1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
// Copyright (c) 2009-2021 The Bitcoin Core developers
// Distributed under the MIT software license, see the accompanying
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
#include <consensus/amount.h>
#include <primitives/transaction.h>
#include <script/interpreter.h>
#include <serialize.h>
#include <streams.h>
#include <test/fuzz/fuzz.h>
#include <test/util/script.h>
#include <cassert>
#include <ios>
#include <utility>
#include <vector>
FUZZ_TARGET(script_flags)
{
if (buffer.size() > 100'000) return;
DataStream ds{buffer};
try {
const CTransaction tx(deserialize, TX_WITH_WITNESS, ds);
unsigned int verify_flags;
ds >> verify_flags;
if (!IsValidFlagCombination(verify_flags)) return;
unsigned int fuzzed_flags;
ds >> fuzzed_flags;
std::vector<CTxOut> spent_outputs;
for (unsigned i = 0; i < tx.vin.size(); ++i) {
CTxOut prevout;
ds >> prevout;
if (!MoneyRange(prevout.nValue)) {
// prevouts should be consensus-valid
prevout.nValue = 1;
}
spent_outputs.push_back(prevout);
}
PrecomputedTransactionData txdata;
txdata.Init(tx, std::move(spent_outputs));
for (unsigned i = 0; i < tx.vin.size(); ++i) {
const CTxOut& prevout = txdata.m_spent_outputs.at(i);
const TransactionSignatureChecker checker{&tx, i, prevout.nValue, txdata, MissingDataBehavior::ASSERT_FAIL};
ScriptError serror;
const bool ret = VerifyScript(tx.vin.at(i).scriptSig, prevout.scriptPubKey, &tx.vin.at(i).scriptWitness, verify_flags, checker, &serror);
assert(ret == (serror == SCRIPT_ERR_OK));
// Verify that removing flags from a passing test or adding flags to a failing test does not change the result
if (ret) {
verify_flags &= ~fuzzed_flags;
} else {
verify_flags |= fuzzed_flags;
}
if (!IsValidFlagCombination(verify_flags)) return;
ScriptError serror_fuzzed;
const bool ret_fuzzed = VerifyScript(tx.vin.at(i).scriptSig, prevout.scriptPubKey, &tx.vin.at(i).scriptWitness, verify_flags, checker, &serror_fuzzed);
assert(ret_fuzzed == (serror_fuzzed == SCRIPT_ERR_OK));
assert(ret_fuzzed == ret);
}
} catch (const std::ios_base::failure&) {
return;
}
}
|
