|
7 | 7 | #include <test/fuzz/FuzzedDataProvider.h> |
8 | 8 | #include <test/fuzz/fuzz.h> |
9 | 9 | #include <test/fuzz/util.h> |
| 10 | +#include <util/check.h> |
10 | 11 |
|
11 | 12 | #include <cstdint> |
12 | 13 | #include <optional> |
@@ -45,3 +46,27 @@ FUZZ_TARGET(script_interpreter) |
45 | 46 | (void)CastToBool(ConsumeRandomLengthByteVector(fuzzed_data_provider)); |
46 | 47 | } |
47 | 48 | } |
| 49 | + |
| 50 | +/** Differential fuzzing for SignatureHash with and without cache. */ |
| 51 | +FUZZ_TARGET(sighash_cache) |
| 52 | +{ |
| 53 | + FuzzedDataProvider provider(buffer.data(), buffer.size()); |
| 54 | + |
| 55 | + // Get inputs to the sighash function that won't change across types. |
| 56 | + const auto scriptcode{ConsumeScript(provider)}; |
| 57 | + const auto tx{ConsumeTransaction(provider, std::nullopt)}; |
| 58 | + if (tx.vin.empty()) return; |
| 59 | + const auto in_index{provider.ConsumeIntegralInRange<uint32_t>(0, tx.vin.size() - 1)}; |
| 60 | + const auto amount{ConsumeMoney(provider)}; |
| 61 | + const auto sigversion{(SigVersion)provider.ConsumeIntegralInRange(0, 1)}; |
| 62 | + |
| 63 | + // Check the sighash function will give the same result for 100 fuzzer-generated hash types whether or not a cache is |
| 64 | + // provided. The cache is conserved across types to exercise cache hits. |
| 65 | + SigHashCache sighash_cache{}; |
| 66 | + for (int i{0}; i < 100; ++i) { |
| 67 | + const auto hash_type{((i & 2) == 0) ? provider.ConsumeIntegral<int8_t>() : provider.ConsumeIntegral<int32_t>()}; |
| 68 | + const auto nocache_res{SignatureHash(scriptcode, tx, in_index, hash_type, amount, sigversion)}; |
| 69 | + const auto cache_res{SignatureHash(scriptcode, tx, in_index, hash_type, amount, sigversion, nullptr, &sighash_cache)}; |
| 70 | + Assert(nocache_res == cache_res); |
| 71 | + } |
| 72 | +} |
0 commit comments