aboutsummaryrefslogtreecommitdiff
path: root/src/test/fuzz
AgeCommit message (Collapse)Author
2020-03-15tests: Add fuzzing harness for count_seconds(...)practicalswift
2020-03-12refactor: Remove mempool global from netMarcoFalke
This refactor does two things: * Pass mempool in to PeerLogicValidation * Pass m_mempool around where needed
2020-03-11fuzz: Add missing ECC_Start to key_io testMarcoFalke
2020-03-11Merge #18314: tests: Add deserialization fuzzing of SnapshotMetadata ↵MarcoFalke
(utxo_snapshot). Increase fuzzing coverage. 08eab0f599a7be7b9b0256bfe9e3a793fe7450db tests: Add fuzzing of CSubNet, CNetAddr and CService related functions (practicalswift) 7a861a62c164ab9b07d6fca09b6a8176e688f1f6 tests: Fuzz HasAllDesirableServiceFlags(...) and MayHaveUsefulAddressDB(...) (practicalswift) 47a263108b05c7039baba5618656898312a7a5ef tests: Fuzz DecodeBase64PSBT(...) (practicalswift) d3d4892ef45d09edbbe4672b112100743970b2a5 tests: Simplify code by removing unwarranted use of unique_ptr:s (practicalswift) e57e67057ae76db73f52ddd5480a4ea5b4bf1636 tests: Fuzz DecodeHexBlk(...) (practicalswift) 117a706faba586f2095f97cf630b709b3e29a947 tests: Fuzz RecursiveDynamicUsage(const std::shared_ptr<X>& p) (practicalswift) 81b58a3161c5d558dadd2b7093e4fc9687844cd9 tests: Fuzz operator!= of CService (practicalswift) c2c58f6f59d38e3d60fe0a8fa45b2a45deee84cc tests: Increase fuzzing coverage of DecompressScript(...) (practicalswift) 9f8d74a8c78457ed49c7ff81bae909c8e003670b tests: Fuzz currently uncovered code path in TxToUniv(...) (practicalswift) 46ef4cfe5f416cb34e889646df3ee241b1d5ae5a tests: Re-arrange test cases in parse_univalue to increase coverage (practicalswift) 516cc6fc7842c13a1d54c6ea2b9e3d335a872125 tests: Remove unit test from fuzzing harness (practicalswift) 7b169cae207ad1301c4edf7d623407d1f377169d tests: Add deserialization fuzzing of SnapshotMetadata (utxo_snapshot), uint160 and uint256 (practicalswift) Pull request description: Add deserialization fuzzing of `SnapshotMetadata` (`utxo_snapshot`). Increase fuzzing coverage. ACKs for top commit: MarcoFalke: ACK 08eab0f599 🗾 Tree-SHA512: 5dca2316d64b9eb1da9bbbb3831de285b1524cbe815e3dba0f9c4eac7f39b403eb26ee0bdd3d9409a1838e7226d783946ec0d251e514a99f68267a95ac56d416
2020-03-11tests: Add fuzzing of CSubNet, CNetAddr and CService related functionspracticalswift
2020-03-11tests: Fuzz HasAllDesirableServiceFlags(...) and MayHaveUsefulAddressDB(...)practicalswift
2020-03-11tests: Fuzz DecodeBase64PSBT(...)practicalswift
2020-03-11tests: Simplify code by removing unwarranted use of unique_ptr:spracticalswift
2020-03-11tests: Fuzz DecodeHexBlk(...)practicalswift
2020-03-11tests: Fuzz RecursiveDynamicUsage(const std::shared_ptr<X>& p)practicalswift
2020-03-11tests: Fuzz operator!= of CServicepracticalswift
2020-03-11tests: Increase fuzzing coverage of DecompressScript(...)practicalswift
2020-03-11Merge #17989: tests: Add fuzzing harness for ProcessMessage(...). Enables ↵MarcoFalke
high-level fuzzing of the P2P layer. 9220a0fdd0f3dc2c8dd7cbeefac7d11106451b51 tests: Add one specialized ProcessMessage(...) fuzzing binary per message type for optimal results when using coverage-guided fuzzing (practicalswift) fd1dae10b4a549ba9292d837235d59bd9eebbed3 tests: Add fuzzing harness for ProcessMessage(...) (practicalswift) Pull request description: Add fuzzing harness for `ProcessMessage(...)`. Enables high-level fuzzing of the P2P layer. All code paths reachable from this fuzzer can be assumed to be reachable for an untrusted peer. Seeded from thin air (an empty corpus) this fuzzer reaches roughly 20 000 lines of code. To test this PR: ``` $ make distclean $ ./autogen.sh $ CC=clang CXX=clang++ ./configure --enable-fuzz \ --with-sanitizers=address,fuzzer,undefined $ make $ src/test/fuzz/process_message … ``` Worth noting about this fuzzing harness: * To achieve a reasonable number of executions per seconds the state of the fuzzer is unfortunately not entirely reset between `test_one_input` calls. The set-up (`FuzzingSetup` ctor) and tear-down (`~FuzzingSetup`) work is simply too costly to be run on every iteration. There is a trade-off to handle here between a.) achieving high executions/second and b.) giving the fuzzer a totally blank slate for each call. Please let me know if you have any suggestion on how to improve this situation while maintaining >1000 executions/second. * To achieve optimal results when using coverage-guided fuzzing I've chosen to create one specialised fuzzing binary per message type (`process_message_addr`, `process_message_block`, `process_message_blocktxn `, etc.) and one general fuzzing binary (`process_message`) which handles all messages types. The latter general fuzzer can be seeded with inputs generated by the former specialised fuzzers. Happy fuzzing friends! ACKs for top commit: MarcoFalke: ACK 9220a0fdd0 🏊 Tree-SHA512: c314ef12b0db17b53cbf3abfb9ecc10ce420fb45b17c1db0b34cabe7c30e453947b3ae462020b0c9f30e2c67a7ef1df68826238687dc2479cd816f0addb530e5
2020-03-11tests: Fuzz currently uncovered code path in TxToUniv(...)practicalswift
2020-03-11tests: Re-arrange test cases in parse_univalue to increase coveragepracticalswift
2020-03-11tests: Remove unit test from fuzzing harnesspracticalswift
2020-03-11tests: Add deserialization fuzzing of SnapshotMetadata (utxo_snapshot), ↵practicalswift
uint160 and uint256
2020-03-11tests: Add fuzzing harness for ProcessMessage(...)practicalswift
2020-03-09Make lifetime correctness easier to see (avoid reference lifetime extension)practicalswift
2020-03-09tests: Add fuzzing harness for CScriptNum operationspracticalswift
2020-03-09tests: Add fuzzing harness for CScript operationspracticalswift
2020-03-09tests: Add common Consume* fuzzing functionspracticalswift
2020-03-09Merge #18047: tests: Add basic fuzzing harness for CNetAddr/CService/CSubNet ↵MarcoFalke
related functions (netaddress.h) 6590395f6047cbfbe29f491d816c25c9a28d23a2 tests: Remove FUZZERS_MISSING_CORPORA (practicalswift) 815c7a679316e34b2072a45949ad4ecb1ae1c7fb tests: Add basic fuzzing harness for CNetAddr/CService/CSubNet related functions (netaddress.h) (practicalswift) Pull request description: Add basic fuzzing harness for `CNetAddr`/`CService`/`CSubNet` related functions (`netaddress.h`). To test this PR: ``` $ make distclean $ ./autogen.sh $ CC=clang CXX=clang++ ./configure --enable-fuzz \ --with-sanitizers=address,fuzzer,undefined $ make $ src/test/fuzz/netaddress … ``` Top commit has no ACKs. Tree-SHA512: 69dc0e391d56d5e9cdb818ac0ac4b69445d0195f714442a06cf662998e38b6e0bbaa635dce78df37ba797feed633e94abba4764b946c1716d392756e7809112d
2020-03-09tests: Add basic fuzzing harness for CNetAddr/CService/CSubNet related ↵practicalswift
functions (netaddress.h)
2020-03-07fuzz: Add assert(script == decompressed_script)MarcoFalke
2020-03-07tests: Fuzz additional functions in the script fuzzing harnesspracticalswift
2020-03-07tests: Fuzz additional functions in the transaction fuzzing harnesspracticalswift
2020-03-07tests: Fuzz additional functions in the integer fuzzing harnesspracticalswift
2020-03-07tests: Fuzz additional functions in the hex fuzzing harnesspracticalswift
2020-03-07tests: Add key_io fuzzing harnesspracticalswift
2020-03-06tests: Add fuzzing harness for locale independence testingpracticalswift
2020-03-05Merge #17972: tests: Add fuzzing harness for CKey and key related functionsMarcoFalke
f4691b6c217ab843e6e66fa0ad34d83137499a89 tests: Add fuzzing harness for CKey related functions (practicalswift) Pull request description: Add fuzzing harness for `CKey` and key related functions. **How to test this PR** ``` $ make distclean $ ./autogen.sh $ CC=clang CXX=clang++ ./configure --enable-fuzz \ --with-sanitizers=address,fuzzer,undefined $ make $ src/test/fuzz/key … #4096 pulse cov: 5736 ft: 6960 corp: 27/833b lim: 67 exec/s: 2048 rss: 122Mb #8192 pulse cov: 5736 ft: 6960 corp: 27/833b lim: 103 exec/s: 2048 rss: 143Mb #13067 NEW cov: 5736 ft: 6965 corp: 28/865b lim: 154 exec/s: 2177 rss: 166Mb L: 32/32 MS: 1 ChangeBit- #16384 pulse cov: 5736 ft: 6965 corp: 28/865b lim: 182 exec/s: 2048 rss: 181Mb #32768 pulse cov: 5736 ft: 6965 corp: 28/865b lim: 347 exec/s: 2184 rss: 258Mb … ``` Top commit has no ACKs. Tree-SHA512: 5b17ffb70c31966d3eac06d2258c127ae671d28d6cdf4e6ac20b45cd59ad32f80952c9c749930b97d317c72d5f840a3b75d466fd28fb6c351424a72c3e41bcbc
2020-03-05tests: Add fuzzing harness for CKey related functionspracticalswift
2020-03-05Merge #17996: tests: Add fuzzing harness for serialization/deserialization ↵MarcoFalke
of floating-points and integrals 9ff41f64198e8ddb969544fc1a5328763f1fa183 tests: Add float to FUZZERS_MISSING_CORPORA (temporarily) (practicalswift) 8f6fb0a85ae6399c8fb4f205ad35c319c42294f1 tests: Add serialization/deserialization fuzzing for integral types (practicalswift) 3c82b92d2e01e409cc46261bffcf3643102f0b94 tests: Add fuzzing harness for functions taking floating-point types as input (practicalswift) c2bd5888607d283a229c9361747a93c83dfea0de Add missing includes (practicalswift) Pull request description: Add simple fuzzing harness for functions with floating-point parameters (such as `ser_double_to_uint64(double)`, etc.). Add serialization/deserialization fuzzing for integral types. Add missing includes. To test this PR: ``` $ make distclean $ ./autogen.sh $ CC=clang CXX=clang++ ./configure --enable-fuzz \ --with-sanitizers=address,fuzzer,undefined $ make $ src/test/fuzz/float … ``` Top commit has no ACKs. Tree-SHA512: 9b5a0c4838ad18d715c7398e557d2a6d0fcc03aa842f76d7a8ed716170a28f17f249eaede4256998aa3417afe2935e0ffdfaa883727d71ae2d2d18a41ced24b5
2020-03-05tests: Add serialization/deserialization fuzzing for integral typespracticalswift
2020-03-05Merge #17917: tests: Add amount compression/decompression fuzzing to ↵MarcoFalke
existing fuzzing harness 7e9c7113afbed96cef80c327cc93e82000d6bb69 compressor: Make the domain of CompressAmount(...) explicit (practicalswift) 4a7fd7a7124f84e010b01d0769ef0572bf031ee8 tests: Add amount compression/decompression fuzzing to existing fuzzing harness: test compression round-trip (practicalswift) Pull request description: Small fuzzing improvement: Add amount compression/decompression fuzzing to existing fuzzing harness: test compression round-trip (`DecompressAmount(CompressAmount(…))`). Make the domain of `CompressAmount(…)` explicit. Amount compression primer: ``` Compact serialization for amounts Special serializer/deserializer for amount values. It is optimized for values which have few non-zero digits in decimal representation. Most amounts currently in the txout set take only 1 or 2 bytes to represent. ``` **How to test this PR** ``` $ make distclean $ ./autogen.sh $ CC=clang CXX=clang++ ./configure --enable-fuzz \ --with-sanitizers=address,fuzzer,undefined $ make $ src/test/fuzz/integer … ``` Top commit has no ACKs. Tree-SHA512: 0f7c05b97012ccd5cd05a96c209e6b4d7d2fa73138bac9615cf531baa3f614f9003e29a198015bcc083af9f5bdc752bb52615b82c5df3c519b1a064bd4fc6664
2020-03-05Merge #18109: tests: Avoid hitting some known minor tinyformat issues when ↵MarcoFalke
fuzzing strprintf(...) 470e2ac602ed2d6e62e5c80f27cd0a60c7cf6bce tests: Avoid hitting some known minor tinyformat issues when fuzzing strprintf(...) (practicalswift) Pull request description: Avoid hitting some known minor tinyformat issues when fuzzing `strprintf(...)`. These can be removed when the issues have been resolved upstreams :) Note to reviewers: The `%c` and `%*` issues are also present for `%<some junk>c` and `%<some junk>*`. That is why simply matching on `"%c"` or `"%*"` is not enough. Note that the intentionally trivial skipping logic overshoots somewhat (`c[…]%` is filtered in addition to `%[…]c`). Top commit has no ACKs. Tree-SHA512: 2b002981e8b3f2ee021c3013f1260654ac7e158699313849c9e9660462bb8cd521544935799bb8daa74925959dc04d63440e647495e0b008cfe1b8a8b2202d40
2020-02-28Merge #17771: tests: Add fuzzing harness for V1TransportDeserializer (P2P ↵MarcoFalke
transport) 2f63ffd15caeb79867e56c8cedbe2c702952db9e tests: Add fuzzing harness for V1TransportDeserializer (P2P transport) (practicalswift) Pull request description: Add fuzzing harness for `V1TransportDeserializer` (P2P transport). **Testing this PR** Run: ``` $ make distclean $ ./autogen.sh $ CC=clang CXX=clang++ ./configure --enable-fuzz \ --with-sanitizers=address,fuzzer,undefined $ make $ src/test/fuzz/p2p_transport_deserializer … ``` ACKs for top commit: MarcoFalke: ACK 2f63ffd15caeb79867e56c8cedbe2c702952db9e Tree-SHA512: 8507d4a0414d16f1b8cc9649e3e638f74071dddc990d7e5d7e6faf77697f50bdaf133e49e2371edd29068a069a074469ef53148c6bfc9950510460b81d87646a
2020-02-25tests: Add fuzzing harness for rolling bloom filter class CRollingBloomFilterpracticalswift
2020-02-25tests: Add fuzzing harness for bloom filter class CBloomFilterpracticalswift
2020-02-12tests: Avoid hitting some known minor tinyformat issues when fuzzing ↵practicalswift
strprintf(...)
2020-01-31tests: Add fuzzing harness for functions taking floating-point types as inputpracticalswift
2020-01-30tests: Add fuzzing harness for AS-mapping (asmap)practicalswift
2020-01-31Merge #18009: tests: Add fuzzing harness for strprintf(…)MarcoFalke
cc668d06fb71463fd406df761b0e89e25d4de968 tests: Add fuzzing harness for strprintf(...) (practicalswift) ccc3c76e2b5d28a2372ae5752c08256396bf43e6 tests: Add fuzzer strprintf to FUZZERS_MISSING_CORPORA (temporarily) (practicalswift) 6ef04912af7f216f3112e0e9919f67e36415a792 tests: Update FuzzedDataProvider.h from upstream (LLVM) (practicalswift) Pull request description: Add fuzzing harness for `strprintf(…)`. Update `FuzzedDataProvider.h`. Avoid hitting some issues in tinyformat (reported upstreams in https://github.com/c42f/tinyformat/issues/70). --- Found issues in tinyformat: **Issue 1.** The following causes a signed integer overflow followed by an allocation of 9 GB of RAM (or an OOM in memory constrained environments): ``` strprintf("%.777777700000000$", 1.0); ``` **Issue 2.** The following causes a stack overflow: ``` strprintf("%987654321000000:", 1); ``` **Issue 3.** The following causes a stack overflow: ``` strprintf("%1$*1$*", -11111111); ``` **Issue 4.** The following causes a `NULL` pointer dereference: ``` strprintf("%.1s", (char *)nullptr); ``` **Issue 5.** The following causes a float cast overflow: ``` strprintf("%c", -1000.0); ``` **Issue 6.** The following causes a float cast overflow followed by an invalid integer negation: ``` strprintf("%*", std::numeric_limits<double>::lowest()); ``` Top commit has no ACKs. Tree-SHA512: 9b765559281470f4983eb5aeca94bab1b15ec9837c0ee01a20f4348e9335e4ee4e4fecbd7a1a5a8ac96aabe0f9eeb597b8fc9a2c8faf1bab386e8225d5cdbc18
2020-01-29Merge #17957: Serialization improvements step 3 (compression.h)Wladimir J. van der Laan
4de934b9b5b4be1bac8fe205f4ee9a79e772dc34 Convert compression.h to new serialization framework (Pieter Wuille) ca34c5cba5fbb9b046b074a234f06ecf6ed5d610 Add FORMATTER_METHODS, similar to SERIALIZE_METHODS, but for formatters (Pieter Wuille) Pull request description: This is the next piece of the puzzle from #10785. It includes: * The `FORMATTER_METHODS` macro, similar to `SERIALIZE_METHODS`, for defining a formatter with a unified serialization/deserialization implementation. * Updating `compression.h` to consist of 3 formatters, rather than old-style wrappers (`ScriptCompression`, `AmountCompression`, `TxOutCompression`). ACKs for top commit: laanwj: code review ACK 4de934b9b5b4be1bac8fe205f4ee9a79e772dc34 ryanofsky: Code review ACK 4de934b9b5b4be1bac8fe205f4ee9a79e772dc34. Only change since last review is removing REF usages Tree-SHA512: d52ca21eb1ce87d9bc3c90d00c905bd4fada522759aaa144c02a58b4d738d5e8647c0558b8ce393c707f6e3c4d20bf93781a2dcc1e1dcbd276d9b5ffd0e02cd6
2020-01-29test: only declare a main() when fuzzing with AFLfanquake
libFuzzer will provide a main(). This also fixes a weak linking issue when fuzzing with libFuzzer on macOS.
2020-01-27tests: Add fuzzing harness for strprintf(...)practicalswift
2020-01-27tests: Update FuzzedDataProvider.h from upstream (LLVM)practicalswift
Upstream revision: https://github.com/llvm/llvm-project/blob/a44ef027ebca1598892ea9b104d6189aeb3bc2f0/compiler-rt/include/fuzzer/FuzzedDataProvider.h
2020-01-22tests: Add fuzzing harness for V1TransportDeserializer (P2P transport)practicalswift
2020-01-22tests: Add amount compression/decompression fuzzing to existing fuzzing ↵practicalswift
harness: test compression round-trip
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-18 15:46:04 +0000