fuzz: Fix assertion in `txorphan` #35972

marcofleon commented at 5:24 PM on August 14, 2026: contributor

EraseTx() calls LimitOrphans(), which may evict announcements from a peer that didn't announce the erased transaction, causing that peer's usage to decrease. Relax the assertion in the EraseTx() branch that claimed usage of a non-announcer peer should be unchanged. Also, add assertions for the other cases.

fuzz: Fix assertion in txorphan

EraseTx calls LimitOrphans, which may evict announcements from a peer
that didn't announce the erased transaction, causing that peer's usage
to decrease. Relax the assertion in the EraseTx branch that claimed
usage of a non-announcer peer is unchanged. Also, add assertions for
the other cases.

01dde6b205

DrahtBot added the label Fuzzing on Aug 14, 2026

DrahtBot commented at 5:24 PM on August 14, 2026: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35972.

Reviews

See the guideline and AI policy for information on the review process.

Type	Reviewers
ACK	dergoegge, instagibbs
Concept ACK	nervana21

If your review is incorrectly listed, please copy-paste <code></code> into the comment that the bot should ignore.

marcofleon commented at 5:35 PM on August 14, 2026: contributor

txorphan_crash.txt

Running the above test case on master you get:

<details> <summary>bad stuff</summary>

FUZZ=txorphan ./fuzzbuild/bin/fuzz minimized-from-b5a139abc5b45708e0c042d4947b0d5730c130d0 
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 741163551
INFO: Loaded 1 modules   (409933 inline 8-bit counters): 409933 [0x5594e19731f0, 0x5594e19d733d), 
INFO: Loaded 1 PC tables (409933 PCs): 409933 [0x5594e19d7340,0x5594e2018810), 
./fuzzbuild/bin/fuzz: Running 1 inputs 1 time(s) each.
Running: minimized-from-b5a139abc5b45708e0c042d4947b0d5730c130d0
../../../../src/test/fuzz/txorphan.cpp:179 auto txorphan_fuzz_target(FuzzBufferType)::(anonymous class)::operator()() const: Assertion `orphanage->UsageByPeer(peer_id) == bytes_from_peer_before' failed.
==336682== ERROR: libFuzzer: deadly signal
    [#0](/bitcoin-bitcoin/0/) 0x5594e06a7554 in __sanitizer_print_stack_trace (/root/bitcoin/fuzzbuild/bin/fuzz+0xd94554) (BuildId: b0307756dfa882aebd4c44771b772f91cd026576)
    [#1](/bitcoin-bitcoin/1/) 0x5594e067afc8 in fuzzer::PrintStackTrace() crtstuff.c
    [#2](/bitcoin-bitcoin/2/) 0x5594e0660533 in fuzzer::Fuzzer::CrashCallback() crtstuff.c
    [#3](/bitcoin-bitcoin/3/) 0x7fc4d2e60a6f  (/usr/lib/x86_64-linux-gnu/libc.so.6+0x40a6f) (BuildId: c9a199fd28ea54b305ea35a8b25500a79bfe684a)
    [#4](/bitcoin-bitcoin/4/) 0x7fc4d2eb73bb  (/usr/lib/x86_64-linux-gnu/libc.so.6+0x973bb) (BuildId: c9a199fd28ea54b305ea35a8b25500a79bfe684a)
    [#5](/bitcoin-bitcoin/5/) 0x7fc4d2e60941 in raise (/usr/lib/x86_64-linux-gnu/libc.so.6+0x40941) (BuildId: c9a199fd28ea54b305ea35a8b25500a79bfe684a)
    [#6](/bitcoin-bitcoin/6/) 0x7fc4d2e484ab in abort (/usr/lib/x86_64-linux-gnu/libc.so.6+0x284ab) (BuildId: c9a199fd28ea54b305ea35a8b25500a79bfe684a)
    [#7](/bitcoin-bitcoin/7/) 0x5594e0d32984 in assertion_fail(std::source_location const&, std::basic_string_view<char, std::char_traits<char>>) /root/bitcoin/fuzzbuild/src/util/../../../src/util/check.cpp:41:5
    [#8](/bitcoin-bitcoin/8/) 0x5594e09fb47a in unsigned long CallOneOf<txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_2, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_3, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_4, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_5, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_6, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_7>(FuzzedDataProvider&, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_2, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_3, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_4, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_5, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_6, txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>)::$_7) /root/bitcoin/fuzzbuild/src/test/fuzz/../../../../src/test/fuzz/util.h:44:27
    [#9](/bitcoin-bitcoin/9/) 0x5594e09fb47a in txorphan_fuzz_target(std::span<unsigned char const, 18446744073709551615ul>) /root/bitcoin/fuzzbuild/src/test/fuzz/../../../../src/test/fuzz/txorphan.cpp:112:13
    [#10](/bitcoin-bitcoin/10/) 0x5594e0b155dc in std::function<void (std::span<unsigned char const, 18446744073709551615ul>)>::operator()(std::span<unsigned char const, 18446744073709551615ul>) const /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/std_function.h:591:9
    [#11](/bitcoin-bitcoin/11/) 0x5594e0b155dc in test_one_input(std::span<unsigned char const, 18446744073709551615ul>) /root/bitcoin/fuzzbuild/src/test/fuzz/util/../../../../../src/test/fuzz/fuzz.cpp:86:5
    [#12](/bitcoin-bitcoin/12/) 0x5594e0b155dc in LLVMFuzzerTestOneInput /root/bitcoin/fuzzbuild/src/test/fuzz/util/../../../../../src/test/fuzz/fuzz.cpp:214:5
    [#13](/bitcoin-bitcoin/13/) 0x5594e0661a76 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) crtstuff.c
    [#14](/bitcoin-bitcoin/14/) 0x5594e064a6af in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) crtstuff.c
    [#15](/bitcoin-bitcoin/15/) 0x5594e06506a1 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) crtstuff.c
    [#16](/bitcoin-bitcoin/16/) 0x5594e067b9c2 in main (/root/bitcoin/fuzzbuild/bin/fuzz+0xd689c2) (BuildId: b0307756dfa882aebd4c44771b772f91cd026576)
    [#17](/bitcoin-bitcoin/17/) 0x7fc4d2e49f74  (/usr/lib/x86_64-linux-gnu/libc.so.6+0x29f74) (BuildId: c9a199fd28ea54b305ea35a8b25500a79bfe684a)
    [#18](/bitcoin-bitcoin/18/) 0x7fc4d2e4a026 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a026) (BuildId: c9a199fd28ea54b305ea35a8b25500a79bfe684a)
    [#19](/bitcoin-bitcoin/19/) 0x5594e0645020 in _start (/root/bitcoin/fuzzbuild/bin/fuzz+0xd32020) (BuildId: b0307756dfa882aebd4c44771b772f91cd026576)

NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal

</details>

Running on this branch, you don't.