Skip to content

Conversation

@practicalswift
Copy link
Contributor

Add fuzzing harness for classes/functions in blockfilter.h.

Add integer serialization/deserialization fuzzing harness.

@fanquake fanquake added the Tests label Mar 24, 2020
@DrahtBot
Copy link
Contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Conflicts

Reviewers, this pull request conflicts with the following ones:

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

(void)gcs_filter.GetEncoded();
(void)gcs_filter.Match(ConsumeRandomLengthByteVector(fuzzed_data_provider));
GCSFilter::ElementSet element_set;
while (fuzzed_data_provider.ConsumeBool()) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why does this need to be consumed? It seems the only purpose of the consumed bool is to exit early. The same can be achieved by the fuzz engine by just not providing any further input. So shouldn't the condition here be fuzzed_data_provider.remaining_bytes()?

Copy link
Contributor Author

@practicalswift practicalswift Mar 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, using if (fuzzed_data_provider.remaining_bytes()) { is possible but that would render the seed corpus invalid if we add input consuming code to be fuzzed in blockfilter.cpp going forward.

Using if (fuzzed_data_provider.ConsumeBool()) { instead avoids that problem: we can add code to be fuzzed that consumes input without invalidating the existing seed corpus.

Invalidating in this context means changing the fuzzing coverage for a given input file.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please note that fuzzed_data_provider.ConsumeBool() will return false if fuzzed_data_provider.remaining_bytes() == 0.

@maflcko maflcko merged commit 3f5107d into bitcoin:master Mar 25, 2020
Fabcien pushed a commit to Bitcoin-ABC/bitcoin-abc that referenced this pull request Jan 20, 2021
…d integer {de,}serialization fuzzing.

Summary:
```
Add fuzzing harness for classes/functions in blockfilter.h.

Add integer serialization/deserialization fuzzing harness.
```

Backport of core [[bitcoin/bitcoin#18423 | PR18423]].

Depends on D8967.

Test Plan:
  ninja bitcoin-fuzzers
  ./test/fuzz/test_runner.py <path_to_corpus>

Reviewers: #bitcoin_abc, PiRK

Reviewed By: #bitcoin_abc, PiRK

Differential Revision: https://reviews.bitcoinabc.org/D8970
@practicalswift practicalswift deleted the fuzzers-misc-2 branch April 10, 2021 19:40
kwvg added a commit to kwvg/dash that referenced this pull request Jul 6, 2022
…ckfilter.h. Add integer {de,}serialization fuzzing
@bitcoin bitcoin locked as resolved and limited conversation to collaborators Aug 18, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants