tests: Add EvalScript(...) fuzzing harness #17009

pull practicalswift wants to merge 2 commits into bitcoin:master from practicalswift:eval_script changing 5 files +286 −3
  1. practicalswift commented at 9:43 AM on October 1, 2019: contributor

    Add EvalScript(...) fuzzing harness.

    To test this PR:

    We can run contrib/devtools/test_fuzzing_harnesses.sh (#17000) during five seconds to quickly verify that the newly added fuzz harness seem to hit relevant code regions, that the fuzzing throughput seems reasonable, etc.

    test_fuzzing_harnesses.sh eval 5 runs all fuzzers matching the regexp eval giving them five seconds of runtime each.

    $ CC=clang CXX=clang++ ./configure --enable-fuzz --with-sanitizers=address,fuzzer,undefined
$ make
$ contrib/devtools/test_fuzzing_harnesses.sh eval 5
Testing fuzzer eval_script during 5 second(s)
A subset of reached functions:
        NEW_FUNC[1/24]: 0x557b808742e0 in prevector<28u, unsigned char, unsigned int, int>::indirect_ptr(int) src/./prevector.h:161
        NEW_FUNC[2/24]: 0x557b80875460 in prevector<28u, unsigned char, unsigned int, int>::indirect_ptr(int) const src/./prevector.h:162
        NEW_FUNC[6/9]: 0x557b81acdaa0 in popstack(std::vector<std::vector<unsigned char, std::allocator<unsigned char> >, std::allocator<std::vector<unsigned char, std::allocator<unsigned char> > > >&) src/script/interpreter.cpp:57
        NEW_FUNC[5/16]: 0x557b809f1bf0 in CScriptNum::serialize(long const&) src/./script/script.h:326
        NEW_FUNC[4/6]: 0x557b817c93d0 in CScriptNum::CScriptNum(std::vector<unsigned char, std::allocator<unsigned char> > const&, bool, unsigned long) src/./script/script.h:225
        NEW_FUNC[5/6]: 0x557b817cbb80 in CScriptNum::set_vch(std::vector<unsigned char, std::allocator<unsigned char> > const&) src/./script/script.h:360
        NEW_FUNC[0/11]: 0x557b80a88170 in CHash256::Write(unsigned char const*, unsigned long) src/./hash.h:34
        NEW_FUNC[1/11]: 0x557b80a88270 in CHash256::Finalize(unsigned char*) src/./hash.h:28
        NEW_FUNC[5/11]: 0x557b81affdb0 in CSHA256::CSHA256() src/crypto/sha256.cpp:644
        NEW_FUNC[6/11]: 0x557b81affe80 in (anonymous namespace)::sha256::Initialize(unsigned int*) src/crypto/sha256.cpp:66
        NEW_FUNC[7/11]: 0x557b81b00460 in CSHA256::Write(unsigned char const*, unsigned long) src/crypto/sha256.cpp:649
        NEW_FUNC[8/11]: 0x557b81b009a0 in CSHA256::Finalize(unsigned char*) src/crypto/sha256.cpp:675
        NEW_FUNC[9/11]: 0x557b81b015e0 in CSHA256::Reset() src/crypto/sha256.cpp:692
        NEW_FUNC[10/11]: 0x557b81b01d90 in (anonymous namespace)::sha256::Transform(unsigned int*, unsigned char const*, unsigned long) src/crypto/sha256.cpp:79
        NEW_FUNC[0/1]: 0x557b808cc180 in BaseSignatureChecker::CheckLockTime(CScriptNum const&) const src/./script/interpreter.h:153
        NEW_FUNC[0/2]: 0x557b81ab5640 in CastToBool(std::vector<unsigned char, std::allocator<unsigned char> > const&) src/script/interpreter.cpp:36
        NEW_FUNC[0/1]: 0x557b817c9c30 in CScriptNum::getint() const src/./script/script.h:312
        NEW_FUNC[0/1]: 0x557b81ae1df0 in CScriptNum::operator-=(long const&) src/./script/script.h:298
        NEW_FUNC[0/5]: 0x557b81af5670 in CRIPEMD160::CRIPEMD160() src/crypto/ripemd160.cpp:243
        NEW_FUNC[1/5]: 0x557b81af5740 in (anonymous namespace)::ripemd160::Initialize(unsigned int*) src/crypto/ripemd160.cpp:25
        NEW_FUNC[2/5]: 0x557b81af5b00 in CRIPEMD160::Write(unsigned char const*, unsigned long) src/crypto/ripemd160.cpp:248
        NEW_FUNC[3/5]: 0x557b81af5fa0 in (anonymous namespace)::ripemd160::Transform(unsigned int*, unsigned char const*) src/crypto/ripemd160.cpp:55
        NEW_FUNC[4/5]: 0x557b81af8d60 in CRIPEMD160::Finalize(unsigned char*) src/crypto/ripemd160.cpp:274
        NEW_FUNC[0/16]: 0x557b80857a30 in CScript::operator<<(std::vector<unsigned char, std::allocator<unsigned char> > const&) src/./script/script.h:462
        NEW_FUNC[1/16]: 0x557b80872670 in prevector<28u, unsigned char, unsigned int, int>::insert(prevector<28u, unsigned char, unsigned int, int>::iterator, unsigned char const&) src/./prevector.h:342
        NEW_FUNC[2/16]: 0x557b80872e00 in void prevector<28u, unsigned char, unsigned int, int>::insert<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > > >(prevector<28u, unsigned char, unsigned int, int>::iterator, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >) src/./prevector.h:368
        NEW_FUNC[3/16]: 0x557b80873630 in prevector<28u, unsigned char, unsigned int, int>::capacity() const src/./prevector.h:295
        NEW_FUNC[4/16]: 0x557b80874ed0 in void prevector<28u, unsigned char, unsigned int, int>::fill<prevector<28u, unsigned char, unsigned int, int>::const_iterator>(unsigned char*, prevector<28u, unsigned char, unsigned int, int>::const_iterator, prevector<28u, unsigned char, unsigned int, int>::const_iterator) src/./prevector.h:204
        NEW_FUNC[5/16]: 0x557b808cc0f0 in BaseSignatureChecker::CheckSig(std::vector<unsigned char, std::allocator<unsigned char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&, CScript const&, SigVersion) const src/./script/interpreter.h:148
        NEW_FUNC[6/16]: 0x557b809edb10 in CScript::operator=(CScript&&) src/./script/script.h:390
        NEW_FUNC[7/16]: 0x557b809f8ec0 in void prevector<28u, unsigned char, unsigned int, int>::insert<prevector<28u, unsigned char, unsigned int, int>::const_iterator>(prevector<28u, unsigned char, unsigned int, int>::iterator, prevector<28u, unsigned char, unsigned int, int>::const_iterator, prevector<28u, unsigned char, unsigned int, int>::const_iterator) src/./prevector.h:368
        NEW_FUNC[8/16]: 0x557b809f9260 in prevector<28u, unsigned char, unsigned int, int>::swap(prevector<28u, unsigned char, unsigned int, int>&) src/./prevector.h:451
        NEW_FUNC[9/16]: 0x557b81ab58c0 in CheckSignatureEncoding(std::vector<unsigned char, std::allocator<unsigned char> > const&, unsigned int, ScriptError_t*) src/script/interpreter.cpp:200
        NEW_FUNC[10/16]: 0x557b81ab6f30 in FindAndDelete(CScript&, CScript const&) src/script/interpreter.cpp:254
        NEW_FUNC[11/16]: 0x557b81acdc20 in CheckPubKeyEncoding(std::vector<unsigned char, std::allocator<unsigned char> > const&, unsigned int, SigVersion const&, ScriptError_t*) src/script/interpreter.cpp:217
        NEW_FUNC[12/16]: 0x557b81ad3890 in IsCompressedOrUncompressedPubKey(std::vector<unsigned char, std::allocator<unsigned char> > const&) src/script/interpreter.cpp:63
        NEW_FUNC[13/16]: 0x557b81ad8830 in CScript::GetOp(prevector<28u, unsigned char, unsigned int, int>::const_iterator&, opcodetype&) const src/./script/script.h:505
        NEW_FUNC[14/16]: 0x557b81ae21a0 in prevector<28u, unsigned char, unsigned int, int>::prevector<prevector<28u, unsigned char, unsigned int, int>::const_iterator>(prevector<28u, unsigned char, unsigned int, int>::const_iterator, prevector<28u, unsigned char, unsigned int, int>::const_iterator) src/./prevector.h:246
        NEW_FUNC[0/1]: 0x557b81ae1a40 in CScriptNum::operator+=(long const&) src/./script/script.h:290
        NEW_FUNC[0/5]: 0x557b81af9760 in CSHA1::CSHA1() src/crypto/sha1.cpp:150
        NEW_FUNC[1/5]: 0x557b81af9830 in (anonymous namespace)::sha1::Initialize(unsigned int*) src/crypto/sha1.cpp:32
        NEW_FUNC[2/5]: 0x557b81af9bf0 in CSHA1::Write(unsigned char const*, unsigned long) src/crypto/sha1.cpp:155
        NEW_FUNC[3/5]: 0x557b81afa090 in (anonymous namespace)::sha1::Transform(unsigned int*, unsigned char const*) src/crypto/sha1.cpp:47
        NEW_FUNC[4/5]: 0x557b81afc5e0 in CSHA1::Finalize(unsigned char*) src/crypto/sha1.cpp:181
        NEW_FUNC[0/1]: 0x557b81ada4f0 in CScriptNum::operator-() const src/./script/script.h:278
        NEW_FUNC[0/1]: 0x557b808cc210 in BaseSignatureChecker::CheckSequence(CScriptNum const&) const src/./script/interpreter.h:158
        NEW_FUNC[0/1]: 0x557b81ab5c00 in IsValidSignatureEncoding(std::vector<unsigned char, std::allocator<unsigned char> > const&) src/script/interpreter.cpp:107
stat::number_of_executed_units: 9728
stat::average_exec_per_sec:     1621
stat::new_units_added:          844
stat::slowest_unit_time_sec:    0
stat::peak_rss_mb:              326
Number of unique code paths taken during fuzzing round: 583

Tested fuzz harnesses seem to work as expected.
  2. fanquake added the label Tests on Oct 1, 2019
  3. laanwj commented at 10:12 AM on October 1, 2019: member

    Concept ACK

  4. practicalswift force-pushed on Oct 1, 2019
  5. in src/test/fuzz/fuzz.h:12 in 6b05d03ea6 outdated 
       8 | @@ -9,6 +9,6 @@
   9 |  #include <vector>
  10 |  
  11 |  
  12 | -void test_one_input(std::vector<uint8_t> buffer);
  13 | +void test_one_input(const std::vector<uint8_t>& buffer);
    MarcoFalke commented at 12:39 PM on October 1, 2019:

    Looks fine to do this change, even if we were to switch to a different class (like https://cs.chromium.org/chromium/src/third_party/libFuzzer/src/utils/FuzzedDataProvider.h?rcl=b9f51dc8c98065df0c8da13c051046f5bab833db), the input data remains read-only.

    practicalswift commented at 3:25 PM on October 1, 2019:

    Yes, fuzzing inputs are passed read-only by convention for all in-process fuzzers I've ever used. And FuzzedDataProvider is great :)

    MarcoFalke commented at 1:30 PM on October 4, 2019:

    Could split up this commit, so that other pull request don't conflict with this one?

    MarcoFalke commented at 3:28 PM on October 4, 2019:

    @practicalswift ^ ;)

    practicalswift commented at 8:35 AM on October 7, 2019:

    I've now moved this change to a separate PR to make this PR non-conflicting with others. I hope that was the correct reading of the suggestion :)

  6. in test/fuzz/test_runner.py:104 in 6b05d03ea6 outdated 
      99 | @@ -100,10 +100,12 @@ def main():
 100 |  
 101 |  def run_once(*, corpus, test_list, build_dir, export_coverage):
 102 |      for t in test_list:
 103 | +        corpus_path = os.path.join(corpus, t)
 104 | +        os.makedirs(corpus_path, exist_ok=True)
    MarcoFalke commented at 12:41 PM on October 1, 2019:

    See the documentation: "The seed corpus to run on (must contain subfolders for each fuzz target)"

    the idea was to give the user feedback when the seeds were missing by accident

    practicalswift commented at 1:20 PM on October 1, 2019:

    The consequence of that is that Travis fails when adding a new fuzzer (like in this case prior to adding that change). That's not how we want things to work, right? :)

    MarcoFalke commented at 3:46 PM on October 1, 2019:

    I think we do want this (as a reminder to generate seeds and upload them for travis)

    practicalswift commented at 7:47 AM on October 2, 2019:

    I think that creates a inter-repo dependency that is not warranted: the build for https://github.com/bitcoin/bitcoin should not break due to https://github.com/bitcoin-core/qa-assets not being updated. I suggest moving this checking to a cron job or to https://github.com/bitcoin-core/qa-assets.

    Our fuzzing framework is currently in a really really poor state: to fix that we want to make it super easy to add new fuzzers. Removing this inter-repo dependency is a quick way to make it easier to add new fuzzers without any measurable cost: modern coverage-guided fuzzers such as libFuzzer usually provide good value even in the absence of a starting corpus. Eventually the corpus will be added which is good, but no need to fail hard until it does.

    practicalswift commented at 2:28 PM on October 2, 2019:

    I'm now using suppressions in fuzz/test_runner.py to resolve this.

  7. in src/test/fuzz/eval_script.cpp:14 in 6b05d03ea6 outdated 
       9 | +
  10 | +void test_one_input(const std::vector<uint8_t>& buffer)
  11 | +{
  12 | +    const CScript script(buffer.begin(), buffer.end());
  13 | +    for (const auto sig_version : {SigVersion::BASE, SigVersion::WITNESS_V0}) {
  14 | +        for (const auto flags : {0U, std::numeric_limits<unsigned int>::max()}) {
    MarcoFalke commented at 12:43 PM on October 1, 2019:

    Can you explain why the flags are hardcoded (as opposed to be read from the input)?

    MarcoFalke commented at 12:52 PM on October 1, 2019:

    not sure if this helps, but there is a static bool IsValidFlagCombination helper

    practicalswift commented at 8:44 AM on October 2, 2019:

    It is a trade-off: while reading the flags could increase coverage it would also greatly increase the search space in a way that is not trivial for a fuzzer to reduce intelligently (AFAICT). Based on my reading of how flags are affecting the code paths taken in EvalScript I came to the conclusion that {0U, std::numeric_limits<unsigned int>::max()} seemed like a good way to limit search space while retaining good coverage. Let me know if you can find counter examples of code paths that won't be taken due to this limitation that would warrant increasing the search space :)

    MarcoFalke commented at 12:59 PM on October 2, 2019:

    It might give you the same line coverage, but not the same path coverage. E.g. CLTV and CSV are always both enabled or both disabled, but never only one of them is enabled. Do you have any reading suggestions for me that explain your intuition that the fuzzer will conceptually have a harder time covering the search space when the input data is used to decide which code path to take?

    practicalswift commented at 2:27 PM on October 2, 2019:

    I'll try to find a link :) I've now switched to reading flags from input using the excellent FuzzedDataProvider helper. I'm sure that will work out well too :)

  8. MarcoFalke commented at 12:45 PM on October 1, 2019: member

    Concept ACK

  9. jonatack commented at 3:25 PM on October 1, 2019: member

    Concept ACK. Will try to test this soon.

  10. practicalswift force-pushed on Oct 2, 2019
  11. practicalswift force-pushed on Oct 2, 2019
  12. practicalswift force-pushed on Oct 2, 2019
  13. practicalswift force-pushed on Oct 2, 2019
  14. DrahtBot commented at 8:39 PM on October 3, 2019: member

    <!--e57a25ab6845829454e8d69fc972939a-->

    The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

    <!--174a7506f384e20aa4161008e828411d-->

    Conflicts

    Reviewers, this pull request conflicts with the following ones:

    • #17129 (tests: Add fuzzing harness for miniscript::FromScript(...) by practicalswift)
    • #17109 (tests: Add fuzzing harness for various functions consuming only integrals by practicalswift)
    • #17051 (tests: Add deserialization fuzzing harnesses by practicalswift)

    If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

  15. practicalswift force-pushed on Oct 7, 2019
  16. MarcoFalke referenced this in commit febc31c641 on Oct 7, 2019
  17. practicalswift force-pushed on Oct 7, 2019
  18. in src/test/fuzz/eval_script.cpp:13 in 446183e906 outdated 
      11 | +void test_one_input(const std::vector<uint8_t>& buffer)
  12 | +{
  13 | +    if (buffer.size() <= sizeof(unsigned int)) {
  14 | +        return;
  15 | +    }
  16 | +    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
    MarcoFalke commented at 4:40 PM on October 7, 2019:

    style-nit: Looks like this creates another copy of the buffer.

    Could be solved by making test_one_input pass either a reference of a vector or a fuzzed data provider at compile time (with a compile flag)?

    Feel free to ignore.

  19. in src/test/fuzz/FuzzedDataProvider.h:1 in 446183e906 outdated 
       0 | @@ -0,0 +1,245 @@
   1 | +//===- FuzzedDataProvider.h - Utility header for fuzz targets ---*- C++ -* ===//
    MarcoFalke commented at 4:41 PM on October 7, 2019:

    Could put this into a separate commit to explain in the commit body where it is taken from exactly (repo+commit)?

    practicalswift commented at 3:18 PM on October 8, 2019:

    Good point! Fixed!

  20. sidhujag referenced this in commit a167684c20 on Oct 7, 2019
  21. practicalswift force-pushed on Oct 8, 2019
  22. DrahtBot added the label Needs rebase on Oct 10, 2019
  23. practicalswift force-pushed on Oct 10, 2019
  24. DrahtBot removed the label Needs rebase on Oct 10, 2019
  25. tests: Add FuzzedDataProvider fuzzing helper from the Chromium project
    Source: https://cs.chromium.org/chromium/src/third_party/libFuzzer/src/utils/FuzzedDataProvider.h?rcl=b9f51dc8c98065df0c8da13c051046f5bab833db
    bebb637472
  26. in test/fuzz/test_runner.py:17 in 7e9e369990 outdated 
      11 | @@ -12,6 +12,10 @@
  12 |  import subprocess
  13 |  import logging
  14 |  
  15 | +# Fuzzers known to lack a seed corpus in https://github.com/bitcoin-core/qa-assets/tree/master/fuzz_seed_corpus
  16 | +FUZZERS_MISSING_CORPORA = [
  17 | +    "eval_script",
    MarcoFalke commented at 9:08 PM on October 10, 2019:

    can remove all of this?

    practicalswift commented at 9:14 PM on October 10, 2019:

    Done! :)

  27. practicalswift force-pushed on Oct 10, 2019
  28. in src/test/fuzz/eval_script.cpp:15 in d58e0a5b39 outdated 
      10 | +
  11 | +void test_one_input(const std::vector<uint8_t>& buffer)
  12 | +{
  13 | +    if (buffer.size() <= sizeof(unsigned int)) {
  14 | +        return;
  15 | +    }
    MarcoFalke commented at 2:41 PM on October 11, 2019:

    why is this needed? The fuzzer should be able to learn it trivially.

    Also, you are limiting the script to have a size greater or equal to one

    practicalswift commented at 3:32 PM on October 11, 2019:

    Unfortunately needed to not trigger the following UBSan warnings in Chromium's FuzzedDataProvider.h :)

    Without:

    $ src/test/fuzz/eval_script
INFO: Seed: 2056324753
INFO: Loaded 1 modules   (453398 inline 8-bit counters): 453398 [0x563c78576048, 0x563c785e4b5e),
INFO: Loaded 1 PC tables (453398 PCs): 453398 [0x563c785e4b60,0x563c78ccfcc0),
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
test/fuzz/FuzzedDataProvider.h:212:17: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior test/fuzz/FuzzedDataProvider.h:212:17 in
test/fuzz/FuzzedDataProvider.h:212:32: runtime error: null pointer passed as argument 2, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior test/fuzz/FuzzedDataProvider.h:212:32 in
    MarcoFalke commented at 5:15 PM on October 11, 2019:

    Why doesn't that make the fuzzer fail and exit?

    edit:

    This is concerning:

    $ src/test/fuzz/eval_script -runs=1 ../btc_qa_assets/fuzz_seed_corpus/eval_script
INFO: Seed: 353817634
INFO: Loaded 1 modules   (428917 inline 8-bit counters): 428917 [0x55d5861db100, 0x55d586243c75), 
INFO: Loaded 1 PC tables (428917 PCs): 428917 [0x55d586243c78,0x55d5868cf3c8), 
INFO:     1505 files found in ../btc_qa_assets/fuzz_seed_corpus/eval_script
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 10047 bytes
test/fuzz/FuzzedDataProvider.h:212:17: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior test/fuzz/FuzzedDataProvider.h:212:17 in 
test/fuzz/FuzzedDataProvider.h:212:32: runtime error: null pointer passed as argument 2, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior test/fuzz/FuzzedDataProvider.h:212:32 in 
INFO: seed corpus: files: 1505 min: 1b max: 10047b total: 76468b rss: 92Mb
[#1506](/bitcoin-bitcoin/1506/)	INITED cov: 2992 ft: 20174 corp: 1486/74Kb lim: 4 exec/s: 1506 rss: 229Mb
[#1506](/bitcoin-bitcoin/1506/)	DONE   cov: 2992 ft: 20174 corp: 1486/74Kb lim: 4 exec/s: 1506 rss: 229Mb
Done 1506 runs in 1 second(s)
$ echo $?
0
    MarcoFalke commented at 5:15 PM on October 11, 2019:

    Anyway, the check should be <, not <=, otherwise you are limiting the script to have a size greater or equal to one

    practicalswift commented at 4:21 PM on October 12, 2019:

    @MarcoFalke I think you forgot to set UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1:exitcode=1 :)

    I think this is the behaviour you expected:

    $ UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1:exitcode=1 src/test/fuzz/eval_script -runs=1 ../btc_qa_assets/fuzz_seed_corpus/eval_script
INFO: Seed: 3606842015
INFO: Loaded 1 modules   (453402 inline 8-bit counters): 453402 [0x55b0f0056068, 0x55b0f00c4b82),
INFO: Loaded 1 PC tables (453402 PCs): 453402 [0x55b0f00c4b88,0x55b0f07afd28),
INFO:        0 files found in ../btc_qa_assets/fuzz_seed_corpus/eval_script
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
test/fuzz/FuzzedDataProvider.h:212:17: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
    [#0](/bitcoin-bitcoin/0/) 0x55b0eb940b1d in std::vector<unsigned char, std::allocator<unsigned char> > FuzzedDataProvider::ConsumeBytes<unsigned char>(unsigned long, unsigned long) /src/./test/fuzz/FuzzedDataProvider.h:212:5
    [#1](/bitcoin-bitcoin/1/) 0x55b0eb9404b7 in std::vector<unsigned char, std::allocator<unsigned char> > FuzzedDataProvider::ConsumeBytes<unsigned char>(unsigned long) /src/./test/fuzz/FuzzedDataProvider.h:42:12
    [#2](/bitcoin-bitcoin/2/) 0x55b0eb93e4c3 in std::vector<unsigned char, std::allocator<unsigned char> > FuzzedDataProvider::ConsumeRemainingBytes<unsigned char>() /src/./test/fuzz/FuzzedDataProvider.h:143:12
    [#3](/bitcoin-bitcoin/3/) 0x55b0eb93d70f in test_one_input(std::vector<unsigned char, std::allocator<unsigned char> > const&) /src/test/fuzz/eval_script.cpp:18:68
    [#4](/bitcoin-bitcoin/4/) 0x55b0eb9331fb in LLVMFuzzerTestOneInput /src/test/fuzz/fuzz.cpp:34:5
    [#5](/bitcoin-bitcoin/5/) 0x55b0eb6fbb87 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/src/test/fuzz/eval_script+0x1da8b87)
    [#6](/bitcoin-bitcoin/6/) 0x55b0eb7057cb in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/src/test/fuzz/eval_script+0x1db27cb)
    [#7](/bitcoin-bitcoin/7/) 0x55b0eb707932 in fuzzer::Fuzzer::Loop(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/src/test/fuzz/eval_script+0x1db4932)
    [#8](/bitcoin-bitcoin/8/) 0x55b0eb6f6e1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/src/test/fuzz/eval_script+0x1da3e1c)
    [#9](/bitcoin-bitcoin/9/) 0x55b0eb6bb2c2 in main (/src/test/fuzz/eval_script+0x1d682c2)
    [#10](/bitcoin-bitcoin/10/) 0x7f84c2817b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    [#11](/bitcoin-bitcoin/11/) 0x55b0eb6e9d39 in _start (/src/test/fuzz/eval_script+0x1d96d39)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior test/fuzz/FuzzedDataProvider.h:212:17 in
MS: 0 ; base unit: 0000000000000000000000000000000000000000


artifact_prefix='./'; Test unit written to ./crash-da39a3ee5e6b4b0d3255bfef95601890afd80709
Base64:
$ echo $?
1
  29. MarcoFalke commented at 2:43 PM on October 11, 2019: member

    Concept ACK d58e0a5b39032e3dc06af0f0662b6a8ae092345d

    <details><summary>Show signature and timestamp</summary>

    Signature:

    -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

ACK d58e0a5b39032e3dc06af0f0662b6a8ae092345d
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEE+rVPoUahrI9sLGYTzit1aX5ppUgFAlwqrYAACgkQzit1aX5p
pUhokAv9Gw2Cn+XfK88rrNb49RuOKqSslmk7/yvSEFZLTiA9U7guKJPBCeRFcMgV
ItO3JXlht3/6Ltot9/kt30EQDlwL/E2YTL7AFSv41FG9gvV8ORSVEZ1O4tS1pyx8
32Rgd7H34V5rg2qnKQR+zCCM2aBxtQ53wRQS0DjRKbS6mdUqky+rfZ2AwUUFwjeG
P9Vg/XMC6XkBMOvJqPS8f0Ef/YSJsjNTuDo2g6OzEbAd2UbF3eCR4aFD5Um8eW41
Dqm3YjB13UQwnqVSunazYtyiQauRJoxlkshmFec/taD4ZrIhDCCjuPiSRTE6zZgV
DKHukZO7OkYn0uVRimHirR0ezx06QuEp9wcbvv5L92Wecvfo2NlSHW9WSzvGwaV8
48agu4UTwEcTl8BgP+lTFjL3qncJ8W1z0Yjsbbgjg0/UMgSoqAAqeM9r2v5HqqGe
7NCdxO3RuoT2VKgU0IzslXolxtv5qyio9I041wkPW0pG/pZ4+qXn9sgQvMq9R1DR
X9AiIDKI
=ClLo
-----END PGP SIGNATURE-----

    Timestamp of file with hash 32f59337b799b6469837b88390d4a402e662f355ae288f53c5ff01c79d105ce1 -

    </details>

  30. MarcoFalke added the label Waiting for author on Oct 12, 2019
  31. practicalswift force-pushed on Oct 12, 2019
  32. tests: Add EvalScript(...) fuzzing harness 7e50abcc29
  33. practicalswift force-pushed on Oct 12, 2019
  34. MarcoFalke commented at 1:27 PM on October 14, 2019: member

    ACK 7e50abcc29dc5fde24a1b3e57c6316eabda35e2e

    <details><summary>Show signature and timestamp</summary>

    Signature:

    -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

ACK 7e50abcc29dc5fde24a1b3e57c6316eabda35e2e
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEE+rVPoUahrI9sLGYTzit1aX5ppUgFAlwqrYAACgkQzit1aX5p
pUidXQwAq4GO999vR/OJASwj9LLmukMWUhvY04RwBHGUho2xHLi2V1YL1q/f5cYH
qVNb/V/llESB85HRz4kOYc+FntCFMD9IOFIAagLvYATqVk0n9iOdGHsbBovMtVUf
uBErkQLGfghU+b1hLxs0wmcNdY8KvmaI/o36GD2k03TZ+ZbkQ4F1UR4x6uaburv6
oo+pWtmgUZUFiUAZKnmz/DlNmURW05TlCdGgwcEPCum5v363lY8r9miVASEiezDi
EImqxL894G251U/j260Bc07RXiFeWS/9znNtYvwTZl8UNCCVNxrw0he3lG1ru7Z4
5aXwS6g8+rhzU38b+N+wM68X5NgrcQGpCAzCAafVvZHcKh4bqCikxId0fQ0xRMpA
Isy6KEQ8WVAoloelUubu6NUl0RhzJIAfEjD8cSXXdJ/oW8TLDHLxG3Kj0MjUKudw
7kNZxFgdrIl1e5kKlAhYVLxgCNiFWvqJo3uaruCMUpEw1mtxgvhcxqn/5+2keihM
6Tx7u40P
=UCP9
-----END PGP SIGNATURE-----

    Timestamp of file with hash affe871723f783a800c6edcd8f373e476fd6c5791654096da973631289ee4718 -

    </details>

  35. MarcoFalke removed the label Waiting for author on Oct 14, 2019
  36. MarcoFalke referenced this in commit 556820ee57 on Oct 14, 2019
  37. MarcoFalke merged this on Oct 14, 2019
  38. MarcoFalke closed this on Oct 14, 2019
  39. deadalnix referenced this in commit efa7a3323c on Jun 26, 2020
  40. jasonbcox referenced this in commit a9f8187d89 on Jul 1, 2020
  41. practicalswift deleted the branch on Apr 10, 2021
  42. kittywhiskers referenced this in commit 831b0057d9 on Feb 26, 2022
  43. PastaPastaPasta referenced this in commit 91aced0a4c on Feb 26, 2022
  44. PastaPastaPasta referenced this in commit 4099e8820d on Mar 3, 2022
  45. DrahtBot locked this on Aug 18, 2022
Contributors
practicalswiftlaanwjMarcoFalkejonatackDrahtBot
Labels
Tests
Linked (view graph)
#17000 tests: Add test_fuzzing_harnesses.sh for quick testing/verification of fuzzing harness coverage#17069 tests: Pass fuzzing inputs as constant references
github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2026-04-16 15:14 UTC
This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me