fuzz: Increase branch coverage of the float fuzz target

1 files changed, 28 insertions, 1 deletions

diff --git a/src/test/fuzz/float.cpp b/src/test/fuzz/float.cpp
index adef66a3ee..2f77c8949e 100644
--- a/src/test/fuzz/float.cpp
+++ b/src/test/fuzz/float.cpp
@@ -5,6 +5,7 @@
 #include <memusage.h>
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
 #include <util/serfloat.h>
 #include <version.h>
 
@@ -17,7 +18,33 @@ FUZZ_TARGET(float)
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
 
     {
-        const double d = fuzzed_data_provider.ConsumeFloatingPoint<double>();
+        const double d{[&] {
+            double tmp;
+            CallOneOf(
+                fuzzed_data_provider,
+                // an actual number
+                [&] { tmp = fuzzed_data_provider.ConsumeFloatingPoint<double>(); },
+                // special numbers and NANs
+                [&] { tmp = fuzzed_data_provider.PickValueInArray({
+                          std::numeric_limits<double>::infinity(),
+                          -std::numeric_limits<double>::infinity(),
+                          std::numeric_limits<double>::min(),
+                          -std::numeric_limits<double>::min(),
+                          std::numeric_limits<double>::max(),
+                          -std::numeric_limits<double>::max(),
+                          std::numeric_limits<double>::lowest(),
+                          -std::numeric_limits<double>::lowest(),
+                          std::numeric_limits<double>::quiet_NaN(),
+                          -std::numeric_limits<double>::quiet_NaN(),
+                          std::numeric_limits<double>::signaling_NaN(),
+                          -std::numeric_limits<double>::signaling_NaN(),
+                          std::numeric_limits<double>::denorm_min(),
+                          -std::numeric_limits<double>::denorm_min(),
+                      }); },
+                // Anything from raw memory (also checks that DecodeDouble doesn't crash on any input)
+                [&] { tmp = DecodeDouble(fuzzed_data_provider.ConsumeIntegral<uint64_t>()); });
+            return tmp;
+        }()};
         (void)memusage::DynamicUsage(d);
 
         uint64_t encoded = EncodeDouble(d);