-
Notifications
You must be signed in to change notification settings - Fork 38.8k
fuzz: add missing ECCVerifyHandle to base_encode_decode #22279
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
+6
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Good catch! Thanks! cr ACK 906d791 If you have time, consider adding this coverage increasing input to the seed corpus over at https://github.com/bitcoin-core/qa-assets :) |
sidhujag
pushed a commit
to syscoin/syscoin
that referenced
this pull request
Jun 20, 2021
…_decode 906d791 fuzz: add missing ECCVerifyHandle to base_encode_decode (Andrew Poelstra) Pull request description: It is possible to trigger a fuzztest failure in the `base_encode_decode` by asking it to decode any PSBT that has HD keypaths in it. For example, this one ``` cHNidP8BAFUCAAAAASeaIyOl37UfxF8iD6WLD8E+HjNCeSqF1+Ns1jM7XLw5AAAAAAD/////AaBa6gsAAAAAGXapFP/pwAYQl8w7Y28ssEYPpPxCfStFiKwAAAAAAAEBIJVe6gsAAAAAF6kUY0UgD2jRieGtwN8cTRbqjxTA2+uHIgIDsTQcy6doO2r08SOM1ul+cWfVafrEfx5I1HVBhENVvUZGMEMCIAQktY7/qqaU4VWepck7v9SokGQiQFXN8HC2dxRpRC0HAh9cjrD+plFtYLisszrWTt5g6Hhb+zqpS5m9+GFR25qaAQEEIgAgdx/RitRZZm3Unz1WTj28QvTIR3TjYK2haBao7UiNVoEBBUdSIQOxNBzLp2g7avTxI4zW6X5xZ9Vp+sR/HkjUdUGEQ1W9RiED3lXR4drIBeP4pYwfv5uUwC89uq/hJ/78pJlfJvggg71SriIGA7E0HMunaDtq9PEjjNbpfnFn1Wn6xH8eSNR1QYRDVb1GELSmumcAAACAAAAAgAQAAIAiBgPeVdHh2sgF4/iljB+/m5TALz26r+En/vykmV8m+CCDvRC0prpnAAAAgAAAAIAFAACAAAA= ``` which I took straight from the PSBT test vectors. The reason is that in src/psbt.h we call `DeserializeHDKeypaths`, which in turn calls `CPubKey::IsFullyValid`, which in turn asserts that a secp context has been created. The error appears to be masked on many systems by the definition of `instance_of_eccryptoclosure` in src/script/bitcoinconsensus.cpp, which defines a static object which contains an `ECCVerifyHandle`. If you just comment out that line you can reliably trigger the fuzz test failure, e.g. by creating a file `crash` with the above PSBT, and runnnig ``` ASAN_OPTIONS=symbolize=0:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1 UBSAN_OPTIONS=suppressions=./test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1 FUZZ=base_encode_decode ./src/test/fuzz/fuzz -seed_inputs=crash ``` ACKs for top commit: practicalswift: cr ACK 906d791 Tree-SHA512: b98b60573c21efe28503fe351883c6f0d9ac99d0dd6f100537b16ac53476617b8a3f899faf0c23d893d34a01b3bbe4a784499ec6f9c7000292e850bed449bd85
fanquake
pushed a commit
to fanquake/bitcoin
that referenced
this pull request
Jun 29, 2021
GitHub Pull: bitcoin#22279 Rebased-From: 906d791
Member
|
Backported to 0.21 in #22366. |
luke-jr
pushed a commit
to bitcoinknots/bitcoin
that referenced
this pull request
Jun 29, 2021
GitHub Pull: bitcoin#22279 Rebased-From: 906d791
stevenroose
added a commit
to ElementsProject/elements
that referenced
this pull request
Jul 1, 2021
0896d0a util: Properly handle -noincludeconf on command line (MarcoFalke) 5f18d33 Cleanup -includeconf error message (MarcoFalke) 99b8659 Fix crash when parsing command line with -noincludeconf=0 (MarcoFalke) c98902b fuzz: add missing ECCVerifyHandle to base_encode_decode (Andrew Poelstra) Pull request description: Backport of bitcoin/bitcoin#22279 and bitcoin/bitcoin#22002 and bitcoin/bitcoin#22137 ACKs for top commit: jonasnick: utACK 0896d0a Tree-SHA512: 7a9c4a20fc51ac3e66fd0b8d6f28200b9342774fcb003c561e277fab4a68c3ebd2cab4c3081170199a51aabf3956e0f7248fa6c853c8aa971645fb9039adc688
fanquake
added a commit
that referenced
this pull request
Jul 8, 2021
…_decode da81624 util: Properly handle -noincludeconf on command line (MarcoFalke) 513613d Cleanup -includeconf error message (MarcoFalke) 70eac6f Fix crash when parsing command line with -noincludeconf=0 (MarcoFalke) c5357fa fuzz: add missing ECCVerifyHandle to base_encode_decode (Andrew Poelstra) Pull request description: Backports #22279, #22002 and #22137 to fix fuzzing issues in the 0.21 branch: https://github.com/bitcoin/bitcoin/runs/2864012729. ACKs for top commit: achow101: ACK da81624 Tree-SHA512: ab8751387e42e03ff43594ae34be8ed0dba903d7da1aaecb9f19c08366570d8995abe89ba0c9bafe37662940f3e83bef1e9e50f330e86114cd6a773becd1fd21
gwillen
pushed a commit
to ElementsProject/elements
that referenced
this pull request
Jun 1, 2022
Took the non-backported version of base_encode_decode from bitcoin/bitcoin#22279
gwillen
pushed a commit
to ElementsProject/elements
that referenced
this pull request
Jun 1, 2022
Hey look, it's one of mine, from this rebase :)
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It is possible to trigger a fuzztest failure in the
base_encode_decodeby asking it to decode any PSBT that has HD keypaths in it. For example, this onewhich I took straight from the PSBT test vectors. The reason is that in src/psbt.h we call
DeserializeHDKeypaths, which in turn callsCPubKey::IsFullyValid, which in turn asserts that a secp context has been created.The error appears to be masked on many systems by the definition of
instance_of_eccryptoclosurein src/script/bitcoinconsensus.cpp, which defines a static object which contains anECCVerifyHandle. If you just comment out that line you can reliably trigger the fuzz test failure, e.g. by creating a filecrashwith the above PSBT, and runnnig