diff options
author | MarcoFalke <falke.marco@gmail.com> | 2020-03-29 10:30:57 -0400 |
---|---|---|
committer | MarcoFalke <falke.marco@gmail.com> | 2020-03-29 10:32:05 -0400 |
commit | 5f9cd62f33fb4d440173b9c376cadf4887e81e9d (patch) | |
tree | 3cd494ae1863b9219ee6e6c3d75a12ed06b9902b /src/test/fuzz | |
parent | 6cfb3dbbdbf575b4f3ab1fced3410d67c00d01de (diff) | |
parent | 11a520f6793e21e0a8a9301f5ec4c28a48131b85 (diff) | |
download | bitcoin-5f9cd62f33fb4d440173b9c376cadf4887e81e9d.tar.xz |
Merge #18455: tests: Add fuzzing harness for functions/classes in flatfile.h, merkleblock.h, random.h, serialize.h and span.h
11a520f6793e21e0a8a9301f5ec4c28a48131b85 tests: Add fuzzing harness for functions/classes in random.h (practicalswift)
64d277bbbcbd464b2a795bae011ee808298a42ca tests: Add fuzzing harness for LimitedString (serialize.h) (practicalswift)
f205cf7fef5618aaa96f016fda168eedfd9da437 tests: Add fuzzing harness for functions/classes in span.h (practicalswift)
9718f38f54357f15b8a27e060aed56f91015112d tests: Add fuzzing harness for functions/classes in merkleblock.h (practicalswift)
a16ea051f915eb4c975fe06f89470aa99d99d7e4 tests: Add fuzzing harness for functions/classes in flatfile.h (practicalswift)
Pull request description:
* Add fuzzing harness for functions/classes in `flatfile.h`
* Add fuzzing harness for functions/classes in `merkleblock.h`
* Add fuzzing harness for functions/classes in `span.h`
* Add fuzzing harness for `LimitedString` (`serialize.h`)
* Add fuzzing harness for functions/classes in `random.h`
Top commit has no ACKs.
Tree-SHA512: 6f7e0f946f1062d51216990cde9672b4e896335152548ace3d8711e4969c3e3c8566d01d915b72adcda5c1caa9c2e34da6b7473b55a229f5b77239d3b0ba4b67
Diffstat (limited to 'src/test/fuzz')
-rw-r--r-- | src/test/fuzz/flatfile.cpp | 30 | ||||
-rw-r--r-- | src/test/fuzz/merkleblock.cpp | 27 | ||||
-rw-r--r-- | src/test/fuzz/random.cpp | 31 | ||||
-rw-r--r-- | src/test/fuzz/span.cpp | 39 | ||||
-rw-r--r-- | src/test/fuzz/string.cpp | 29 | ||||
-rw-r--r-- | src/test/fuzz/util.h | 19 |
6 files changed, 171 insertions, 4 deletions
diff --git a/src/test/fuzz/flatfile.cpp b/src/test/fuzz/flatfile.cpp new file mode 100644 index 0000000000..a55de77df7 --- /dev/null +++ b/src/test/fuzz/flatfile.cpp @@ -0,0 +1,30 @@ +// Copyright (c) 2020 The Bitcoin Core developers +// Distributed under the MIT software license, see the accompanying +// file COPYING or http://www.opensource.org/licenses/mit-license.php. + +#include <flatfile.h> +#include <optional.h> +#include <test/fuzz/FuzzedDataProvider.h> +#include <test/fuzz/fuzz.h> +#include <test/fuzz/util.h> + +#include <cassert> +#include <cstdint> +#include <string> +#include <vector> + +void test_one_input(const std::vector<uint8_t>& buffer) +{ + FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); + Optional<FlatFilePos> flat_file_pos = ConsumeDeserializable<FlatFilePos>(fuzzed_data_provider); + if (!flat_file_pos) { + return; + } + Optional<FlatFilePos> another_flat_file_pos = ConsumeDeserializable<FlatFilePos>(fuzzed_data_provider); + if (another_flat_file_pos) { + assert((*flat_file_pos == *another_flat_file_pos) != (*flat_file_pos != *another_flat_file_pos)); + } + (void)flat_file_pos->ToString(); + flat_file_pos->SetNull(); + assert(flat_file_pos->IsNull()); +} diff --git a/src/test/fuzz/merkleblock.cpp b/src/test/fuzz/merkleblock.cpp new file mode 100644 index 0000000000..eb8fa1d421 --- /dev/null +++ b/src/test/fuzz/merkleblock.cpp @@ -0,0 +1,27 @@ +// Copyright (c) 2020 The Bitcoin Core developers +// Distributed under the MIT software license, see the accompanying +// file COPYING or http://www.opensource.org/licenses/mit-license.php. + +#include <merkleblock.h> +#include <optional.h> +#include <test/fuzz/FuzzedDataProvider.h> +#include <test/fuzz/fuzz.h> +#include <test/fuzz/util.h> +#include <uint256.h> + +#include <cstdint> +#include <string> +#include <vector> + +void test_one_input(const std::vector<uint8_t>& buffer) +{ + FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); + Optional<CPartialMerkleTree> partial_merkle_tree = ConsumeDeserializable<CPartialMerkleTree>(fuzzed_data_provider); + if (!partial_merkle_tree) { + return; + } + (void)partial_merkle_tree->GetNumTransactions(); + std::vector<uint256> matches; + std::vector<unsigned int> indices; + (void)partial_merkle_tree->ExtractMatches(matches, indices); +} diff --git a/src/test/fuzz/random.cpp b/src/test/fuzz/random.cpp new file mode 100644 index 0000000000..7df6594ad6 --- /dev/null +++ b/src/test/fuzz/random.cpp @@ -0,0 +1,31 @@ +// Copyright (c) 2020 The Bitcoin Core developers +// Distributed under the MIT software license, see the accompanying +// file COPYING or http://www.opensource.org/licenses/mit-license.php. + +#include <random.h> +#include <test/fuzz/FuzzedDataProvider.h> +#include <test/fuzz/fuzz.h> +#include <test/fuzz/util.h> + +#include <algorithm> +#include <cstdint> +#include <string> +#include <vector> + +void test_one_input(const std::vector<uint8_t>& buffer) +{ + FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); + FastRandomContext fast_random_context{ConsumeUInt256(fuzzed_data_provider)}; + (void)fast_random_context.rand64(); + (void)fast_random_context.randbits(fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 64)); + (void)fast_random_context.randrange(fuzzed_data_provider.ConsumeIntegralInRange<uint64_t>(FastRandomContext::min() + 1, FastRandomContext::max())); + (void)fast_random_context.randbytes(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 1024)); + (void)fast_random_context.rand32(); + (void)fast_random_context.rand256(); + (void)fast_random_context.randbool(); + (void)fast_random_context(); + + std::vector<int64_t> integrals = ConsumeRandomLengthIntegralVector<int64_t>(fuzzed_data_provider); + Shuffle(integrals.begin(), integrals.end(), fast_random_context); + std::shuffle(integrals.begin(), integrals.end(), fast_random_context); +} diff --git a/src/test/fuzz/span.cpp b/src/test/fuzz/span.cpp new file mode 100644 index 0000000000..4aea530ef2 --- /dev/null +++ b/src/test/fuzz/span.cpp @@ -0,0 +1,39 @@ +// Copyright (c) 2020 The Bitcoin Core developers +// Distributed under the MIT software license, see the accompanying +// file COPYING or http://www.opensource.org/licenses/mit-license.php. + +#include <span.h> +#include <test/fuzz/FuzzedDataProvider.h> +#include <test/fuzz/fuzz.h> +#include <test/fuzz/util.h> + +#include <cassert> +#include <cstddef> +#include <cstdint> +#include <string> +#include <vector> + +void test_one_input(const std::vector<uint8_t>& buffer) +{ + FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); + + std::string str = fuzzed_data_provider.ConsumeBytesAsString(32); + const Span<const char> span = MakeSpan(str); + (void)span.data(); + (void)span.begin(); + (void)span.end(); + if (span.size() > 0) { + const std::ptrdiff_t idx = fuzzed_data_provider.ConsumeIntegralInRange<std::ptrdiff_t>(0U, span.size() - 1U); + (void)span.first(idx); + (void)span.last(idx); + (void)span.subspan(idx); + (void)span.subspan(idx, span.size() - idx); + (void)span[idx]; + } + + std::string another_str = fuzzed_data_provider.ConsumeBytesAsString(32); + const Span<const char> another_span = MakeSpan(another_str); + assert((span <= another_span) != (span > another_span)); + assert((span == another_span) != (span != another_span)); + assert((span >= another_span) != (span < another_span)); +} diff --git a/src/test/fuzz/string.cpp b/src/test/fuzz/string.cpp index bb583885ba..3de0cf8db7 100644 --- a/src/test/fuzz/string.cpp +++ b/src/test/fuzz/string.cpp @@ -12,6 +12,8 @@ #include <rpc/server.h> #include <rpc/util.h> #include <script/descriptor.h> +#include <serialize.h> +#include <streams.h> #include <test/fuzz/FuzzedDataProvider.h> #include <test/fuzz/fuzz.h> #include <test/fuzz/util.h> @@ -24,6 +26,7 @@ #include <util/system.h> #include <util/translation.h> #include <util/url.h> +#include <version.h> #include <cstdint> #include <string> @@ -86,4 +89,30 @@ void test_one_input(const std::vector<uint8_t>& buffer) (void)urlDecode(random_string_1); (void)ValidAsCString(random_string_1); (void)_(random_string_1.c_str()); + + { + CDataStream data_stream{SER_NETWORK, INIT_PROTO_VERSION}; + std::string s; + LimitedString<10> limited_string = LIMITED_STRING(s, 10); + data_stream << random_string_1; + try { + data_stream >> limited_string; + assert(data_stream.empty()); + assert(s.size() <= random_string_1.size()); + assert(s.size() <= 10); + if (!random_string_1.empty()) { + assert(!s.empty()); + } + } catch (const std::ios_base::failure&) { + } + } + { + CDataStream data_stream{SER_NETWORK, INIT_PROTO_VERSION}; + const LimitedString<10> limited_string = LIMITED_STRING(random_string_1, 10); + data_stream << limited_string; + std::string deserialized_string; + data_stream >> deserialized_string; + assert(data_stream.empty()); + assert(deserialized_string == random_string_1); + } } diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h index 10be2ebaf7..7004aff420 100644 --- a/src/test/fuzz/util.h +++ b/src/test/fuzz/util.h @@ -20,13 +20,13 @@ #include <string> #include <vector> -NODISCARD inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, size_t max_length = 4096) noexcept +NODISCARD inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept { const std::string s = fuzzed_data_provider.ConsumeRandomLengthString(max_length); return {s.begin(), s.end()}; } -NODISCARD inline std::vector<std::string> ConsumeRandomLengthStringVector(FuzzedDataProvider& fuzzed_data_provider, size_t max_vector_size = 16, size_t max_string_length = 16) noexcept +NODISCARD inline std::vector<std::string> ConsumeRandomLengthStringVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_vector_size = 16, const size_t max_string_length = 16) noexcept { const size_t n_elements = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_vector_size); std::vector<std::string> r; @@ -37,7 +37,18 @@ NODISCARD inline std::vector<std::string> ConsumeRandomLengthStringVector(Fuzzed } template <typename T> -NODISCARD inline Optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, size_t max_length = 4096) noexcept +NODISCARD inline std::vector<T> ConsumeRandomLengthIntegralVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_vector_size = 16) noexcept +{ + const size_t n_elements = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_vector_size); + std::vector<T> r; + for (size_t i = 0; i < n_elements; ++i) { + r.push_back(fuzzed_data_provider.ConsumeIntegral<T>()); + } + return r; +} + +template <typename T> +NODISCARD inline Optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept { const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length); CDataStream ds{buffer, SER_NETWORK, INIT_PROTO_VERSION}; @@ -81,7 +92,7 @@ NODISCARD inline uint256 ConsumeUInt256(FuzzedDataProvider& fuzzed_data_provider } template <typename T> -bool MultiplicationOverflow(T i, T j) +NODISCARD bool MultiplicationOverflow(const T i, const T j) noexcept { static_assert(std::is_integral<T>::value, "Integral required."); if (std::numeric_limits<T>::is_signed) { |