1 files changed, 28 insertions, 0 deletions
diff --git a/src/wallet/test/fuzz/scriptpubkeyman.cpp b/src/wallet/test/fuzz/scriptpubkeyman.cpp
index b0c955f482..835470aeae 100644
--- a/src/wallet/test/fuzz/scriptpubkeyman.cpp
+++ b/src/wallet/test/fuzz/scriptpubkeyman.cpp
@@ -49,9 +49,21 @@ void initialize_spkm()
     MOCKED_DESC_CONVERTER.Init();
 }
 
+/**
+ * Key derivation is expensive. Deriving deep derivation paths take a lot of compute and we'd rather spend time
+ * elsewhere in this target, like on actually fuzzing the DescriptorScriptPubKeyMan. So rule out strings which could
+ * correspond to a descriptor containing a too large derivation path.
+ */
+static bool TooDeepDerivPath(std::string_view desc)
+{
+    const FuzzBufferType desc_buf{reinterpret_cast<const unsigned char *>(desc.data()), desc.size()};
+    return HasDeepDerivPath(desc_buf);
+}
+
 static std::optional<std::pair<WalletDescriptor, FlatSigningProvider>> CreateWalletDescriptor(FuzzedDataProvider& fuzzed_data_provider)
 {
     const std::string mocked_descriptor{fuzzed_data_provider.ConsumeRandomLengthString()};
+    if (TooDeepDerivPath(mocked_descriptor)) return {};
     const auto desc_str{MOCKED_DESC_CONVERTER.GetDescriptor(mocked_descriptor)};
     if (!desc_str.has_value()) return std::nullopt;
 
@@ -125,6 +137,15 @@ FUZZ_TARGET(scriptpubkeyman, .init = initialize_spkm)
                                            PKHash{ConsumeUInt160(fuzzed_data_provider)}};
                         std::string str_sig;
                         (void)spk_manager->SignMessage(msg, pk_hash, str_sig);
+                        (void)spk_manager->GetMetadata(dest);
+                    }
+                }
+            },
+            [&] {
+                auto spks{spk_manager->GetScriptPubKeys()};
+                for (const CScript& spk : spks) {
+                    if (fuzzed_data_provider.ConsumeBool()) {
+                        spk_manager->MarkUnusedAddresses(spk);
                     }
                 }
             },
@@ -136,6 +157,10 @@ FUZZ_TARGET(scriptpubkeyman, .init = initialize_spkm)
                 }
                 spk_manager->AddDescriptorKey(key, key.GetPubKey());
                 spk_manager->TopUp();
+                LOCK(spk_manager->cs_desc_man);
+                auto particular_key{spk_manager->GetKey(key.GetPubKey().GetID())};
+                assert(*particular_key == key);
+                assert(spk_manager->HasPrivKey(key.GetPubKey().GetID()));
             },
             [&] {
                 std::string descriptor;
@@ -182,6 +207,9 @@ FUZZ_TARGET(scriptpubkeyman, .init = initialize_spkm)
             }
         );
     }
+
+    (void)spk_manager->GetEndRange();
+    (void)spk_manager->GetKeyPoolSize();
 }
 
 } // namespace