aboutsummaryrefslogtreecommitdiff
path: root/src/test/fuzz
AgeCommit message (Collapse)Author
2020-06-25tests: Add fuzzing harness for ChaCha20Poly1305AEADpracticalswift
2020-06-25tests: Add fuzzing harness for ChaCha20practicalswift
2020-06-25tests: Add fuzzing harness for CHKDF_HMAC_SHA256_L32practicalswift
2020-06-25tests: Add fuzzing harness for poly1305_auth(...)practicalswift
2020-06-25tests: Add fuzzing harness for AES256CBCEncrypt/AES256CBCDecryptpracticalswift
2020-06-25tests: Add fuzzing harness for AES256Encrypt/AES256Decryptpracticalswift
2020-06-25Merge #19286: tests: Add fuzzing harness for CHash{160,256}, ↵MarcoFalke
C{HMAC_,}SHA{1,256,512}, CRIPEMD160, CSipHasher, etc. 67bb7be864f38ef5afc731aa427146cb2af500dd tests: Add fuzzing harness for CHash{160,256}, C{HMAC_,}SHA{1,256,512}, CRIPEMD160, CSipHasher, etc. (practicalswift) Pull request description: Add fuzzing harness for `CHash{160,256}`, `C{HMAC_,}SHA{1,256,512}`, `CRIPEMD160`, `CSipHasher`, etc. See [`doc/fuzzing.md`](https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md) for information on how to fuzz Bitcoin Core. Don't forget to contribute any coverage increasing inputs you find to the [Bitcoin Core fuzzing corpus repo](https://github.com/bitcoin-core/qa-assets). Happy fuzzing :) Top commit has no ACKs. Tree-SHA512: 5377b361097211a7d0b90a26ed1c6dadb9ecce11349036d19f8c9ad2818cd98709bbcbf1c2361dd18eae122b8dbce1c71bb5aa2e85660677e235b8974ae33fcc
2020-06-24psbt: Allow both non_witness_utxo and witness_utxoAndrew Chow
2020-06-24refactor: Replace HexStr(o.begin(), o.end()) with HexStr(o)Wladimir J. van der Laan
HexStr can be called with anything that bas `begin()` and `end()` functions, so clean up the redundant calls.
2020-06-22rpc: gettxoutsetinfo can specify hash_type (only legacy option for now)Fabian Jahr
2020-06-21scripted-diff: TxoutType C++11 scoped enum classMarcoFalke
-BEGIN VERIFY SCRIPT- # General rename helper: $1 -> $2 rename_global() { sed -i "s/\<$1\>/$2/g" $(git grep -l "$1"); } # Helper to rename TxoutType $1 rename_value() { sed -i "s/ TX_$1,/ $1,/g" src/script/standard.h; # First strip the prefix in the definition (header) rename_global TX_$1 "TxoutType::$1"; # Then replace globally } # Change the type globally to bring it in line with the style-guide # (clsses are UpperCamelCase) rename_global 'enum txnouttype' 'enum class TxoutType' rename_global 'txnouttype' 'TxoutType' # Now rename each enum value rename_value 'NONSTANDARD' rename_value 'PUBKEY' rename_value 'PUBKEYHASH' rename_value 'SCRIPTHASH' rename_value 'MULTISIG' rename_value 'NULL_DATA' rename_value 'WITNESS_V0_KEYHASH' rename_value 'WITNESS_V0_SCRIPTHASH' rename_value 'WITNESS_UNKNOWN' -END VERIFY SCRIPT-
2020-06-21doc: Update outdated txnouttype documentationMarcoFalke
Also, remove scope of txnouttype in fuzz tests temporarily. The next commit will add scopes to all txnouttype.
2020-06-19net: Use mockable time for ping/pong, add testsMarcoFalke
2020-06-19Merge #18937: refactor: s/command/msg_type/ in CNetMsgMaker and ↵MarcoFalke
CSerializedNetMsg 51e9393c1f6c9eaac554f821f5327f63bd09c8cf refactor: s/command/msg_type/ in CNetMsgMaker and CSerializedNetMsg (Sebastian Falbesoner) Pull request description: Follow-up PR for #18533 -- another small step towards getting rid of the confusing "command" terminology. Also see PR #18610 which tackled the functional tests. ACKs for top commit: MarcoFalke: ACK 51e9393c1f6c9eaac554f821f5327f63bd09c8cf Tree-SHA512: bb6f05a7be6823d5c4eab1d05b31fee944e700946827ad9425d59a3957fd879776c88c606319cbe9832d9451b275baedf913b71429ea3e01e4e82bf2d419e819
2020-06-19Merge #19293: net: Avoid redundant and confusing FAILED logfanquake
fa1904e5f0d164fbcf41398f9ebbaafe82c28419 net: Remove dead logging code (MarcoFalke) fac12ebf4f3b77b05112d2b00f8d3f4669621a4c net: Avoid redundant and confusing FAILED log (MarcoFalke) Pull request description: Remove a redundant and confusing "FAILED" log message and gets rid of the unused return type in `ProcessMessage` ACKs for top commit: jnewbery: utACK fa1904e5f0d164fbcf41398f9ebbaafe82c28419 gzhao408: utACK https://github.com/bitcoin/bitcoin/commit/fa1904e5f0d164fbcf41398f9ebbaafe82c28419 troygiorshev: ACK fa1904e5f0d164fbcf41398f9ebbaafe82c28419 naumenkogs: utACK fa1904e Tree-SHA512: bfa553d5efa022727ed17877fb7c08c14849d804fe6d6a7ce172d513857beba35de41ea40b27ff1aedf68b81e2cda7b2a948ac985fcaaf1b6cfb96cce4837c90
2020-06-18Merge #18468: Span improvementsWladimir J. van der Laan
26acc8dd9b512f220c1facdba2c5de7976d3c258 Add sanity check asserts to span when -DDEBUG (Pieter Wuille) 2676aeadfa0e43dcaaccc4720623cdfe0beed528 Simplify usage of Span in several places (Pieter Wuille) ab303a16d114b1e94c6cf0e4c5db5389dfa197f6 Add Span constructors for arrays and vectors (Pieter Wuille) bb3d38fc061d8482e68cd335a45c9cd8bb66a475 Make pointer-based Span construction safer (Pieter Wuille) 1f790a1147ad9a5fe06987d84b6cd71f91cbec4b Make Span size type unsigned (Pieter Wuille) Pull request description: This improves our Span class by making it closer to the C++20 `std::span` one: * ~~Support conversion between compatible Spans (e.g. `Span<char>` to `Span<const char>`).~~ (done in #18591) * Make the size type `std::size_t` rather than `std::ptrdiff_t` (the C++20 one underwent the same change). * Support construction of Spans directly from arrays, `std::string`s, `std::array`s, `std::vector`s, `prevector`s, ... (for all but arrays, this only works for const containers to prevent surprises). And then make use of those improvements in various call sites. I realize the template magic used looks scary, but it's only needed to make overload resultion make the right choices. Note that the operations done on values are all extremely simple: no casts, explicit conversions, or warning-silencing constructions. That should hopefully make it simpler to review. ACKs for top commit: laanwj: Code review ACK 26acc8dd9b512f220c1facdba2c5de7976d3c258 promag: Code review ACK 26acc8dd9b512f220c1facdba2c5de7976d3c258. Tree-SHA512: 5a5bd346a140edf782b5b3b3f04d9160c7b9e9def35159814a07780ab1dd352545b88d3cc491e0f80d161f829c49ebfb952fddc9180f1a56f1257aa51f38788a
2020-06-16net: Remove dead logging codeMarcoFalke
fRet is never false, so the dead code can be removed and the return type can be made void
2020-06-15tests: Add fuzzing harness for CHash{160,256}, C{HMAC_,}SHA{1,256,512}, ↵practicalswift
CRIPEMD160, CSipHasher, etc.
2020-06-11tests: Add fuzzing harness for {Read,Write}{LE,BE}{16,32,64} (crypto/common.h)practicalswift
2020-06-11tests: Add std::vector<uint8_t> ↵practicalswift
ConsumeFixedLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, const size_t length)
2020-06-09refactor: Error message bilingual_str consistencyWladimir J. van der Laan
- Move the decision whether to translate an error message to where it is defined. This simplifies call sites: no more `InitError(Untranslated(...))`. - Make all functions in `util/error.h` consistently return a `bilingual_str`. We've decided to use this as error message type so let's roll with it. This has no functional changes: no messages are changed, no new translation messages are defined.
2020-06-04Merge #19053: refactor: replace CNode pointers by references within ↵MarcoFalke
net_processing.{h,cpp} 8b3136bd307123a255b9166aa42a497a44bcce70 refactor: replace CNode pointers by references within net_processing.{h,cpp} (Sebastian Falbesoner) Pull request description: This PR is inspired by a [recent code review comment](https://github.com/bitcoin/bitcoin/pull/19010#discussion_r426954791) on a PR that introduced new functions to the net_processing module. The point of the discussion was basically that whenever we pass something not by value (in the concrete example it was about `CNode*` and `CConnman*`) we should either use * a pointer (```CType*```) with null pointer check or * a reference (```CType&```) To keep things simple, this PR for a first approach * only tackles `CNode*` pointers * only within the net_processing module, i.e. no changes that would need adaption in other modules * keeps the names of the variables as they are I'm aware that PRs like this are kind of a PITA to review, but I think the code quality would increase if we get rid of pointers without nullptr check -- bloating up the code by adding all the missing checks would be the worse alternative, in my opinion. Possible follow-up PRs, in case this is received well: * replace CNode pointers by references for net module * replace CConnman pointers by references for net_processing module * ... ACKs for top commit: MarcoFalke: ACK 8b3136bd307123a255b9166aa42a497a44bcce70 🔻 practicalswift: ACK 8b3136bd307123a255b9166aa42a497a44bcce70 Tree-SHA512: 15b6a569ecdcb39341002b9f4e09b38ed4df077e3a3a50dfb1b72d98bdc9f9769c7c504f106456aa7748af8591af7bb836b72d46086df715ab116e4ac3224b3b
2020-06-03Merge #18875: fuzz: Stop nodes in process_message* fuzzersMarcoFalke
fab860aed4878b831dae463e1ee68029b66210f5 fuzz: Stop nodes in process_message* fuzzers (MarcoFalke) 6666c828e072a5e99ea0c16394ca3e5b9de07409 fuzz: Give CNode ownership to ConnmanTestMsg in process_message fuzz harness (MarcoFalke) Pull request description: Background is that I saw an integer overflow in net_processing ``` #30629113 REDUCE cov: 25793 ft: 142917 corp: 3421/2417Kb lim: 4096 exec/s: 89 rss: 614Mb L: 1719/4096 MS: 1 EraseBytes- net_processing.cpp:977:25: runtime error: signed integer overflow: 2147483624 + 100 cannot be represented in type 'int' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior net_processing.cpp:977:25 in net_processing.cpp:985:9: runtime error: signed integer overflow: -2147483572 - 100 cannot be represented in type 'int' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior net_processing.cpp:985:9 in ``` Telling from the line numbers, it looks like `nMisbehavior` wrapped around. Fix that by calling `StopNodes` after each exec, which should clear the node state and thus `nMisbehavior`. ACKs for top commit: practicalswift: ACK fab860aed4878b831dae463e1ee68029b66210f5 Tree-SHA512: 891c081d5843565d891aec028b6c27ef3fa39bc40ae78238e81d8f784b4d4b49cb870998574725a5159dd03aeeb2e0b9bc3d3bb51d57d1231ef42e3394b2d639
2020-06-02tests: Avoid fuzzer-specific nullptr dereference in libevent when handling ↵practicalswift
PROXY requests
2020-06-02refactor: replace CNode pointers by references within net_processing.{h,cpp}Sebastian Falbesoner
2020-05-30tests: Add fuzzing harness for functions in script/sign.hpracticalswift
2020-05-30tests: Add fuzzing harness for functions in script/sigcache.hpracticalswift
2020-05-30tests: Add fuzzing harness for functions in script/interpreter.hpracticalswift
2020-05-30tests: Add fuzzing harness for functions in script/descriptor.hpracticalswift
2020-05-30tests: Add fuzzing harness for functions in script/bitcoinconsensus.hpracticalswift
2020-05-30tests: Fill fuzzing coverage gaps for functions in script/script.h, ↵practicalswift
script/script_error.h and script/standard.h
2020-05-29tests: Add fuzzing helper functions ConsumeDataStream, ConsumeTxDestination ↵practicalswift
and ConsumeUInt160
2020-05-26Merge #19032: Serialization improvements: final stepWladimir J. van der Laan
71f016c6eb42e1ac2c905e04ba4d20c2009e533f Remove old serialization primitives (Pieter Wuille) 92beff15d3ae2646c00bd78146d7592a7097ce9c Convert LimitedString to formatter (Pieter Wuille) ef17c03e074b6c3f185afa4eff572ba687c2a171 Convert wallet to new serialization (Pieter Wuille) 65c589e45e8b8914698a0fd25cd5aafdda30869c Convert Qt to new serialization (Pieter Wuille) Pull request description: This is the final step 🥳 of the serialization improvements extracted from #10785. It converts the LimitedString wrapper to a new-style formatter, and updates the wallet and Qt code to use the new serialization framework. Finally all remaining old primitives are removed. ACKs for top commit: jonatack: ACK 71f016c6eb42e1ac2 reviewed diff, builds/tests/re-fuzzed. laanwj: Code review ACK 71f016c6eb42e1ac2c905e04ba4d20c2009e533f Tree-SHA512: d952194bc73259f6510bd4ab1348a1febbbf9862af30f905991812fb0e1f23f15948cdb3fc662be54d648e8f6d95b11060055d2e7a8c2cb5bf008224870b1ea1
2020-05-25tests: Add fuzzing harness for CCoinsViewCachepracticalswift
2020-05-24Convert LimitedString to formatterPieter Wuille
2020-05-23Merge #18698: Make g_chainman internal to validationMarcoFalke
fab6b9d18fd48bbbd1939b1173723bc04c5824b5 validation: Mark g_chainman DEPRECATED (MarcoFalke) fa1d97b25686a5caca623599f6d608fd08616fe8 validation: Make ProcessNewBlock*() members of ChainstateManager (MarcoFalke) fa24d4909864096934577abc26cfa9be47f634ba validation: Make PruneOneBlockFile() a member of ChainstateManager (MarcoFalke) fa84b1cd846f6499b741710fd478ec9ad49b5120 validation: Make LoadBlockIndex() a member of ChainstateManager (MarcoFalke) fa05fdf0f19fa4b557cc5e9ba436e3215b83c4e6 net: Pass chainman into PeerLogicValidation (MarcoFalke) fa7b626d7a150e5cbd4d163d2dab6f8a55fc2cc4 node: Add chainman alias for g_chainman (MarcoFalke) Pull request description: The global `g_chainman` has recently been introduced in #17737. The chainstate manager is primarily needed for the assumeutxo feature, but it can also simplify testing in the future. The goal of this pull is to make the global chainstate manager internal to validation, so that all external code does not depend on globals and that unit or fuzz tests can pass in their (potentially mocked) chainstate manager. I suggest reviewing the pull request commit-by-commit. It should be relatively straightforward refactoring that does not change behavior at all. ACKs for top commit: ryanofsky: Code review ACK fab6b9d18fd48bbbd1939b1173723bc04c5824b5. Had to be rebased but still looks good Tree-SHA512: dcbf114aeef4f8320d466369769f22ce4dd8f46a846870354df176c3de9ff17c64630fbd777e7121d7470d7a8564ed8d37b77168746e8df7489c6877e55d7b4f
2020-05-22tests: Don't limit fuzzing inputs to 1 MB for afl-fuzz (now: ∞ ∀ fuzzers)practicalswift
2020-05-21net: Pass chainman into PeerLogicValidationMarcoFalke
2020-05-14Switch from Optional<T> to std::optional<T> (C++17). Run clang-format.practicalswift
2020-05-14tests: Fill fuzzing coverage gaps for functions in util/translation.hpracticalswift
2020-05-14tests: Fill fuzzing coverage gaps for functions in consensus/validation.hpracticalswift
2020-05-14tests: Fill fuzzing coverage gaps for functions in primitives/block.hpracticalswift
2020-05-12Simplify usage of Span in several placesPieter Wuille
2020-05-12fuzz: Stop nodes in process_message* fuzzersMarcoFalke
2020-05-11fuzz: Give CNode ownership to ConnmanTestMsg in process_message fuzz harnessMarcoFalke
2020-05-11refactor: s/command/msg_type/ in CNetMsgMaker and CSerializedNetMsgSebastian Falbesoner
2020-05-09fuzz: use std::optional for sep_pos variableHarris
Co-authored-by: MarcoFalke <falke.marco@gmail.com>
2020-05-08fuzz: fix vector size problem in system fuzzerHarris
Co-authored-by: Pieter Wuille <pieter.wuille@gmail.com>
2020-05-06Merge #18512: Improve asmap checks and add sanity checkWladimir J. van der Laan
748977690e0519110cda9628162a7ccf73a5934b Add asmap_direct fuzzer that tests Interpreter directly (Pieter Wuille) 7cf97fda154ba837933eb05be5aeecfb69a06641 Make asmap Interpreter errors fatal and fuzz test it (Pieter Wuille) c81aefc5377888c7ac4f29f570249fd6c2fdb352 Add additional effiency checks to sanity checker (Pieter Wuille) fffd8dca2de39ad4a683f0dce57cdca55ed2f600 Add asmap sanity checker (Pieter Wuille) 5feefbe6e7b6cdd809eba4074d41dc95a7035f7e Improve asmap Interpret checks and document failures (Pieter Wuille) 2b3dbfa5a63cb5a6625ec00294ebd933800f0255 Deal with decoding failures explicitly in asmap Interpret (Pieter Wuille) 1479007a335ab43af46f527d0543e254fc2a8e86 Introduce Instruction enum in asmap (Pieter Wuille) Pull request description: This improves/documents the failure cases inside the asmap interpreter. None of the changes are bug fixes (they only change behavior for corrupted asmap files), but they may make things easier to follow. In a second step, a sanity checker is added that effectively executes every potential code path through the asmap file, checking the same failure cases as the interpreter, and more. It takes around 30 ms to run for me for a 1.2 MB asmap file. I've verified that this accepts asmap files constructed by https://github.com/sipa/asmap/blob/master/buildmap.py with a large dataset, and no longer accepts it with 1 bit changed in it. ACKs for top commit: practicalswift: ACK 748977690e0519110cda9628162a7ccf73a5934b modulo feedback below. jonatack: ACK 748977690e0519110cda9628162a7ccf73a5934b code review, regular build/tests/ran bitcoin with -asmap, fuzz build/ran both fuzzers overnight. fjahr: ACK 748977690e0519110cda9628162a7ccf73a5934b Tree-SHA512: d876df3859735795c857c83e7155ba6851ce839bdfa10c18ce2698022cc493ce024b5578c1828e2a94bcdf2552c2f46c392a251ed086691b41959e62a6970821
2020-05-06Merge #18806: net: remove is{Empty,Full} flags from CBloomFilter, clarify ↵fanquake
CVE fix 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 net: remove is{Empty,Full} flags from CBloomFilter, clarify CVE fix (Sebastian Falbesoner) Pull request description: The BIP37 bloom filter class `CBloomFilter` contains two flags `isEmpty`/`isFull` together with an update method with the purpose to, according to the comments, "avoid wasting cpu", i.e. the mechanism should serve as an optimization for the trivial cases of empty (all bits zero) or full (all bits one) filters. However, the real reason of adding those flags (introduced with commit https://github.com/bitcoin/bitcoin/commit/37c6389c5a0ca63ae3573440ecdfe95d28ad8f07 by gmaxwell) was a _covert fix_ of [CVE-2013-5700](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5700), a vulnerability that allowed a divide-by-zero remote node crash. According to gmaxwell himself (https://github.com/bitcoin/bitcoin/pull/9060#issuecomment-257749165): > the IsEmpty/IsFull optimizations were largely a pretextual optimization intended to make unexploitable a remote crash vulnerability (integer division by zero) that existed in the original bloom filtering code without disclosing it. I'm doubtful that they are all that useful. :) For more information on how to trigger this crash, see PR https://github.com/bitcoin/bitcoin/pull/18515 which contains a detailled description and a regression test. It has also been discussed on a [recent PR club meeting on fuzzing](https://bitcoincore.reviews/18521.html). The covert fix code already led to issues and PR based on the wrong assumption that the flags are there for optimization reasons (see #16886 and #16922). This PR gets rid of the flags and the update method and just focuses on the CVE fix itself, i.e. it can be seen as a revert of the covert fix commit modulo the actual fix. ACKs for top commit: meshcollider: utACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 laanwj: Concept and code review ACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 jkczyz: ACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 MarcoFalke: ACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 fjahr: Code review ACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 Tree-SHA512: 29f7ff9faece0285e11e16c024851f5bcb772dec64118ccc3f9067ec256267ec8e1b1e3105c7de2a72fd122c3b085e8fc840ab8f4e49813f1cc7a444df1867f7
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-18 15:45:06 +0000