The fuzzers eval_script and script_flags require holding ECCVerifyHandle.
This is a follow-up to #17235 which accidentally broke those two fuzzers.
Sorry about the temporary breakage my fuzzing friends: it took a while to fuzz before reaching these code paths. That's why this wasn't immediately caught. Sorry.
What are the steps to reproduce? Please upload a seed to https://github.com/bitcoin-core/qa-assets
This test case triggers the condition in script_flags:
020200000002020201006040001f84e6008d000000000000000000000000
04000000000000002751261a535353295b5352210300000000a7000000ac
acacacacacacacacacacac7573655f636d70acacacaca7ac000000000000
0000000000000000000000000000000010101000000000
$ mkdir script_flags-testcase/
$ xxd -p -r <<< "020200000002020201006040001f84e6008d00000000000000000000000004000000000000002751261a535353295b5352210300000000a7000000acacacacacacacacacacacac7573655f636d70acacacaca7ac0000000000000000000000000000000000000000000010101000000000" > script_flags-testcase/crash
$ UBSAN_OPTIONS="print_stacktrace=1:halt_on_error=1" src/test/fuzz/script_flags script_flags-testcase/
pubkey.cpp:174:36: runtime error: null pointer passed as argument 1, which is declared to never be null
This test case triggers the condition in eval_script:
1a3017021200f98d0a0f831000210000000000001a32170201008100ac6e
6e878c
$ mkdir script_flags-testcase/
$ xxd -p -r <<< "1a3017021200f98d0a0f831000210000000000001a32170201008100ac6e6e878c" > eval_script-testcase/crash
$ UBSAN_OPTIONS="print_stacktrace=1:halt_on_error=1" src/test/fuzz/eval_script eval_script-testcase/
pubkey.cpp:35:45: runtime error: null pointer passed as argument 1, which is declared to never be null
Seeds submitted to qa-assets in https://github.com/bitcoin-core/qa-assets/pull/1 :)
@MarcoFalke The broken fuzzers are causing some pain in the form of false positives. Would it be possible to get those changes in? :)