1 files changed, 62 insertions, 11 deletions

diff --git a/src/test/test_bitcoin_fuzzy.cpp b/src/test/test_bitcoin_fuzzy.cpp
index 50e4076d07..6694c5caa8 100644
--- a/src/test/test_bitcoin_fuzzy.cpp
+++ b/src/test/test_bitcoin_fuzzy.cpp
@@ -19,6 +19,7 @@
 #include "undo.h"
 #include "version.h"
 #include "pubkey.h"
+#include "blockencodings.h"
 
 #include <stdint.h>
 #include <unistd.h>
@@ -45,11 +46,13 @@ enum TEST_ID {
     CBLOOMFILTER_DESERIALIZE,
     CDISKBLOCKINDEX_DESERIALIZE,
     CTXOUTCOMPRESSOR_DESERIALIZE,
+    BLOCKTRANSACTIONS_DESERIALIZE,
+    BLOCKTRANSACTIONSREQUEST_DESERIALIZE,
     TEST_ID_END
 };
 
-bool read_stdin(std::vector<char> &data) {
-    char buffer[1024];
+bool read_stdin(std::vector<uint8_t> &data) {
+    uint8_t buffer[1024];
     ssize_t length=0;
     while((length = read(STDIN_FILENO, buffer, 1024)) > 0) {
         data.insert(data.end(), buffer, buffer+length);
@@ -59,11 +62,7 @@ bool read_stdin(std::vector<char> &data) {
     return length==0;
 }
 
-int do_fuzz()
-{
-    std::vector<char> buffer;
-    if (!read_stdin(buffer)) return 0;
-
+int test_one_input(std::vector<uint8_t> buffer) {
     if (buffer.size() < sizeof(uint32_t)) return 0;
 
     uint32_t test_id = 0xffffffff;
@@ -249,15 +248,58 @@ int do_fuzz()
 
             break;
         }
+        case BLOCKTRANSACTIONS_DESERIALIZE:
+        {
+            try
+            {
+                BlockTransactions bt;
+                ds >> bt;
+            } catch (const std::ios_base::failure& e) {return 0;}
+
+            break;
+        }
+        case BLOCKTRANSACTIONSREQUEST_DESERIALIZE:
+        {
+            try
+            {
+                BlockTransactionsRequest btr;
+                ds >> btr;
+            } catch (const std::ios_base::failure& e) {return 0;}
+
+            break;
+        }
         default:
             return 0;
     }
     return 0;
 }
 
+static std::unique_ptr<ECCVerifyHandle> globalVerifyHandle;
+void initialize() {
+    globalVerifyHandle = std::unique_ptr<ECCVerifyHandle>(new ECCVerifyHandle());
+}
+
+// This function is used by libFuzzer
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    test_one_input(std::vector<uint8_t>(data, data + size));
+    return 0;
+}
+
+// This function is used by libFuzzer
+extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
+    initialize();
+    return 0;
+}
+
+// Disabled under WIN32 due to clash with Cygwin's WinMain.
+#ifndef WIN32
+// Declare main(...) "weak" to allow for libFuzzer linking. libFuzzer provides
+// the main(...) function.
+__attribute__((weak))
+#endif
 int main(int argc, char **argv)
 {
-    ECCVerifyHandle globalVerifyHandle;
+    initialize();
 #ifdef __AFL_INIT
     // Enable AFL deferred forkserver mode. Requires compilation using
     // afl-clang-fast++. See fuzzing.md for details.
@@ -267,11 +309,20 @@ int main(int argc, char **argv)
 #ifdef __AFL_LOOP
     // Enable AFL persistent mode. Requires compilation using afl-clang-fast++.
     // See fuzzing.md for details.
+    int ret = 0;
     while (__AFL_LOOP(1000)) {
-        do_fuzz();
+        std::vector<uint8_t> buffer;
+        if (!read_stdin(buffer)) {
+            continue;
+        }
+        ret = test_one_input(buffer);
     }
-    return 0;
+    return ret;
 #else
-    return do_fuzz();
+    std::vector<uint8_t> buffer;
+    if (!read_stdin(buffer)) {
+        return 0;
+    }
+    return test_one_input(buffer);
 #endif
 }