Add fuzzing harnesses for various Base{32,58,64} and hex related functions.
Testing this PR
Run:
0$ CC=clang CXX=clang++ ./configure --enable-fuzz \
1 --with-sanitizers=address,fuzzer,undefined
2$ make
3$ src/test/fuzz/base_encode_decode
4…
5$ src/test/fuzz/hex
6…
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
Reviewers, this pull request conflicts with the following ones:
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.
18+
19+ std::vector<unsigned char> decoded;
20+ if (DecodeBase58(random_encoded_string, decoded)) {
21+ const std::string encoded_string = EncodeBase58(decoded);
22+ assert(encoded_string == SanitizeString(encoded_string, SAFE_CHARS_BASE58));
23+ const std::string sanitized_random_encoded_string = SanitizeString(random_encoded_string, SAFE_CHARS_BASE58);
SanitizeString for this use case.
random_encoded_string can contain all kinds of crap and still pass DecodeBase58 so it is not only for whitespace removal. To properly fuzz test this then knowledge of SAFE_CHARS_BASE58 is needed, but if you want I can make the sanitation machinery local to the this file?
SAFE_CHARS_BASE58. I’ll get back with a more specific code example :)
Consider these cases:
str contains good → DecodeBase58(const std::string& str, …) == true (as expected)str contains bad0IOl → DecodeBase58(const std::string& str, …) == false (as expected)str contains good\x00bad0IOl → DecodeBase58(const std::string& str, …) == true(!)The reason is that DecodeBase58(const std::string& str, …) calls DecodeBase58(const char* psz, …) which will only consider the string up to the first \x00.
SanitizeString, the string could be shortened and trimmed of whitespace in the fuzzer?
I’m not sure that is the way to go: \x00 is not whitespace :)
WDYT: shouldn’t DecodeBase58(const std::string& str, …) return false when passed a str which contains at least one character that is not any of the base58 characters (all alphanumeric characters except for “0”, “I”, “O”, and “l”) or the whitespace characters?
ACK c18405732e38eadb2c47533c3f982f4605fbfd9a 🔁
Signature:
0-----BEGIN PGP SIGNED MESSAGE-----
1Hash: SHA512
2
3ACK c18405732e38eadb2c47533c3f982f4605fbfd9a 🔁
4-----BEGIN PGP SIGNATURE-----
5
6iQGzBAEBCgAdFiEE+rVPoUahrI9sLGYTzit1aX5ppUgFAlwqrYAACgkQzit1aX5p
7pUiRkQwAzifZDinuiY69gCNY7zItA/6qtOrQCr5xI9XT/cXhnmxujZ3kUOhV6Up4
85TURghwN8nPvmhoGQGRUdLKcRIukT7fOpY4nm4ZUF1ixP+ptU76tqMRvbEvmW7+n
9cJFiQdRf6orw4BQDmzs8Mn6bAzbDy0R6rZQaVOOWC3t8gm5GYxgyxF1GCaaCiObN
101RCHk7w/cPtECYtF/jn6mGQ+x1QjFTnM4jfE6eoZ4MK8ZQQH83KpPHFbaDkUdZVr
11JDDTgj36fvZDMG5lHwq3Kl1H4n6935gnn5scpg/RJDBWR/b6/OtDWbOgD5NKYeB0
12TxYzEOcvc2VZMHniZY+0U5QGG1V2E4b2i8VTXKprvS78HFFBHGBFaEs0x8Khw++y
136PiMm5pl5NNsrupqhFZjKok1ovcYhdW/R20UUenuoreBdNxn2gbxHusrby7fqyLU
14Mh1EjobV9+2j6hoq31RruhDhEEci9hGYQIkViGxp9WE30zIQnfMaydWK8WXqo2j9
15mzRQTJm4
16=fMYZ
17-----END PGP SIGNATURE-----
Timestamp of file with hash f74c2496a35f1208847a8485a6f49081e34fb06b514fa83512932463fc23f7a6 -
ACK c18405732e38eadb2c47533c3f982f4605fbfd9a - code review and tested on master posthumously :running_man:
0bitcoin/bitcoin (master)$ src/test/fuzz/base_encode_decode
1INFO: Seed: 1034069505
2INFO: Loaded 1 modules (5201 inline 8-bit counters): 5201 [0x559140d7b920, 0x559140d7cd71),
3INFO: Loaded 1 PC tables (5201 PCs): 5201 [0x559140d7cd78,0x559140d91288),
4INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
5INFO: A corpus is not provided, starting from an empty corpus
6[#2](/bitcoin-bitcoin/2/) INITED cov: 451 ft: 452 corp: 1/1b lim: 4 exec/s: 0 rss: 41Mb
7[#3](/bitcoin-bitcoin/3/) NEW cov: 460 ft: 557 corp: 2/3b lim: 4 exec/s: 0 rss: 41Mb L: 2/2 MS: 1 InsertByte-
8[#5](/bitcoin-bitcoin/5/) NEW cov: 460 ft: 559 corp: 3/5b lim: 4 exec/s: 0 rss: 41Mb L: 2/2 MS: 2 ShuffleBytes-CopyPart-
9[#7](/bitcoin-bitcoin/7/) NEW cov: 461 ft: 560 corp: 4/7b lim: 4 exec/s: 0 rss: 41Mb L: 2/2 MS: 2 ShuffleBytes-ChangeBit-
0bitcoin/bitcoin (master)$ src/test/fuzz/hex
1INFO: Seed: 1110008671
2INFO: Loaded 1 modules (3630 inline 8-bit counters): 3630 [0x5602274bbe40, 0x5602274bcc6e),
3INFO: Loaded 1 PC tables (3630 PCs): 3630 [0x5602274bcc70,0x5602274caf50),
4INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
5INFO: A corpus is not provided, starting from an empty corpus
6[#2](/bitcoin-bitcoin/2/) INITED cov: 176 ft: 177 corp: 1/1b lim: 4 exec/s: 0 rss: 41Mb
7[#5](/bitcoin-bitcoin/5/) NEW cov: 183 ft: 197 corp: 2/3b lim: 4 exec/s: 0 rss: 41Mb L: 2/2 MS: 3 ShuffleBytes-ShuffleBytes-InsertByte-
8[#6](/bitcoin-bitcoin/6/) NEW cov: 183 ft: 198 corp: 3/5b lim: 4 exec/s: 0 rss: 41Mb L: 2/2 MS: 1 InsertByte-
9[#7](/bitcoin-bitcoin/7/) NEW cov: 184 ft: 212 corp: 4/7b lim: 4 exec/s: 0 rss: 41Mb L: 2/2 MS: 1 ShuffleBytes-