1 files changed, 18 insertions, 9 deletions
diff --git a/src/test/fuzz/util/net.cpp b/src/test/fuzz/util/net.cpp
index 99151bb84d..5e7aae670e 100644
--- a/src/test/fuzz/util/net.cpp
+++ b/src/test/fuzz/util/net.cpp
@@ -193,21 +193,20 @@ ssize_t FuzzedSock::Recv(void* buf, size_t len, int flags) const
     bool pad_to_len_bytes{m_fuzzed_data_provider.ConsumeBool()};
     if (m_peek_data.has_value()) {
         // `MSG_PEEK` was used in the preceding `Recv()` call, return `m_peek_data`.
-        random_bytes.assign({m_peek_data.value()});
+        random_bytes = m_peek_data.value();
         if ((flags & MSG_PEEK) == 0) {
             m_peek_data.reset();
         }
         pad_to_len_bytes = false;
     } else if ((flags & MSG_PEEK) != 0) {
         // New call with `MSG_PEEK`.
-        random_bytes = m_fuzzed_data_provider.ConsumeBytes<uint8_t>(1);
+        random_bytes = ConsumeRandomLengthByteVector(m_fuzzed_data_provider, len);
         if (!random_bytes.empty()) {
-            m_peek_data = random_bytes[0];
+            m_peek_data = random_bytes;
             pad_to_len_bytes = false;
         }
     } else {
-        random_bytes = m_fuzzed_data_provider.ConsumeBytes<uint8_t>(
-            m_fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, len));
+        random_bytes = ConsumeRandomLengthByteVector(m_fuzzed_data_provider, len);
     }
     if (random_bytes.empty()) {
         const ssize_t r = m_fuzzed_data_provider.ConsumeBool() ? 0 : -1;
@@ -216,7 +215,11 @@ ssize_t FuzzedSock::Recv(void* buf, size_t len, int flags) const
         }
         return r;
     }
-    std::memcpy(buf, random_bytes.data(), random_bytes.size());
+    // `random_bytes` might exceed the size of `buf` if e.g. Recv is called with
+    // len=N and MSG_PEEK first and afterwards called with len=M (M < N) and
+    // without MSG_PEEK.
+    size_t recv_len{std::min(random_bytes.size(), len)};
+    std::memcpy(buf, random_bytes.data(), recv_len);
     if (pad_to_len_bytes) {
         if (len > random_bytes.size()) {
             std::memset((char*)buf + random_bytes.size(), 0, len - random_bytes.size());
@@ -226,7 +229,7 @@ ssize_t FuzzedSock::Recv(void* buf, size_t len, int flags) const
     if (m_fuzzed_data_provider.ConsumeBool() && std::getenv("FUZZED_SOCKET_FAKE_LATENCY") != nullptr) {
         std::this_thread::sleep_for(std::chrono::milliseconds{2});
     }
-    return random_bytes.size();
+    return recv_len;
 }
 
 int FuzzedSock::Connect(const sockaddr*, socklen_t) const
@@ -380,7 +383,10 @@ bool FuzzedSock::Wait(std::chrono::milliseconds timeout, Event requested, Event*
         return false;
     }
     if (occurred != nullptr) {
-        *occurred = m_fuzzed_data_provider.ConsumeBool() ? requested : 0;
+        // We simulate the requested event as occured when ConsumeBool()
+        // returns false. This avoids simulating endless waiting if the
+        // FuzzedDataProvider runs out of data.
+        *occurred = m_fuzzed_data_provider.ConsumeBool() ? 0 : requested;
     }
     return true;
 }
@@ -389,7 +395,10 @@ bool FuzzedSock::WaitMany(std::chrono::milliseconds timeout, EventsPerSock& even
 {
     for (auto& [sock, events] : events_per_sock) {
         (void)sock;
-        events.occurred = m_fuzzed_data_provider.ConsumeBool() ? events.requested : 0;
+        // We simulate the requested event as occured when ConsumeBool()
+        // returns false. This avoids simulating endless waiting if the
+        // FuzzedDataProvider runs out of data.
+        events.occurred = m_fuzzed_data_provider.ConsumeBool() ? 0 : events.requested;
     }
     return true;
 }