tests: Add fuzzing harness for TorController

3 files changed, 85 insertions, 1 deletions

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index e817bb2ee2..03b9e50f76 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -291,6 +291,7 @@ test_fuzz_fuzz_SOURCES = \
  test/fuzz/strprintf.cpp \
  test/fuzz/system.cpp \
  test/fuzz/timedata.cpp \
+ test/fuzz/torcontrol.cpp \
  test/fuzz/transaction.cpp \
  test/fuzz/tx_in.cpp \
  test/fuzz/tx_out.cpp \
diff --git a/src/test/fuzz/torcontrol.cpp b/src/test/fuzz/torcontrol.cpp
new file mode 100644
index 0000000000..b7a42ea7f4
--- /dev/null
+++ b/src/test/fuzz/torcontrol.cpp
@@ -0,0 +1,79 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+#include <torcontrol.h>
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+class DummyTorControlConnection : public TorControlConnection
+{
+public:
+    DummyTorControlConnection() : TorControlConnection{nullptr}
+    {
+    }
+
+    bool Connect(const std::string&, const ConnectionCB&, const ConnectionCB&)
+    {
+        return true;
+    }
+
+    void Disconnect()
+    {
+    }
+
+    bool Command(const std::string&, const ReplyHandlerCB&)
+    {
+        return true;
+    }
+};
+
+void initialize_torcontrol()
+{
+    static const auto testing_setup = MakeNoLogFileContext<>();
+}
+
+FUZZ_TARGET_INIT(torcontrol, initialize_torcontrol)
+{
+    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
+
+    TorController tor_controller;
+    while (fuzzed_data_provider.ConsumeBool()) {
+        TorControlReply tor_control_reply;
+        CallOneOf(
+            fuzzed_data_provider,
+            [&] {
+                tor_control_reply.code = 250;
+            },
+            [&] {
+                tor_control_reply.code = 510;
+            },
+            [&] {
+                tor_control_reply.code = fuzzed_data_provider.ConsumeIntegral<int>();
+            });
+        tor_control_reply.lines = ConsumeRandomLengthStringVector(fuzzed_data_provider);
+        if (tor_control_reply.lines.empty()) {
+            break;
+        }
+        DummyTorControlConnection dummy_tor_control_connection;
+        CallOneOf(
+            fuzzed_data_provider,
+            [&] {
+                tor_controller.add_onion_cb(dummy_tor_control_connection, tor_control_reply);
+            },
+            [&] {
+                tor_controller.auth_cb(dummy_tor_control_connection, tor_control_reply);
+            },
+            [&] {
+                tor_controller.authchallenge_cb(dummy_tor_control_connection, tor_control_reply);
+            },
+            [&] {
+                tor_controller.protocolinfo_cb(dummy_tor_control_connection, tor_control_reply);
+            });
+    }
+}
diff --git a/src/torcontrol.h b/src/torcontrol.h
index ecf26d89c1..7258f27cb6 100644
--- a/src/torcontrol.h
+++ b/src/torcontrol.h
@@ -113,6 +113,9 @@ class TorController
 {
 public:
     TorController(struct event_base* base, const std::string& tor_control_center, const CService& target);
+    TorController() : conn{nullptr} {
+        // Used for testing only.
+    }
     ~TorController();
 
     /** Get name of file to store private key in */
@@ -127,7 +130,7 @@ private:
     std::string private_key;
     std::string service_id;
     bool reconnect;
-    struct event *reconnect_ev;
+    struct event *reconnect_ev = nullptr;
     float reconnect_timeout;
     CService service;
     const CService m_target;
@@ -136,6 +139,7 @@ private:
     /** ClientNonce for SAFECOOKIE auth */
     std::vector<uint8_t> clientNonce;
 
+public:
     /** Callback for ADD_ONION result */
     void add_onion_cb(TorControlConnection& conn, const TorControlReply& reply);
     /** Callback for AUTHENTICATE result */