aboutsummaryrefslogtreecommitdiff
path: root/src/test/fuzz
AgeCommit message (Collapse)Author
2020-05-22tests: Don't limit fuzzing inputs to 1 MB for afl-fuzz (now: ∞ ∀ fuzzers)practicalswift
2020-05-14Switch from Optional<T> to std::optional<T> (C++17). Run clang-format.practicalswift
2020-05-14tests: Fill fuzzing coverage gaps for functions in util/translation.hpracticalswift
2020-05-14tests: Fill fuzzing coverage gaps for functions in consensus/validation.hpracticalswift
2020-05-14tests: Fill fuzzing coverage gaps for functions in primitives/block.hpracticalswift
2020-05-09fuzz: use std::optional for sep_pos variableHarris
Co-authored-by: MarcoFalke <falke.marco@gmail.com>
2020-05-08fuzz: fix vector size problem in system fuzzerHarris
Co-authored-by: Pieter Wuille <pieter.wuille@gmail.com>
2020-05-06Merge #18512: Improve asmap checks and add sanity checkWladimir J. van der Laan
748977690e0519110cda9628162a7ccf73a5934b Add asmap_direct fuzzer that tests Interpreter directly (Pieter Wuille) 7cf97fda154ba837933eb05be5aeecfb69a06641 Make asmap Interpreter errors fatal and fuzz test it (Pieter Wuille) c81aefc5377888c7ac4f29f570249fd6c2fdb352 Add additional effiency checks to sanity checker (Pieter Wuille) fffd8dca2de39ad4a683f0dce57cdca55ed2f600 Add asmap sanity checker (Pieter Wuille) 5feefbe6e7b6cdd809eba4074d41dc95a7035f7e Improve asmap Interpret checks and document failures (Pieter Wuille) 2b3dbfa5a63cb5a6625ec00294ebd933800f0255 Deal with decoding failures explicitly in asmap Interpret (Pieter Wuille) 1479007a335ab43af46f527d0543e254fc2a8e86 Introduce Instruction enum in asmap (Pieter Wuille) Pull request description: This improves/documents the failure cases inside the asmap interpreter. None of the changes are bug fixes (they only change behavior for corrupted asmap files), but they may make things easier to follow. In a second step, a sanity checker is added that effectively executes every potential code path through the asmap file, checking the same failure cases as the interpreter, and more. It takes around 30 ms to run for me for a 1.2 MB asmap file. I've verified that this accepts asmap files constructed by https://github.com/sipa/asmap/blob/master/buildmap.py with a large dataset, and no longer accepts it with 1 bit changed in it. ACKs for top commit: practicalswift: ACK 748977690e0519110cda9628162a7ccf73a5934b modulo feedback below. jonatack: ACK 748977690e0519110cda9628162a7ccf73a5934b code review, regular build/tests/ran bitcoin with -asmap, fuzz build/ran both fuzzers overnight. fjahr: ACK 748977690e0519110cda9628162a7ccf73a5934b Tree-SHA512: d876df3859735795c857c83e7155ba6851ce839bdfa10c18ce2698022cc493ce024b5578c1828e2a94bcdf2552c2f46c392a251ed086691b41959e62a6970821
2020-05-06Merge #18806: net: remove is{Empty,Full} flags from CBloomFilter, clarify ↵fanquake
CVE fix 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 net: remove is{Empty,Full} flags from CBloomFilter, clarify CVE fix (Sebastian Falbesoner) Pull request description: The BIP37 bloom filter class `CBloomFilter` contains two flags `isEmpty`/`isFull` together with an update method with the purpose to, according to the comments, "avoid wasting cpu", i.e. the mechanism should serve as an optimization for the trivial cases of empty (all bits zero) or full (all bits one) filters. However, the real reason of adding those flags (introduced with commit https://github.com/bitcoin/bitcoin/commit/37c6389c5a0ca63ae3573440ecdfe95d28ad8f07 by gmaxwell) was a _covert fix_ of [CVE-2013-5700](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5700), a vulnerability that allowed a divide-by-zero remote node crash. According to gmaxwell himself (https://github.com/bitcoin/bitcoin/pull/9060#issuecomment-257749165): > the IsEmpty/IsFull optimizations were largely a pretextual optimization intended to make unexploitable a remote crash vulnerability (integer division by zero) that existed in the original bloom filtering code without disclosing it. I'm doubtful that they are all that useful. :) For more information on how to trigger this crash, see PR https://github.com/bitcoin/bitcoin/pull/18515 which contains a detailled description and a regression test. It has also been discussed on a [recent PR club meeting on fuzzing](https://bitcoincore.reviews/18521.html). The covert fix code already led to issues and PR based on the wrong assumption that the flags are there for optimization reasons (see #16886 and #16922). This PR gets rid of the flags and the update method and just focuses on the CVE fix itself, i.e. it can be seen as a revert of the covert fix commit modulo the actual fix. ACKs for top commit: meshcollider: utACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 laanwj: Concept and code review ACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 jkczyz: ACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 MarcoFalke: ACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 fjahr: Code review ACK 1ad8ea2b73134bdd8d6b50704a019d47ad2191d8 Tree-SHA512: 29f7ff9faece0285e11e16c024851f5bcb772dec64118ccc3f9067ec256267ec8e1b1e3105c7de2a72fd122c3b085e8fc840ab8f4e49813f1cc7a444df1867f7
2020-05-04Merge #18783: tests: Add fuzzing harness for MessageSign, MessageVerify and ↵MarcoFalke
other functions in util/message.h 38e49ded8bd079f8da8b270b39f81cc5cf3ada11 tests: Add fuzzing harness for MessageSign, MessageVerify and other functions in util/message.h (practicalswift) Pull request description: Add fuzzing harness for `MessageSign`, `MessageVerify` and other functions in `util/message.h`. See [`doc/fuzzing.md`](https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md) for information on how to fuzz Bitcoin Core. Don't forget to contribute any coverage increasing inputs you find to the [Bitcoin Core fuzzing corpus repo](https://github.com/bitcoin-core/qa-assets). Happy fuzzing :) ACKs for top commit: vasild: utACK 38e49ded8bd079f8da8b270b39f81cc5cf3ada11 Tree-SHA512: 4f83718365d9c7e772a4ccecb31817bf17117efae2bfaf6e9618ff17908def0c8b97b5fa2504d51ab38b2e6f82c046178dd751495cc37ab4779c0b1ac1a4d211
2020-05-02Merge #18413: script: prevent UB when computing abs value for num opcode ↵fanquake
serialize 2748e8793267126c5b40621d75d1930e358f057e script: prevent UB when computing abs value for num opcode serialize (pierrenn) Pull request description: This was reported by practicalswift here #18046 It seems that the original author of the line used a reference to glibc `abs`: https://github.com/lattera/glibc/blob/master/stdlib/abs.c However depending on some implementation details this can be undefined behavior for unusual values. A detailed explanation of the UB is provided here : https://stackoverflow.com/questions/17313579/is-there-a-safe-way-to-get-the-unsigned-absolute-value-of-a-signed-integer-with (by [Billy O'Neal](https://twitter.com/malwareminigun)) Simple relevant godbolt example : https://godbolt.org/z/yRwtCG Thanks! ACKs for top commit: sipa: ACK 2748e8793267126c5b40621d75d1930e358f057e MarcoFalke: ACK 2748e8793267126c5b40621d75d1930e358f057e, only checked that the bitcoind binary does not change with clang -O2 🎓 practicalswift: ACK 2748e8793267126c5b40621d75d1930e358f057e Tree-SHA512: 539a34c636c2674c66cb6e707d9d0dfdce63f59b5525610ed88da10c9a8d59d81466b111ad63b850660cef3750d732fc7755530c81a2d61f396be0707cd86dec
2020-04-30tests: Clarify how we avoid hitting the signed integer overflow in ↵practicalswift
CFeeRate::GetFeePerK() when fuzzing
2020-04-30tests: Add fuzzing harness for IsRBFOptIn(...)practicalswift
2020-04-30tests: Add fuzzing harness for CBlockPolicyEstimatorpracticalswift
2020-04-28net: remove is{Empty,Full} flags from CBloomFilter, clarify CVE fixSebastian Falbesoner
2020-04-27tests: Add fuzzing harness for MessageSign, MessageVerify and other ↵practicalswift
functions in util/message.h
2020-04-26tests: Add fuzzing coverage for JSONRPCTransactionError(...) and ↵practicalswift
RPCErrorFromTransactionError(...)
2020-04-26tests: Add fuzzing coverage for TransactionErrorString(...)practicalswift
2020-04-26tests: Add fuzzing coverage for ParseFixedPoint(...)practicalswift
2020-04-26tests: Add fuzzing coverage for FormatHDKeypath(...) and WriteHDKeypath(...)practicalswift
2020-04-26tests: Add fuzzing coverage for CHECK_NONFATAL(...)practicalswift
2020-04-26tests: Add fuzzing coverage for StringForFeeReason(...)practicalswift
2020-04-26tests: Add fuzzing harness for functions in system.h (ArgsManager)practicalswift
2020-04-25Merge #18744: test: Add fuzzing harnesses for various classes/functions in ↵MarcoFalke
primitives/ fd8e99da57b53da29fbaec6435931c396e3b612b tests: Add fuzzing harness for functions in primitives/transaction.h (practicalswift) d5a31b7cb4226a62931fd72672422a3d2e789e7a tests: Add fuzzing harness for functions in primitives/block.h (practicalswift) Pull request description: Add fuzzing harnesses for various classes/functions in `primitives/`. See [`doc/fuzzing.md`](https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md) for information on how to fuzz Bitcoin Core. Don't forget to contribute any coverage increasing inputs you find to the [Bitcoin Core fuzzing corpus repo](https://github.com/bitcoin-core/qa-assets). Happy fuzzing :) Top commit has no ACKs. Tree-SHA512: ed54bd5b37ff5e40cfa8d3cd8c65d91a2f64fca87b6a5c3b8ddd6becd876ed172735fb53da4d00a86f318fb94517afd179e07cb28a43edf301ffe4dad703cca4
2020-04-24fuzz: Remove enumeration of expected deserialization exceptions in ↵practicalswift
ProcessMessage(...) fuzzer
2020-04-24tests: Add fuzzing harness for functions in primitives/transaction.hpracticalswift
2020-04-22tests: Add fuzzing harness for functions in primitives/block.hpracticalswift
2020-04-22Merge #18612: script: Remove undocumented and unused operator+Wladimir J. van der Laan
ccccd5190898ece3ac17aa3178f320d091f221df script: Remove undocumented and unused operator+ (MarcoFalke) Pull request description: This operator has no documented use case and is also unused outside of test code. The test code and all other (imaginary) code that might use this operator is written more clear and concise by the existing CScript push operators for opcodes and data. Removing the operator is also going to protect against accidentally reintroducing bugs like this https://github.com/bitcoin/bitcoin/commit/6ff5f718b6a67797b2b3bab8905d607ad216ee21#diff-8458adcedc17d046942185cb709ff5c3L1135 (last time it was used). ACKs for top commit: laanwj: ACK ccccd5190898ece3ac17aa3178f320d091f221df Tree-SHA512: 43898ac77e4d9643d9f8ac6f8f65497a4f0bbb1fb5dcaecc839c3719aa36181ba77befb213e59a9f33a20a29e0173a0e9c4763b1930940b32c3d1598b3e39af9
2020-04-20Merge #18190: tests: Add fuzzing harness for Golomb-Rice coding ↵MarcoFalke
(GolombRiceEncode/GolombRiceDecode) 69749fbe6a95f45eb7a695a5f89be87e55c91fb8 tests: Add fuzzing harness for Golomb-Rice coding (GolombRiceEncode/GolombRiceDecode) (practicalswift) Pull request description: Add fuzzing harness for Golomb-Rice coding (`GolombRiceEncode`/`GolombRiceDecode`). Test this PR using: ``` $ make distclean $ ./autogen.sh $ CC=clang CXX=clang++ ./configure --enable-fuzz \ --with-sanitizers=address,fuzzer,undefined $ make $ src/test/fuzz/golomb_rice … ``` Top commit has no ACKs. Tree-SHA512: 1b26512301b8c22ab3b804d9b9e4baf933f26f8c05e462d583863badcec7e694548a34849a0d7c4ff7d58b19f6338b51819976ecf642bc4659b04ef71182d748
2020-04-20tests: Add fuzzing harness for Golomb-Rice coding ↵practicalswift
(GolombRiceEncode/GolombRiceDecode)
2020-04-17Merge #18682: fuzz: http_request workaround for libevent < 2.1.1MarcoFalke
6f8b498d186df5aa08dbb9ca8fdeab6652f1db5e fuzz: http_request workaround for libevent < 2.1.1 (Sebastian Falbesoner) Pull request description: The fuzz test `http_request` calls the following two internal libevent functions: * `evhttp_parse_firstline_` * `evhttp_parse_headers_` Before libevent 2.1.1 however, internal functions names didn't end with an underscore (see libevent commit https://github.com/libevent/libevent/commit/8ac3c4c25bea4b9948ab91cd00605bf34fc0bd72 and [Changelog for 2.1.1.-alpha](https://github.com/libevent/libevent/blob/master/ChangeLog#L1830) when the change was first mentioned) hence the build fails with a linking error. This PR adds a preprocessor workaround to the test that checks for the libevent version (via ~`_EVENT_NUMERIC_VERSION`~ `LIBEVENT_VERSION_NUMBER`) and creates wrapper functions mapping to naming scheme without underscore in case the version is older than 2.1.1. Tested with Ubuntu Xenial 16.04.6 LTS and clang-8. ACKs for top commit: hebasto: ACK 6f8b498d186df5aa08dbb9ca8fdeab6652f1db5e, tested on xenial: Tree-SHA512: 3b9e0147b8aea22e417d418e3b6d4905f5be131c2b0ae4b0f8b9411c5606d2e22f1b23e1ecc6980ecab907c61404de09e588aae1ac43cf70cf9e8d006bbdee73
2020-04-17fuzz: http_request workaround for libevent < 2.1.1Sebastian Falbesoner
Before libevent 2.1.1, internal functions names didn't end with an underscore.
2020-04-17Merge #18673: scripted-diff: Sort test includesMarcoFalke
fa4632c41714dfaa699bacc6a947d72668a4deef test: Move boost/stdlib includes last (MarcoFalke) fa488f131fd4f5bab0d01376c5a5013306f1abcd scripted-diff: Bump copyright headers (MarcoFalke) fac5c373006a9e4bcbb56843bb85f1aca4d87599 scripted-diff: Sort test includes (MarcoFalke) Pull request description: When writing tests, often includes need to be added or removed. Currently the list of includes is not sorted, so developers that write tests and have `clang-format` installed will either have an unrelated change (sorting) included in their commit or they will have to manually undo the sort. This pull preempts both issues by just sorting all includes in one commit. Please be aware that this is **NOT** a change to policy to enforce clang-format or any other developer guideline or process. Developers are free to use whatever tool they want, see also #18651. Edit: Also includes a commit to bump the copyright headers, so that the touched files don't need to be touched again for that. ACKs for top commit: practicalswift: ACK fa4632c41714dfaa699bacc6a947d72668a4deef jonatack: ACK fa4632c41714dfaa, light review and sanity checks with gcc build and clang fuzz build Tree-SHA512: 130a8d073a379ba556b1e64104d37c46b671425c0aef0ed725fd60156a95e8dc83fb6f0b5330b2f8152cf5daaf3983b4aca5e75812598f2626c39fd12b88b180
2020-04-17Merge #18664: fuzz: fix unused variable compiler warningMarcoFalke
eab7367e25e35688a4d4a6c96701dd7149134df5 fuzz: fix unused variable compiler warning (Jon Atack) Pull request description: Fixes the compiler warning while hopefully not invalidating the existing seeds. Added an explanatory comment. ``` test/fuzz/locale.cpp:59:19: warning: unused variable 'random_int32' [-Wunused-variable] const int32_t random_int32 = fuzzed_data_provider.ConsumeIntegral<int32_t>(); ``` ACKs for top commit: practicalswift: ACK eab7367e25e35688a4d4a6c96701dd7149134df5 Tree-SHA512: 4c90784518027cd3f85acd18030201efe4018f9da46365fef934e9a53a0b923031fec4c884a2da2f14232b6060aeb9016ac09950a18e31395de048548ecbc836
2020-04-17fuzz: fix unused variable compiler warningJon Atack
2020-04-17refactor: Remove unused methods CBloomFilter::reset()/clear()Sebastian Falbesoner
Co-authored-by: MarcoFalke <falke.marco@gmail.com>
2020-04-16scripted-diff: Bump copyright headersMarcoFalke
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT-
2020-04-16scripted-diff: Sort test includesMarcoFalke
-BEGIN VERIFY SCRIPT- # Mark all lines with #includes sed -i --regexp-extended -e 's/(#include <.*>)/\1 /g' $(git grep -l '#include' ./src/bench/ ./src/test ./src/wallet/test/) # Sort all marked lines git diff -U0 | ./contrib/devtools/clang-format-diff.py -p1 -i -v -END VERIFY SCRIPT-
2020-04-15fuzz: Disable debug log fileMarcoFalke
2020-04-15script: Remove undocumented and unused operator+MarcoFalke
2020-04-09Merge #18529: Add fuzzer version of randomized prevector testMarcoFalke
b1d24d1d031a2b2ce67bf846bafa1c3a499b7553 Reorder the test instructions by number (Pieter Wuille) c2ccadc26a04358b11539097c1aadb8d11b85c21 Merge and generalize case 3 and case 6 (Pieter Wuille) 402ad5aaca9509d45d861d77eb6431d6e1944f91 Only run sanity check once at the end (Pieter Wuille) eda8309bfc6a8c94f0b7c076d1cccc86c1011cbc Assert immediately rather than caching failure (Pieter Wuille) 55608455cbed4234f26f62ed9ff500fe5dbc21c4 Make a fuzzer-based copy of the prevector randomized test (Pieter Wuille) Pull request description: The current prevector test effectively randomly generates a number of operations to perform on a prevector and a normal vector, and checks consistency between the two. By converting this into a fuzzer the operations can be targetted rather than random. ACKs for top commit: MarcoFalke: ACK b1d24d1d031a2b2ce67bf846bafa1c3a499b7553 🍬 Tree-SHA512: 2b5c62abcd5fee94f42db03400531484d98c59e7f4308e0e683c61aabcd9ce42f85c5d058d2d5e7f8221124f71d2112b6a5f3c80e5d0fdae265a70647747e92f
2020-04-09script: prevent UB when computing abs value for num opcode serializepierrenn
2020-04-08Add asmap_direct fuzzer that tests Interpreter directlyPieter Wuille
2020-04-08Make asmap Interpreter errors fatal and fuzz test itPieter Wuille
2020-04-09Merge #18363: tests: Add fuzzing harness for HTTPRequest, libevent's evhttp ↵MarcoFalke
and related functions cdfb8e7afa7648405dd6b957f47b1c7ab566a076 tests: Add fuzzing harness for HTTPRequest, libevent's evhttp and related functions (practicalswift) Pull request description: Add fuzzing harness for `HTTPRequest`, `libevent`'s `evhttp` and related functions. ACKs for top commit: laanwj: ACK cdfb8e7afa7648405dd6b957f47b1c7ab566a076 Tree-SHA512: da481afed5eb3232d3f3d0583094e56050e6234223dfcb356d8567fe0616336eb1b78c5e6821325fc9767e385e5dfaf3c96f0d35ffdb67f18d74f9a9a9464e24
2020-04-09Merge #18521: fuzz: Add process_messages harnessMarcoFalke
fa6a00843447d53a5708ea3a629b9150cfe58be2 fuzz: Add process_messages harness (MarcoFalke) Pull request description: ACKs for top commit: practicalswift: Tested ACK fa6a00843447d53a5708ea3a629b9150cfe58be2 Tree-SHA512: 2d8788308c7f45c97ca003378f58a9d51f51265958557a65e5e505b1666b4cb928f0d010622870175090a0ad25e2d10b41f26f4eef14b6ff334a024baa250f8c
2020-04-09Merge #18533: scripted-diff: Replace strCommand with msg_typeMarcoFalke
7777e3624fabe4718675b2be8b088697b7ad4d0d scripted-diff: Replace strCommand with msg_type (MarcoFalke) Pull request description: Receiving a message is not a command, but simply a message of some type ACKs for top commit: promag: ACK 7777e3624fabe4718675b2be8b088697b7ad4d0d. naumenkogs: ACK 7777e36 practicalswift: ACK 7777e3624fabe4718675b2be8b088697b7ad4d0d -- I've always thought the `strCommand` name is confusing :) theStack: ACK 7777e36 Tree-SHA512: 662bac579064c621191916274314b85111cfb4df488f00893ceb16def1c47af4b2a0f34cd7349722099b5a9d23160edb8eb999841f1d64af3e0da02e4870b4bf
2020-04-08tests: Add coverage of {,Incremental}DynamicUsage(const std::set<X, Y>& s) ↵practicalswift
to existing fuzzer
2020-04-08tests: Add fuzzing harness for classes/functions in cuckoocache.hpracticalswift
2020-04-08tests: Add fuzzing harness for classes/functions in checkqueue.hpracticalswift
generated by cgit v1.2.3 (git 2.26.2) at 2024-10-15 19:35:08 +0000