Fill various small fuzzing gaps.
See doc/fuzzing.md for information on how to fuzz Bitcoin Core. Don't forget to contribute any coverage increasing inputs you find to the Bitcoin Core fuzzing corpus repo.
Happy fuzzing :)
Fill various small fuzzing gaps.
See doc/fuzzing.md for information on how to fuzz Bitcoin Core. Don't forget to contribute any coverage increasing inputs you find to the Bitcoin Core fuzzing corpus repo.
Happy fuzzing :)
<!--e57a25ab6845829454e8d69fc972939a-->
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
<!--174a7506f384e20aa4161008e828411d-->
No conflicts as of last run.
19 | +void test_one_input(const std::vector<uint8_t>& buffer) 20 | +{ 21 | + FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()}; 22 | + CDataStream data_stream = ConsumeDataStream(fuzzed_data_provider); 23 | + switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 1)) { 24 | + case 0: {
I don't really like re-using the same seed for different serialization formats. I think it would be better to have separate targets (and folders) for this
Fixed!
24 | @@ -23,4 +25,19 @@ FUZZ_TARGET(kitchen_sink) 25 | (void)JSONRPCTransactionError(transaction_error); 26 | (void)RPCErrorFromTransactionError(transaction_error); 27 | (void)TransactionErrorString(transaction_error); 28 | + 29 | + (void)StringForFeeEstimateHorizon(fuzzed_data_provider.PickValueInArray({FeeEstimateHorizon::SHORT_HALFLIFE, FeeEstimateHorizon::MED_HALFLIFE, FeeEstimateHorizon::LONG_HALFLIFE}));
would be nice to introduce an ALL_FEE_EST_HORIZON constexpr
Fixed!
14 | +void initialize_data_stream() 15 | +{ 16 | + InitializeFuzzingContext(); 17 | +} 18 | + 19 | +FUZZ_TARGET_INIT(data_stream, initialize_data_stream)
FUZZ_TARGET_INIT(data_stream_addr_man, initialize_data_stream_addr_man)
Fixed!
ACK, some nits
@MarcoFalke Thanks for reviewing. Feedback addressed. Please re-review :)
24 | + CAddrDB::Read(addr_man, data_stream); 25 | +} 26 | + 27 | +void initialize_data_stream_net_message() 28 | +{ 29 | + InitializeFuzzingContext();
Can you explain why it is required to boot up a full node to call a single constructor that only invokes std::move. Maybe the whole fuzz test isn't particularly useful, when it only calls std::move, which is already covered by other fuzz targets: https://marcofalke.github.io/btc_cov/fuzz.coverage/src/net.h.gcov.html#745
Good catch. Removing :)
Feedback addressed. Should hopefully be ready for final review :)
review ACK 4ddbcd0d9abe40cd387e63d8c4817e0fe36004dc