From f898ef65c947776750e49d050633f830546bbdc6 Mon Sep 17 00:00:00 2001
From: practicalswift <practicalswift@users.noreply.github.com>
Date: Sat, 16 May 2020 18:20:39 +0000
Subject: tests: Add fuzzing harness for functions in script/sign.h

---
 src/Makefile.test.include     |   7 ++
 src/test/fuzz/script_sign.cpp | 149 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 156 insertions(+)
 create mode 100644 src/test/fuzz/script_sign.cpp

(limited to 'src')

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 7f2c6b6c91..7909cb4a0f 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -117,6 +117,7 @@ FUZZ_TARGETS = \
   test/fuzz/script_interpreter \
   test/fuzz/script_ops \
   test/fuzz/script_sigcache \
+  test/fuzz/script_sign \
   test/fuzz/scriptnum_ops \
   test/fuzz/service_deserialize \
   test/fuzz/signature_checker \
@@ -987,6 +988,12 @@ test_fuzz_script_sigcache_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_script_sigcache_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
 test_fuzz_script_sigcache_SOURCES = test/fuzz/script_sigcache.cpp
 
+test_fuzz_script_sign_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_script_sign_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_script_sign_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_script_sign_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
+test_fuzz_script_sign_SOURCES = test/fuzz/script_sign.cpp
+
 test_fuzz_scriptnum_ops_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
 test_fuzz_scriptnum_ops_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_scriptnum_ops_LDADD = $(FUZZ_SUITE_LD_COMMON)
diff --git a/src/test/fuzz/script_sign.cpp b/src/test/fuzz/script_sign.cpp
new file mode 100644
index 0000000000..c626f950e7
--- /dev/null
+++ b/src/test/fuzz/script_sign.cpp
@@ -0,0 +1,149 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <chainparams.h>
+#include <chainparamsbase.h>
+#include <key.h>
+#include <pubkey.h>
+#include <script/keyorigin.h>
+#include <script/sign.h>
+#include <script/signingprovider.h>
+#include <streams.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cassert>
+#include <cstdint>
+#include <iostream>
+#include <map>
+#include <optional>
+#include <string>
+#include <vector>
+
+void initialize()
+{
+    static const ECCVerifyHandle ecc_verify_handle;
+    ECC_Start();
+    SelectParams(CBaseChainParams::REGTEST);
+}
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    const std::vector<uint8_t> key = ConsumeRandomLengthByteVector(fuzzed_data_provider, 128);
+
+    {
+        CDataStream random_data_stream = ConsumeDataStream(fuzzed_data_provider);
+        std::map<CPubKey, KeyOriginInfo> hd_keypaths;
+        try {
+            DeserializeHDKeypaths(random_data_stream, key, hd_keypaths);
+        } catch (const std::ios_base::failure&) {
+        }
+        CDataStream serialized{SER_NETWORK, PROTOCOL_VERSION};
+        SerializeHDKeypaths(serialized, hd_keypaths, fuzzed_data_provider.ConsumeIntegral<uint8_t>());
+    }
+
+    {
+        std::map<CPubKey, KeyOriginInfo> hd_keypaths;
+        while (fuzzed_data_provider.ConsumeBool()) {
+            const std::optional<CPubKey> pub_key = ConsumeDeserializable<CPubKey>(fuzzed_data_provider);
+            if (!pub_key) {
+                break;
+            }
+            const std::optional<KeyOriginInfo> key_origin_info = ConsumeDeserializable<KeyOriginInfo>(fuzzed_data_provider);
+            if (!key_origin_info) {
+                break;
+            }
+            hd_keypaths[*pub_key] = *key_origin_info;
+        }
+        CDataStream serialized{SER_NETWORK, PROTOCOL_VERSION};
+        try {
+            SerializeHDKeypaths(serialized, hd_keypaths, fuzzed_data_provider.ConsumeIntegral<uint8_t>());
+        } catch (const std::ios_base::failure&) {
+        }
+        std::map<CPubKey, KeyOriginInfo> deserialized_hd_keypaths;
+        try {
+            DeserializeHDKeypaths(serialized, key, hd_keypaths);
+        } catch (const std::ios_base::failure&) {
+        }
+        assert(hd_keypaths.size() >= deserialized_hd_keypaths.size());
+    }
+
+    {
+        SignatureData signature_data_1{ConsumeScript(fuzzed_data_provider)};
+        SignatureData signature_data_2{ConsumeScript(fuzzed_data_provider)};
+        signature_data_1.MergeSignatureData(signature_data_2);
+    }
+
+    FillableSigningProvider provider;
+    CKey k;
+    const std::vector<uint8_t> key_data = ConsumeRandomLengthByteVector(fuzzed_data_provider);
+    k.Set(key_data.begin(), key_data.end(), fuzzed_data_provider.ConsumeBool());
+    if (k.IsValid()) {
+        provider.AddKey(k);
+    }
+
+    {
+        const std::optional<CMutableTransaction> mutable_transaction = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
+        const std::optional<CTxOut> tx_out = ConsumeDeserializable<CTxOut>(fuzzed_data_provider);
+        const unsigned int n_in = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
+        if (mutable_transaction && tx_out && mutable_transaction->vin.size() > n_in) {
+            SignatureData signature_data_1 = DataFromTransaction(*mutable_transaction, n_in, *tx_out);
+            CTxIn input;
+            UpdateInput(input, signature_data_1);
+            const CScript script = ConsumeScript(fuzzed_data_provider);
+            SignatureData signature_data_2{script};
+            signature_data_1.MergeSignatureData(signature_data_2);
+        }
+        if (mutable_transaction) {
+            CTransaction tx_from{*mutable_transaction};
+            CMutableTransaction tx_to;
+            const std::optional<CMutableTransaction> opt_tx_to = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
+            if (opt_tx_to) {
+                tx_to = *opt_tx_to;
+            }
+            CMutableTransaction script_tx_to = tx_to;
+            CMutableTransaction sign_transaction_tx_to = tx_to;
+            if (n_in < tx_to.vin.size() && tx_to.vin[n_in].prevout.n < tx_from.vout.size()) {
+                (void)SignSignature(provider, tx_from, tx_to, n_in, fuzzed_data_provider.ConsumeIntegral<int>());
+            }
+            if (n_in < script_tx_to.vin.size()) {
+                (void)SignSignature(provider, ConsumeScript(fuzzed_data_provider), script_tx_to, n_in, ConsumeMoney(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<int>());
+                MutableTransactionSignatureCreator signature_creator{&tx_to, n_in, ConsumeMoney(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<int>()};
+                std::vector<unsigned char> vch_sig;
+                CKeyID address;
+                if (fuzzed_data_provider.ConsumeBool()) {
+                    if (k.IsValid()) {
+                        address = k.GetPubKey().GetID();
+                    }
+                } else {
+                    address = CKeyID{ConsumeUInt160(fuzzed_data_provider)};
+                }
+                (void)signature_creator.CreateSig(provider, vch_sig, address, ConsumeScript(fuzzed_data_provider), fuzzed_data_provider.PickValueInArray({SigVersion::BASE, SigVersion::WITNESS_V0}));
+            }
+            std::map<COutPoint, Coin> coins;
+            while (fuzzed_data_provider.ConsumeBool()) {
+                const std::optional<COutPoint> outpoint = ConsumeDeserializable<COutPoint>(fuzzed_data_provider);
+                if (!outpoint) {
+                    break;
+                }
+                const std::optional<Coin> coin = ConsumeDeserializable<Coin>(fuzzed_data_provider);
+                if (!coin) {
+                    break;
+                }
+                coins[*outpoint] = *coin;
+            }
+            std::map<int, std::string> input_errors;
+            (void)SignTransaction(sign_transaction_tx_to, &provider, coins, fuzzed_data_provider.ConsumeIntegral<int>(), input_errors);
+        }
+    }
+
+    {
+        SignatureData signature_data_1;
+        (void)ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_1);
+        SignatureData signature_data_2;
+        (void)ProduceSignature(provider, DUMMY_MAXIMUM_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_2);
+    }
+}
-- 
cgit v1.2.3