From fa40c0964b751683774b79da4b72d330a9ff87e2 Mon Sep 17 00:00:00 2001 From: MarcoFalke Date: Sun, 4 Jul 2021 14:22:36 +0200 Subject: [PATCH 1/4] fuzz: Move ConsumeTxDestination to cpp file Moving the implementation out of the header will reduce compile time --- src/test/fuzz/util.cpp | 31 +++++++++++++++++++++++++++++++ src/test/fuzz/util.h | 31 +------------------------------ 2 files changed, 32 insertions(+), 30 deletions(-) diff --git a/src/test/fuzz/util.cpp b/src/test/fuzz/util.cpp index bcf0b0ce72..a71b7e32fd 100644 --- a/src/test/fuzz/util.cpp +++ b/src/test/fuzz/util.cpp @@ -304,3 +304,34 @@ uint32_t ConsumeSequence(FuzzedDataProvider& fuzzed_data_provider) noexcept }) : fuzzed_data_provider.ConsumeIntegral(); } + +CTxDestination ConsumeTxDestination(FuzzedDataProvider& fuzzed_data_provider) noexcept +{ + CTxDestination tx_destination; + CallOneOf( + fuzzed_data_provider, + [&] { + tx_destination = CNoDestination{}; + }, + [&] { + tx_destination = PKHash{ConsumeUInt160(fuzzed_data_provider)}; + }, + [&] { + tx_destination = ScriptHash{ConsumeUInt160(fuzzed_data_provider)}; + }, + [&] { + tx_destination = WitnessV0ScriptHash{ConsumeUInt256(fuzzed_data_provider)}; + }, + [&] { + tx_destination = WitnessV0KeyHash{ConsumeUInt160(fuzzed_data_provider)}; + }, + [&] { + WitnessUnknown witness_unknown{}; + witness_unknown.version = fuzzed_data_provider.ConsumeIntegral(); + const std::vector witness_unknown_program_1 = fuzzed_data_provider.ConsumeBytes(40); + witness_unknown.length = witness_unknown_program_1.size(); + std::copy(witness_unknown_program_1.begin(), witness_unknown_program_1.end(), witness_unknown.program); + tx_destination = witness_unknown; + }); + return tx_destination; +} diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h index 023dcdb3e5..60dc9050fe 100644 --- a/src/test/fuzz/util.h +++ b/src/test/fuzz/util.h @@ -178,36 +178,7 @@ template return CTxMemPoolEntry{MakeTransactionRef(tx), fee, time, entry_height, spends_coinbase, sig_op_cost, {}}; } -[[nodiscard]] inline CTxDestination ConsumeTxDestination(FuzzedDataProvider& fuzzed_data_provider) noexcept -{ - CTxDestination tx_destination; - CallOneOf( - fuzzed_data_provider, - [&] { - tx_destination = CNoDestination{}; - }, - [&] { - tx_destination = PKHash{ConsumeUInt160(fuzzed_data_provider)}; - }, - [&] { - tx_destination = ScriptHash{ConsumeUInt160(fuzzed_data_provider)}; - }, - [&] { - tx_destination = WitnessV0ScriptHash{ConsumeUInt256(fuzzed_data_provider)}; - }, - [&] { - tx_destination = WitnessV0KeyHash{ConsumeUInt160(fuzzed_data_provider)}; - }, - [&] { - WitnessUnknown witness_unknown{}; - witness_unknown.version = fuzzed_data_provider.ConsumeIntegral(); - const std::vector witness_unknown_program_1 = fuzzed_data_provider.ConsumeBytes(40); - witness_unknown.length = witness_unknown_program_1.size(); - std::copy(witness_unknown_program_1.begin(), witness_unknown_program_1.end(), witness_unknown.program); - tx_destination = witness_unknown; - }); - return tx_destination; -} +[[nodiscard]] CTxDestination ConsumeTxDestination(FuzzedDataProvider& fuzzed_data_provider) noexcept; template [[nodiscard]] bool MultiplicationOverflow(const T i, const T j) noexcept From fab99865c0e62468a1b55d7e467398cc2343121b Mon Sep 17 00:00:00 2001 From: MarcoFalke Date: Sun, 4 Jul 2021 16:38:51 +0200 Subject: [PATCH 2/4] fuzz: Improve ConsumeTxDestination * Assert when a type is missing * Add missing WitnessV1Taproot * Limit WitnessUnknown to version [2, 16], to avoid abiguity * Limit WitnessUnknown to size [2, 40], to avoid invalid sizes --- src/test/fuzz/util.cpp | 16 ++++++++++++---- src/test/fuzz/util.h | 3 ++- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/src/test/fuzz/util.cpp b/src/test/fuzz/util.cpp index a71b7e32fd..ece3214ed5 100644 --- a/src/test/fuzz/util.cpp +++ b/src/test/fuzz/util.cpp @@ -2,6 +2,7 @@ // Distributed under the MIT software license, see the accompanying // file COPYING or http://www.opensource.org/licenses/mit-license.php. +#include #include #include #include @@ -308,7 +309,7 @@ uint32_t ConsumeSequence(FuzzedDataProvider& fuzzed_data_provider) noexcept CTxDestination ConsumeTxDestination(FuzzedDataProvider& fuzzed_data_provider) noexcept { CTxDestination tx_destination; - CallOneOf( + const size_t call_size{CallOneOf( fuzzed_data_provider, [&] { tx_destination = CNoDestination{}; @@ -325,13 +326,20 @@ CTxDestination ConsumeTxDestination(FuzzedDataProvider& fuzzed_data_provider) no [&] { tx_destination = WitnessV0KeyHash{ConsumeUInt160(fuzzed_data_provider)}; }, + [&] { + tx_destination = WitnessV1Taproot{XOnlyPubKey{ConsumeUInt256(fuzzed_data_provider)}}; + }, [&] { WitnessUnknown witness_unknown{}; - witness_unknown.version = fuzzed_data_provider.ConsumeIntegral(); - const std::vector witness_unknown_program_1 = fuzzed_data_provider.ConsumeBytes(40); + witness_unknown.version = fuzzed_data_provider.ConsumeIntegralInRange(2, 16); + std::vector witness_unknown_program_1{fuzzed_data_provider.ConsumeBytes(40)}; + if (witness_unknown_program_1.size() < 2) { + witness_unknown_program_1 = {0, 0}; + } witness_unknown.length = witness_unknown_program_1.size(); std::copy(witness_unknown_program_1.begin(), witness_unknown_program_1.end(), witness_unknown.program); tx_destination = witness_unknown; - }); + })}; + Assert(call_size == std::variant_size_v); return tx_destination; } diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h index 60dc9050fe..9f09395a9a 100644 --- a/src/test/fuzz/util.h +++ b/src/test/fuzz/util.h @@ -37,7 +37,7 @@ #include template -void CallOneOf(FuzzedDataProvider& fuzzed_data_provider, Callables... callables) +size_t CallOneOf(FuzzedDataProvider& fuzzed_data_provider, Callables... callables) { constexpr size_t call_size{sizeof...(callables)}; static_assert(call_size >= 1); @@ -45,6 +45,7 @@ void CallOneOf(FuzzedDataProvider& fuzzed_data_provider, Callables... callables) size_t i{0}; ((i++ == call_index ? callables() : void()), ...); + return call_size; } template From fa42800a51919bb50a1000ac4f58847e6a7092a3 Mon Sep 17 00:00:00 2001 From: MarcoFalke Date: Sun, 4 Jul 2021 21:18:59 +0200 Subject: [PATCH 3/4] fuzz: Simplify CTxDestination fuzzing in the script target The WitnessUnknown operators == and < are already called indirectly by the corresponding CTxDestination operators. --- src/test/fuzz/script.cpp | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-) diff --git a/src/test/fuzz/script.cpp b/src/test/fuzz/script.cpp index b87bcf2ef5..1d5f37d109 100644 --- a/src/test/fuzz/script.cpp +++ b/src/test/fuzz/script.cpp @@ -184,25 +184,12 @@ FUZZ_TARGET_INIT(script, initialize_script) } { - WitnessUnknown witness_unknown_1{}; - witness_unknown_1.version = fuzzed_data_provider.ConsumeIntegral(); - const std::vector witness_unknown_program_1 = fuzzed_data_provider.ConsumeBytes(40); - witness_unknown_1.length = witness_unknown_program_1.size(); - std::copy(witness_unknown_program_1.begin(), witness_unknown_program_1.end(), witness_unknown_1.program); - - WitnessUnknown witness_unknown_2{}; - witness_unknown_2.version = fuzzed_data_provider.ConsumeIntegral(); - const std::vector witness_unknown_program_2 = fuzzed_data_provider.ConsumeBytes(40); - witness_unknown_2.length = witness_unknown_program_2.size(); - std::copy(witness_unknown_program_2.begin(), witness_unknown_program_2.end(), witness_unknown_2.program); - - (void)(witness_unknown_1 == witness_unknown_2); - (void)(witness_unknown_1 < witness_unknown_2); - } - - { - const CTxDestination tx_destination_1 = ConsumeTxDestination(fuzzed_data_provider); + const CTxDestination tx_destination_1{ + fuzzed_data_provider.ConsumeBool() ? + DecodeDestination(fuzzed_data_provider.ConsumeRandomLengthString()) : + ConsumeTxDestination(fuzzed_data_provider)}; const CTxDestination tx_destination_2 = ConsumeTxDestination(fuzzed_data_provider); + (void)(tx_destination_1 == tx_destination_2); (void)(tx_destination_1 < tx_destination_2); } From fabf17056c1046c6ac7fa5d140125050b7a2b0e0 Mon Sep 17 00:00:00 2001 From: MarcoFalke Date: Sun, 4 Jul 2021 21:24:27 +0200 Subject: [PATCH 4/4] fuzz: Move CTxDestination fuzzing to script fuzz target No need to split it over several targets --- src/test/fuzz/integer.cpp | 16 ---------------- src/test/fuzz/key_io.cpp | 11 ----------- src/test/fuzz/script.cpp | 19 +++++++++++++++++-- 3 files changed, 17 insertions(+), 29 deletions(-) diff --git a/src/test/fuzz/integer.cpp b/src/test/fuzz/integer.cpp index e9fa343896..e28e2feb0a 100644 --- a/src/test/fuzz/integer.cpp +++ b/src/test/fuzz/integer.cpp @@ -16,8 +16,6 @@ #include #include #include -#include -#include