ci: fuzz/decode_tx fails #20334

issue hebasto opened this issue on November 7, 2020

hebasto commented at 7:48 PM on November 7, 2020: member

https://bitcoinbuilds.org/?job=daf150bb-1252-4603-9f0a-d424583294f0:

Run decode_tx with args ['/home/ubuntu/src/src/test/fuzz/decode_tx', '-runs=1', '/home/ubuntu/src/QA/fuzz_seed_corpus/decode_tx']INFO: Seed: 2836361558
INFO: Loaded 1 modules   (20561 inline 8-bit counters): 20561 [0x55e5baadc3f0, 0x55e5baae1441), 
INFO: Loaded 1 PC tables (20561 PCs): 20561 [0x55e5baae1448,0x55e5bab31958), 
INFO:      630 files found in /home/ubuntu/src/QA/fuzz_seed_corpus/decode_tx
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 1048576 bytes
INFO: seed corpus: files: 630 min: 1b max: 3984182b total: 4969882b rss: 31Mb
decode_tx: test/fuzz/decode_tx.cpp:29: void test_one_input(const std::vector<uint8_t> &): Assertion `result_try_witness_and_maybe_no_witness' failed.
==25419== ERROR: libFuzzer: deadly signal
    [#0](/bitcoin-bitcoin/0/) 0x55e5ba4d8f17 in __sanitizer_print_stack_trace (/home/ubuntu/src/src/test/fuzz/decode_tx+0x2e3f17)
    [#1](/bitcoin-bitcoin/1/) 0x55e5ba42422b in fuzzer::PrintStackTrace() (/home/ubuntu/src/src/test/fuzz/decode_tx+0x22f22b)
    [#2](/bitcoin-bitcoin/2/) 0x55e5ba407488 in fuzzer::Fuzzer::CrashCallback() (/home/ubuntu/src/src/test/fuzz/decode_tx+0x212488)
    [#3](/bitcoin-bitcoin/3/) 0x55e5ba40744f in fuzzer::Fuzzer::StaticCrashSignalCallback() (/home/ubuntu/src/src/test/fuzz/decode_tx+0x21244f)
    [#4](/bitcoin-bitcoin/4/) 0x7f36b3cbc88f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1288f)
    [#5](/bitcoin-bitcoin/5/) 0x7f36b249de96 in gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x3ee96)
    [#6](/bitcoin-bitcoin/6/) 0x7f36b249f800 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x40800)
    [#7](/bitcoin-bitcoin/7/) 0x7f36b248f399  (/lib/x86_64-linux-gnu/libc.so.6+0x30399)
    [#8](/bitcoin-bitcoin/8/) 0x7f36b248f411 in __assert_fail (/lib/x86_64-linux-gnu/libc.so.6+0x30411)
    [#9](/bitcoin-bitcoin/9/) 0x55e5ba502ac6 in test_one_input(std::vector<unsigned char, std::allocator<unsigned char> > const&) /home/ubuntu/src/src/test/fuzz/decode_tx.cpp:29:9
    [#10](/bitcoin-bitcoin/10/) 0x55e5ba58ff42 in LLVMFuzzerTestOneInput /home/ubuntu/src/src/test/fuzz/fuzz.cpp:36:5
    [#11](/bitcoin-bitcoin/11/) 0x55e5ba4087aa in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x2137aa)
    [#12](/bitcoin-bitcoin/12/) 0x55e5ba407fa5 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x212fa5)
    [#13](/bitcoin-bitcoin/13/) 0x55e5ba40aa6e in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x215a6e)
    [#14](/bitcoin-bitcoin/14/) 0x55e5ba40b005 in fuzzer::Fuzzer::Loop(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x216005)
    [#15](/bitcoin-bitcoin/15/) 0x55e5ba3fdac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x208ac0)
    [#16](/bitcoin-bitcoin/16/) 0x55e5ba4249e2 in main (/home/ubuntu/src/src/test/fuzz/decode_tx+0x22f9e2)
    [#17](/bitcoin-bitcoin/17/) 0x7f36b2480b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    [#18](/bitcoin-bitcoin/18/) 0x55e5ba3f64c9 in _start (/home/ubuntu/src/src/test/fuzz/decode_tx+0x2014c9)

NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
MS: 0 ; base unit: 0000000000000000000000000000000000000000
0x0,0x11,0x0,0x0,0x0,0x1,0x1,0xe8,0x60,0x0,0x0,0x0,0x0,0x0,0x0,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x0,0x5,0x5,0x5,0x0,0x0,0x0,0x6,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,
\x00\x11\x00\x00\x00\x01\x01\xe8`\x00\x00\x00\x00\x00\x00\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x00\x05\x05\x05\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00
artifact_prefix='./'; Test unit written to ./crash-bb7f920f5c05dd1f8d0a4b4daa4d1e880f775e04
Base64: ABEAAAABAehgAAAAAAAABQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUABQUFAAAABgAAAAAAAAAA

INFO: Seed: 2836361558
INFO: Loaded 1 modules   (20561 inline 8-bit counters): 20561 [0x55e5baadc3f0, 0x55e5baae1441), 
INFO: Loaded 1 PC tables (20561 PCs): 20561 [0x55e5baae1448,0x55e5bab31958), 
INFO:      630 files found in /home/ubuntu/src/QA/fuzz_seed_corpus/decode_tx
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 1048576 bytes
INFO: seed corpus: files: 630 min: 1b max: 3984182b total: 4969882b rss: 31Mb
decode_tx: test/fuzz/decode_tx.cpp:29: void test_one_input(const std::vector<uint8_t> &): Assertion `result_try_witness_and_maybe_no_witness' failed.
==25419== ERROR: libFuzzer: deadly signal
    [#0](/bitcoin-bitcoin/0/) 0x55e5ba4d8f17 in __sanitizer_print_stack_trace (/home/ubuntu/src/src/test/fuzz/decode_tx+0x2e3f17)
    [#1](/bitcoin-bitcoin/1/) 0x55e5ba42422b in fuzzer::PrintStackTrace() (/home/ubuntu/src/src/test/fuzz/decode_tx+0x22f22b)
    [#2](/bitcoin-bitcoin/2/) 0x55e5ba407488 in fuzzer::Fuzzer::CrashCallback() (/home/ubuntu/src/src/test/fuzz/decode_tx+0x212488)
    [#3](/bitcoin-bitcoin/3/) 0x55e5ba40744f in fuzzer::Fuzzer::StaticCrashSignalCallback() (/home/ubuntu/src/src/test/fuzz/decode_tx+0x21244f)
    [#4](/bitcoin-bitcoin/4/) 0x7f36b3cbc88f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1288f)
    [#5](/bitcoin-bitcoin/5/) 0x7f36b249de96 in gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x3ee96)
    [#6](/bitcoin-bitcoin/6/) 0x7f36b249f800 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x40800)
    [#7](/bitcoin-bitcoin/7/) 0x7f36b248f399  (/lib/x86_64-linux-gnu/libc.so.6+0x30399)
    [#8](/bitcoin-bitcoin/8/) 0x7f36b248f411 in __assert_fail (/lib/x86_64-linux-gnu/libc.so.6+0x30411)
    [#9](/bitcoin-bitcoin/9/) 0x55e5ba502ac6 in test_one_input(std::vector<unsigned char, std::allocator<unsigned char> > const&) /home/ubuntu/src/src/test/fuzz/decode_tx.cpp:29:9
    [#10](/bitcoin-bitcoin/10/) 0x55e5ba58ff42 in LLVMFuzzerTestOneInput /home/ubuntu/src/src/test/fuzz/fuzz.cpp:36:5
    [#11](/bitcoin-bitcoin/11/) 0x55e5ba4087aa in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x2137aa)
    [#12](/bitcoin-bitcoin/12/) 0x55e5ba407fa5 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x212fa5)
    [#13](/bitcoin-bitcoin/13/) 0x55e5ba40aa6e in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x215a6e)
    [#14](/bitcoin-bitcoin/14/) 0x55e5ba40b005 in fuzzer::Fuzzer::Loop(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x216005)
    [#15](/bitcoin-bitcoin/15/) 0x55e5ba3fdac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/ubuntu/src/src/test/fuzz/decode_tx+0x208ac0)
    [#16](/bitcoin-bitcoin/16/) 0x55e5ba4249e2 in main (/home/ubuntu/src/src/test/fuzz/decode_tx+0x22f9e2)
    [#17](/bitcoin-bitcoin/17/) 0x7f36b2480b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    [#18](/bitcoin-bitcoin/18/) 0x55e5ba3f64c9 in _start (/home/ubuntu/src/src/test/fuzz/decode_tx+0x2014c9)

NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
MS: 0 ; base unit: 0000000000000000000000000000000000000000
0x0,0x11,0x0,0x0,0x0,0x1,0x1,0xe8,0x60,0x0,0x0,0x0,0x0,0x0,0x0,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x0,0x5,0x5,0x5,0x0,0x0,0x0,0x6,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,
\x00\x11\x00\x00\x00\x01\x01\xe8`\x00\x00\x00\x00\x00\x00\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x00\x05\x05\x05\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00
artifact_prefix='./'; Test unit written to ./crash-bb7f920f5c05dd1f8d0a4b4daa4d1e880f775e04
Base64: ABEAAAABAehgAAAAAAAABQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUABQUFAAAABgAAAAAAAAAA

Target "/home/ubuntu/src/src/test/fuzz/decode_tx -runs=1 /home/ubuntu/src/QA/fuzz_seed_corpus/decode_tx" failed with exit code 77

hebasto added the label Bug on Nov 7, 2020
practicalswift commented at 9:25 PM on November 7, 2020: contributor

@hebasto

Thanks for reporting!

I'm unable to reproduce against current master.

Are you able to reproduce it?
decryp2kanon commented at 3:46 AM on November 8, 2020: contributor

Are you able to reproduce it?

I saw this before. But I cannot reproduce. Its randomly occurs... I feel this is CI side issue.

It happened on Cirrus or Travis?
MarcoFalke commented at 7:25 PM on March 12, 2021: member

Probably an upstream bug in the ci
MarcoFalke closed this on Mar 12, 2021
DrahtBot locked this on Aug 18, 2022

Contributors

Labels

Linked (view graph)

#1 JSON-RPC support for mobile devices ("ultra-lightweight" clients)#2 Long-term, safe, store-of-value #3 Encrypt wallet #4 Export/Import wallet in a human readable, future-proof format #5 Make the version number the protocol version and not the client version #6 Treat wallet as a generic keystore #7 Block-header-only, faster startup client #8 RPC command to sign text with wallet private key #9 Fix for GUI on Macs and latest wxWidgets #10 Add address to listtransactions output #11 Nolisten patch #12 Monitor transactions and/or blocks #13 Messages with or about transactions #14 bitcoin: URI and/or bitcoin-request MIME type for click-to-pay #15 Option to specify external IP address #16 Mac UI issues #17 listaccounts method #18 Error when trying to send very precise amount