tests: Add fuzzing harness for classes/functions in blockfilter.h. Add integer {de,}serialization fuzzing. #18423

pull practicalswift wants to merge 2 commits into bitcoin:master from practicalswift:fuzzers-misc-2 changing 4 files +101 −0

practicalswift commented at 5:09 PM on March 24, 2020: contributor

Add fuzzing harness for classes/functions in blockfilter.h.

Add integer serialization/deserialization fuzzing harness.
tests: Add integer serialization/deserialization fuzzing harness 87d24e67bb
tests: Add fuzzing harness for classes/functions in blockfilter.h 102f3267e9
fanquake added the label Tests on Mar 24, 2020
DrahtBot commented at 12:22 AM on March 25, 2020: member


The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



Conflicts

Reviewers, this pull request conflicts with the following ones:
- #18407 (tests: Add proof-of-work fuzzing harness by practicalswift)
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.
in src/test/fuzz/blockfilter.cpp:39 in 102f3267e9
```
  34 | +        (void)gcs_filter.GetN();
  35 | +        (void)gcs_filter.GetParams();
  36 | +        (void)gcs_filter.GetEncoded();
  37 | +        (void)gcs_filter.Match(ConsumeRandomLengthByteVector(fuzzed_data_provider));
  38 | +        GCSFilter::ElementSet element_set;
  39 | +        while (fuzzed_data_provider.ConsumeBool()) {
```
MarcoFalke commented at 12:35 AM on March 25, 2020:

Why does this need to be consumed? It seems the only purpose of the consumed bool is to exit early. The same can be achieved by the fuzz engine by just not providing any further input. So shouldn't the condition here be fuzzed_data_provider.remaining_bytes()?

practicalswift commented at 11:18 AM on March 25, 2020:

Yes, using if (fuzzed_data_provider.remaining_bytes()) { is possible but that would render the seed corpus invalid if we add input consuming code to be fuzzed in blockfilter.cpp going forward.

Using if (fuzzed_data_provider.ConsumeBool()) { instead avoids that problem: we can add code to be fuzzed that consumes input without invalidating the existing seed corpus.

Invalidating in this context means changing the fuzzing coverage for a given input file.

practicalswift commented at 11:36 AM on March 25, 2020:

Please note that fuzzed_data_provider.ConsumeBool() will return false if fuzzed_data_provider.remaining_bytes() == 0.
MarcoFalke approved
MarcoFalke merged this on Mar 25, 2020
MarcoFalke closed this on Mar 25, 2020
Fabcien referenced this in commit 0f75a947b3 on Jan 20, 2021
practicalswift deleted the branch on Apr 10, 2021
kittywhiskers referenced this in commit f06ad0357e on May 7, 2022
kittywhiskers referenced this in commit bb4ca0fc31 on May 7, 2022
kittywhiskers referenced this in commit 6dca911041 on Jun 14, 2022
kittywhiskers referenced this in commit 411a5e8772 on Jun 14, 2022
kittywhiskers referenced this in commit 9b561445f3 on Jun 18, 2022
kittywhiskers referenced this in commit dc329b0855 on Jul 4, 2022
kittywhiskers referenced this in commit ae4ac1fefa on Jul 4, 2022
kittywhiskers referenced this in commit 45e539c68b on Jul 6, 2022
kittywhiskers referenced this in commit 7a954b8bd7 on Jul 6, 2022
PastaPastaPasta referenced this in commit eefdae1a53 on Jul 12, 2022
knst referenced this in commit 34ca755f20 on Jul 21, 2022
DrahtBot locked this on Aug 18, 2022

Contributors

Labels

tests: Add fuzzing harness for classes/functions in blockfilter.h. Add integer {de,}serialization fuzzing. #18423

Conflicts