5 files changed, 45 insertions, 14 deletions
diff --git a/src/test/fuzz/addition_overflow.cpp b/src/test/fuzz/addition_overflow.cpp
index cfad41659e..372c1a370e 100644
--- a/src/test/fuzz/addition_overflow.cpp
+++ b/src/test/fuzz/addition_overflow.cpp
@@ -26,6 +26,12 @@ void TestAdditionOverflow(FuzzedDataProvider& fuzzed_data_provider)
     const T i = fuzzed_data_provider.ConsumeIntegral<T>();
     const T j = fuzzed_data_provider.ConsumeIntegral<T>();
     const bool is_addition_overflow_custom = AdditionOverflow(i, j);
+    const auto maybe_add{CheckedAdd(i, j)};
+    const auto sat_add{SaturatingAdd(i, j)};
+    assert(is_addition_overflow_custom == !maybe_add.has_value());
+    assert(is_addition_overflow_custom == AdditionOverflow(j, i));
+    assert(maybe_add == CheckedAdd(j, i));
+    assert(sat_add == SaturatingAdd(j, i));
 #if defined(HAVE_BUILTIN_ADD_OVERFLOW)
     T result_builtin;
     const bool is_addition_overflow_builtin = __builtin_add_overflow(i, j, &result_builtin);
@@ -33,11 +39,14 @@ void TestAdditionOverflow(FuzzedDataProvider& fuzzed_data_provider)
     if (!is_addition_overflow_custom) {
         assert(i + j == result_builtin);
     }
-#else
-    if (!is_addition_overflow_custom) {
-        (void)(i + j);
-    }
 #endif
+    if (is_addition_overflow_custom) {
+        assert(sat_add == std::numeric_limits<T>::min() || sat_add == std::numeric_limits<T>::max());
+    } else {
+        const auto add{i + j};
+        assert(add == maybe_add.value());
+        assert(add == sat_add);
+    }
 }
 } // namespace
 
diff --git a/src/test/fuzz/addrman.cpp b/src/test/fuzz/addrman.cpp
index 3699abb597..ba917dec2a 100644
--- a/src/test/fuzz/addrman.cpp
+++ b/src/test/fuzz/addrman.cpp
@@ -137,7 +137,7 @@ public:
      * - vvNew entries refer to the same addresses
      * - vvTried entries refer to the same addresses
      */
-    bool operator==(const AddrManDeterministic& other)
+    bool operator==(const AddrManDeterministic& other) const
     {
         LOCK2(m_impl->cs, other.m_impl->cs);
 
diff --git a/src/test/fuzz/script.cpp b/src/test/fuzz/script.cpp
index 14a59912db..fdcd0da37d 100644
--- a/src/test/fuzz/script.cpp
+++ b/src/test/fuzz/script.cpp
@@ -167,12 +167,4 @@ FUZZ_TARGET_INIT(script, initialize_script)
             Assert(dest == GetScriptForDestination(tx_destination_2));
         }
     }
-
-    (void)FormatScript(script);
-    (void)ScriptToAsmStr(script, /*fAttemptSighashDecode=*/fuzzed_data_provider.ConsumeBool());
-
-    UniValue o1(UniValue::VOBJ);
-    ScriptPubKeyToUniv(script, o1, /*include_hex=*/fuzzed_data_provider.ConsumeBool());
-    UniValue o3(UniValue::VOBJ);
-    ScriptToUniv(script, o3);
 }
diff --git a/src/test/fuzz/script_format.cpp b/src/test/fuzz/script_format.cpp
new file mode 100644
index 0000000000..2fa893f812
--- /dev/null
+++ b/src/test/fuzz/script_format.cpp
@@ -0,0 +1,30 @@
+// Copyright (c) 2019-2022 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <chainparams.h>
+#include <core_io.h>
+#include <script/script.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+#include <univalue.h>
+
+void initialize_script_format()
+{
+    SelectParams(CBaseChainParams::REGTEST);
+}
+
+FUZZ_TARGET_INIT(script_format, initialize_script_format)
+{
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    const CScript script{ConsumeScript(fuzzed_data_provider)};
+
+    (void)FormatScript(script);
+    (void)ScriptToAsmStr(script, /*fAttemptSighashDecode=*/fuzzed_data_provider.ConsumeBool());
+
+    UniValue o1(UniValue::VOBJ);
+    ScriptPubKeyToUniv(script, o1, /*include_hex=*/fuzzed_data_provider.ConsumeBool());
+    UniValue o3(UniValue::VOBJ);
+    ScriptToUniv(script, o3);
+}
diff --git a/src/test/fuzz/util.cpp b/src/test/fuzz/util.cpp
index 2514636d6e..f0c1b0d147 100644
--- a/src/test/fuzz/util.cpp
+++ b/src/test/fuzz/util.cpp
@@ -566,7 +566,7 @@ ssize_t FuzzedFileProvider::write(void* cookie, const char* buf, size_t size)
     SetFuzzedErrNo(fuzzed_file->m_fuzzed_data_provider);
     const ssize_t n = fuzzed_file->m_fuzzed_data_provider.ConsumeIntegralInRange<ssize_t>(0, size);
     if (AdditionOverflow(fuzzed_file->m_offset, (int64_t)n)) {
-        return fuzzed_file->m_fuzzed_data_provider.ConsumeBool() ? 0 : -1;
+        return 0;
     }
     fuzzed_file->m_offset += n;
     return n;