diff options
| author | MarcoFalke <falke.marco@gmail.com> | 2021-08-16 10:47:55 +0200 |
|---|---|---|
| committer | MarcoFalke <falke.marco@gmail.com> | 2021-08-16 10:47:58 +0200 |
| commit | 42b00a37580a11fbb81a3748d9e834ae8913cdba (patch) | |
| tree | be786ccd75b060cf552872b69f25fd0e257227b6 | |
| parent | 3facf0a8ae99a03f5e2fb709b8d86c47328d363c (diff) | |
| parent | fa7718344d2879bb3f3c00a4185c5445390c017d (diff) | |
| download | bitcoin-42b00a37580a11fbb81a3748d9e834ae8913cdba.tar.xz | |
Merge bitcoin/bitcoin#22649: fuzz: Avoid OOM in system fuzz target
fa7718344d2879bb3f3c00a4185c5445390c017d fuzz: Avoid OOM in system fuzz target (MarcoFalke)
Pull request description:
If the inputs size is unlimited, the target may consume unlimited memory, because the argsmanager stores the argument names. Limiting the size should fix this issue.
Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36906
ACKs for top commit:
practicalswift:
cr ACK fa7718344d2879bb3f3c00a4185c5445390c017d
Tree-SHA512: 6edfcf324ee9d94e511038ee01340f02db50bcb233af3f1a1717c3602164c88528d9d987e971ec32f1a4593b868019bea0102c53c9b02bfefec3dfde959483cf
| -rw-r--r-- | src/test/fuzz/fuzz.h | 3 | ||||
| -rw-r--r-- | src/test/fuzz/system.cpp | 3 |
2 files changed, 5 insertions, 1 deletions
diff --git a/src/test/fuzz/fuzz.h b/src/test/fuzz/fuzz.h index 2bad77bdc1..ce8fd660aa 100644 --- a/src/test/fuzz/fuzz.h +++ b/src/test/fuzz/fuzz.h @@ -11,6 +11,9 @@ #include <functional> #include <string_view> +#define LIMITED_WHILE(condition, limit) \ + for (unsigned _count{limit}; (condition) && _count; --_count) + using FuzzBufferType = Span<const uint8_t>; using TypeTestOneInput = std::function<void(FuzzBufferType)>; diff --git a/src/test/fuzz/system.cpp b/src/test/fuzz/system.cpp index b25dcfcd3b..0f53939eac 100644 --- a/src/test/fuzz/system.cpp +++ b/src/test/fuzz/system.cpp @@ -31,7 +31,8 @@ FUZZ_TARGET(system) SetupHelpOptions(args_manager); } - while (fuzzed_data_provider.ConsumeBool()) { + LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 3000) + { CallOneOf( fuzzed_data_provider, [&] { |