https://drahtbot.space/host_reports/DrahtBot/reports/coverage_fuzz/MarcoFalke/bitcoin-core/fa4234d877ea3193/fuzz.coverage/src/net_processing.cpp.gcov.html

Concept ACK

FWIW this is functionally equivalent to the local fuzzing harness modification that allowed me to find the recent wtxid crash bug. A vulnerability which luckily didn't make it to any release :)

@practicalswift Mind reviewing this? Without this, it is not possible to get meaningful coverage in net_processing. Also, I have more patches on top that increase coverage, which are blocked on this one.

@MarcoFalke Yes, of course: my plan is to code review this one and verify that it finds the recent wtxid crash bug today or tomorrow at latest :)

Mutual review beg: Please consider reviewing the fuzzing PRs #19065 (May), #19203 (June), #19259 (June), #19288 (June), #19415 (June), #19972 (September) and #20188 (October) :)

I urge anyone interested in increasing fuzzing coverage to review MarcoFalke's #20332 (this PR) and the fuzzers above: I want the fuzzing coverage to break the current plateau where we've resided at during the last few months. Let's get the fuzzing momentum moving again! :) 🚀

Tested ACK fa4234d

With this modification the fuzzer was able to find the recent wtxid crash bug (not part of any release luckily!) within a.) one minute if seeded with the Bitcoin Core qa-assets seed corpus, and b.) three hours if seeded from thin air (empty corpus). Thanks for fixing this!

Really nice to see the fuzzers catch real issues long before they have a chance to make it to a release.

<wish list>
Now we only need something like OSS-Fuzz' CIFuzz (fuzzing of open PR:s) to catch issues like this before merge. OSS-Fuzz is open source in the form of ClusterFuzz. I hope that some day we'll have a dedicated Bitcoin Core private ClusterFuzz installation where the security team would have immediate access to crash cases.

CI-Fuzz: "OSS-Fuzz offers CIFuzz, a GitHub action/CI job that runs your fuzz targets on pull requests. This works similarly to running unit tests in CI. CIFuzz helps you find and fix bugs before they make it into your codebase. Currently, CIFuzz only supports projects hosted on GitHub."

ClusterFuzz: "ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz."
</wish list>