tests: Add fuzzing harness for CScript and CScriptNum operations #18176

  32 | +        switch (fuzzed_data_provider.ConsumeIntegralInRange(0, 26)) {
  33 | +        case 0:
  34 | +            (void)(script_num == fuzzed_data_provider.ConsumeIntegral<int64_t>());
  35 | +            break;
  36 | +        case 1:
  37 | +            (void)(script_num != fuzzed_data_provider.ConsumeIntegral<int64_t>());

MarcoFalke commented at 10:19 PM on March 7, 2020:

Can combine case 0 and 1?

const auto int = fuzzed_data_provider.ConsumeIntegral<int64_t>()
(script_num == int) != (script_num != int)

practicalswift commented at 4:57 PM on March 9, 2020:

Fixed!

  41 | +            break;
  42 | +        case 3:
  43 | +            (void)(script_num < fuzzed_data_provider.ConsumeIntegral<int64_t>());
  44 | +            break;
  45 | +        case 4:
  46 | +            (void)(script_num >= fuzzed_data_provider.ConsumeIntegral<int64_t>());

MarcoFalke commented at 10:19 PM on March 7, 2020:

Same here:

(s_n < int) != (s_n >= int)

practicalswift commented at 4:58 PM on March 9, 2020:

Fixed!

  44 | +            break;
  45 | +        case 4:
  46 | +            (void)(script_num >= fuzzed_data_provider.ConsumeIntegral<int64_t>());
  47 | +            break;
  48 | +        case 5:
  49 | +            (void)(script_num > fuzzed_data_provider.ConsumeIntegral<int64_t>());

MarcoFalke commented at 10:20 PM on March 7, 2020:

Same here:

(s_n > int ) != (s_n <= int)

practicalswift commented at 4:57 PM on March 9, 2020:

Fixed!

  62 | +            break;
  63 | +        case 10:
  64 | +            (void)(script_num >= ConsumeScriptNum(fuzzed_data_provider));
  65 | +            break;
  66 | +        case 11:
  67 | +            (void)(script_num > ConsumeScriptNum(fuzzed_data_provider));

MarcoFalke commented at 10:20 PM on March 7, 2020:

Same for all of these

practicalswift commented at 4:58 PM on March 9, 2020:

Fixed!

  68 | +            break;
  69 | +        case 12:
  70 | +            script_num = script_num + fuzzed_data_provider.ConsumeIntegral<int64_t>();
  71 | +            break;
  72 | +        case 13:
  73 | +            script_num = script_num - fuzzed_data_provider.ConsumeIntegral<int64_t>();

MarcoFalke commented at 10:22 PM on March 7, 2020:

Could combine these?

(script_num - int ) + int == script_num
(script_num + int ) - int == script_num

practicalswift commented at 4:57 PM on March 9, 2020:

Fixed!

  74 | +            break;
  75 | +        case 14:
  76 | +            script_num = script_num + ConsumeScriptNum(fuzzed_data_provider);
  77 | +            break;
  78 | +        case 15:
  79 | +            script_num = script_num - ConsumeScriptNum(fuzzed_data_provider);

MarcoFalke commented at 10:23 PM on March 7, 2020:

Same here and below?

practicalswift commented at 4:57 PM on March 9, 2020:

Fixed!

  40 | +            assert((script_num <= i) != script_num > i);
  41 | +            break;
  42 | +        }
  43 | +        case 2: {
  44 | +            const int64_t i = fuzzed_data_provider.ConsumeIntegral<int64_t>();
  45 | +            assert((script_num >= i) != (script_num < i));

MarcoFalke commented at 8:08 PM on March 9, 2020:

in commit 4532649328ad5056f9ae2bf99f3aba2212bdc785:

Any reason those are separate cases for the fuzzer to find? They can all be executed in the same case:

             assert((script_num == i) != (script_num != i));
             assert((script_num <= i) != script_num > i);
             assert((script_num >= i) != (script_num < i));

practicalswift commented at 8:40 PM on March 9, 2020:

Oh, of course. Now fixed. Thanks!

  55 | +            assert((script_num <= sn) != (script_num > sn));
  56 | +            break;
  57 | +        }
  58 | +        case 5: {
  59 | +            const CScriptNum sn = ConsumeScriptNum(fuzzed_data_provider);
  60 | +            assert((script_num >= sn) != (script_num < sn));

MarcoFalke commented at 8:08 PM on March 9, 2020:

Same here

  77 | +        case 7: {
  78 | +            const CScriptNum sn = ConsumeScriptNum(fuzzed_data_provider);
  79 | +            // Avoid signed integer overflow:
  80 | +            // script/script.h:264:93: runtime error: signed integer overflow: -9223126527765971126 + -9223372036854756825 cannot be represented in type 'long'
  81 | +            if (IsValidAddition(script_num, sn)) {
  82 | +                assert((script_num + sn) - sn == script_num);

MarcoFalke commented at 8:11 PM on March 9, 2020:

Same here

 155 | +            // Avoid negation failure:
 156 | +            // script/script.h:332:35: runtime error: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
 157 | +            if (script_num == CScriptNum{std::numeric_limits<int64_t>::min()}) {
 158 | +                break;
 159 | +            }
 160 | +            (void)script_num.getvch();

MarcoFalke commented at 8:13 PM on March 9, 2020:

Also in commit 4532649:

No input is consumed from the fuzzer, so this doesn't need to be special cased and can be executed unconditionally?

practicalswift commented at 8:40 PM on March 9, 2020:

True! Fixed.