflow: -2147483572 - 100 cannot be represented in type 'int' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior net_processing.cpp:985:9 in ``` Telling from the line numbers, it looks like `nMisbehavior` wrapped around. Fix that by calling `StopNodes` after each exec, which should clear the node state and thus `nMisbehavior`. ACKs for top commit: practicalswift: ACKfab860aed4Tree-SHA512: 891c081d5843565d891aec028b6c27ef3fa39bc40ae78238e81d8f784b4d4b49cb870998574725a5159dd03aeeb2e0b9bc3d3bb51d57d1231ef42e3394b2d639
86 lines
3.1 KiB
C++
86 lines
3.1 KiB
C++
// Copyright (c) 2020 The Bitcoin Core developers
|
|
// Distributed under the MIT software license, see the accompanying
|
|
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
|
|
#include <banman.h>
|
|
#include <chainparams.h>
|
|
#include <consensus/consensus.h>
|
|
#include <net.h>
|
|
#include <net_processing.h>
|
|
#include <protocol.h>
|
|
#include <scheduler.h>
|
|
#include <script/script.h>
|
|
#include <streams.h>
|
|
#include <test/fuzz/FuzzedDataProvider.h>
|
|
#include <test/fuzz/fuzz.h>
|
|
#include <test/util/mining.h>
|
|
#include <test/util/net.h>
|
|
#include <test/util/setup_common.h>
|
|
#include <util/memory.h>
|
|
#include <validationinterface.h>
|
|
#include <version.h>
|
|
|
|
#include <atomic>
|
|
#include <cassert>
|
|
#include <chrono>
|
|
#include <cstdint>
|
|
#include <iosfwd>
|
|
#include <iostream>
|
|
#include <memory>
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
bool ProcessMessage(CNode* pfrom, const std::string& msg_type, CDataStream& vRecv, int64_t nTimeReceived, const CChainParams& chainparams, ChainstateManager& chainman, CTxMemPool& mempool, CConnman* connman, BanMan* banman, const std::atomic<bool>& interruptMsgProc);
|
|
|
|
namespace {
|
|
|
|
#ifdef MESSAGE_TYPE
|
|
#define TO_STRING_(s) #s
|
|
#define TO_STRING(s) TO_STRING_(s)
|
|
const std::string LIMIT_TO_MESSAGE_TYPE{TO_STRING(MESSAGE_TYPE)};
|
|
#else
|
|
const std::string LIMIT_TO_MESSAGE_TYPE;
|
|
#endif
|
|
|
|
const TestingSetup* g_setup;
|
|
} // namespace
|
|
|
|
void initialize()
|
|
{
|
|
static TestingSetup setup{
|
|
CBaseChainParams::REGTEST,
|
|
{
|
|
"-nodebuglogfile",
|
|
},
|
|
};
|
|
g_setup = &setup;
|
|
|
|
for (int i = 0; i < 2 * COINBASE_MATURITY; i++) {
|
|
MineBlock(g_setup->m_node, CScript() << OP_TRUE);
|
|
}
|
|
SyncWithValidationInterfaceQueue();
|
|
}
|
|
|
|
void test_one_input(const std::vector<uint8_t>& buffer)
|
|
{
|
|
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
|
|
ConnmanTestMsg& connman = *(ConnmanTestMsg*)g_setup->m_node.connman.get();
|
|
const std::string random_message_type{fuzzed_data_provider.ConsumeBytesAsString(CMessageHeader::COMMAND_SIZE).c_str()};
|
|
if (!LIMIT_TO_MESSAGE_TYPE.empty() && random_message_type != LIMIT_TO_MESSAGE_TYPE) {
|
|
return;
|
|
}
|
|
CDataStream random_bytes_data_stream{fuzzed_data_provider.ConsumeRemainingBytes<unsigned char>(), SER_NETWORK, PROTOCOL_VERSION};
|
|
CNode& p2p_node = *MakeUnique<CNode>(0, ServiceFlags(NODE_NETWORK | NODE_WITNESS | NODE_BLOOM), 0, INVALID_SOCKET, CAddress{CService{in_addr{0x0100007f}, 7777}, NODE_NETWORK}, 0, 0, CAddress{}, std::string{}, false).release();
|
|
p2p_node.fSuccessfullyConnected = true;
|
|
p2p_node.nVersion = PROTOCOL_VERSION;
|
|
p2p_node.SetSendVersion(PROTOCOL_VERSION);
|
|
connman.AddTestNode(p2p_node);
|
|
g_setup->m_node.peer_logic->InitializeNode(&p2p_node);
|
|
try {
|
|
(void)ProcessMessage(&p2p_node, random_message_type, random_bytes_data_stream, GetTimeMillis(), Params(), *g_setup->m_node.chainman, *g_setup->m_node.mempool, g_setup->m_node.connman.get(), g_setup->m_node.banman.get(), std::atomic<bool>{false});
|
|
} catch (const std::ios_base::failure&) {
|
|
}
|
|
SyncWithValidationInterfaceQueue();
|
|
LOCK2(::cs_main, g_cs_orphans); // See init.cpp for rationale for implicit locking order requirement
|
|
g_setup->m_node.connman->StopNodes();
|
|
}
|