-
Notifications
You must be signed in to change notification settings - Fork 38.7k
tests: Add fuzzing harness for classes/functions in blockfilter.h. Add integer {de,}serialization fuzzing. #18423
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers. ConflictsReviewers, this pull request conflicts with the following ones:
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first. |
| (void)gcs_filter.GetEncoded(); | ||
| (void)gcs_filter.Match(ConsumeRandomLengthByteVector(fuzzed_data_provider)); | ||
| GCSFilter::ElementSet element_set; | ||
| while (fuzzed_data_provider.ConsumeBool()) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why does this need to be consumed? It seems the only purpose of the consumed bool is to exit early. The same can be achieved by the fuzz engine by just not providing any further input. So shouldn't the condition here be fuzzed_data_provider.remaining_bytes()?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, using if (fuzzed_data_provider.remaining_bytes()) { is possible but that would render the seed corpus invalid if we add input consuming code to be fuzzed in blockfilter.cpp going forward.
Using if (fuzzed_data_provider.ConsumeBool()) { instead avoids that problem: we can add code to be fuzzed that consumes input without invalidating the existing seed corpus.
Invalidating in this context means changing the fuzzing coverage for a given input file.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please note that fuzzed_data_provider.ConsumeBool() will return false if fuzzed_data_provider.remaining_bytes() == 0.
…d integer {de,}serialization fuzzing.
Summary:
```
Add fuzzing harness for classes/functions in blockfilter.h.
Add integer serialization/deserialization fuzzing harness.
```
Backport of core [[bitcoin/bitcoin#18423 | PR18423]].
Depends on D8967.
Test Plan:
ninja bitcoin-fuzzers
./test/fuzz/test_runner.py <path_to_corpus>
Reviewers: #bitcoin_abc, PiRK
Reviewed By: #bitcoin_abc, PiRK
Differential Revision: https://reviews.bitcoinabc.org/D8970
…ckfilter.h. Add integer {de,}serialization fuzzing
backport: bitcoin#18417, bitcoin#18521, bitcoin#18529, bitcoin#18176, bitcoin#18423, bitcoin#17926, bitcoin#18353, bitcoin#18407, bitcoin#18455, bitcoin#18565, bitcoin#18867 (fuzzing harness backports: part 2)
Add fuzzing harness for classes/functions in
blockfilter.h.Add integer serialization/deserialization fuzzing harness.