fuzz: Cover block filter P2P messages #36337

pull maflcko wants to merge 1 commits into bitcoin:master from maflcko:2609-fuzz-block-filter-p2p changing 4 files +27 −6

maflcko commented at 5:34 PM on September 25, 2026: member

The BIP157 P2P messages are not covered by any fuzz targets at all.

Fix this to cover them via the P2P targets.

Should be possible to test by verifying the integer sanitizer is triggered (https://github.com/bitcoin/bitcoin/pull/36321#issuecomment-5810977529):

$ echo 'FwAAAAEAAABcX2dldGNmY2hlY2twdAAftOvdD0sFqXEx6US5VIknlsOJqZ5goMwtmwZBPdCxQVxf
AfkGKP39/f0v/Q/9E1AP/f2ybAT1Af39A/399wEAuXEAAAAAAAAAAAB1z3QAbgAAQAHm/f39/f39
/f39/S8/D/0B/f3IAAcBBWNmaf8DAAAA' | base64 --decode > /tmp/msg.bin

$ UBSAN_OPTIONS="suppressions=$(pwd)/test/sanitizer_suppressions/ubsan:print_stacktrace=0:halt_on_error=0:report_error_type=1" FUZZ=process_messages ./bld-cmake/bin/fuzz /tmp/msg.bin 

./bld-cmake/bin/fuzz: Running 1 inputs 1 time(s) each.
/src/net_processing.cpp:3662:33: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'size_type' (aka 'unsigned long')
/src/net_processing.cpp:3662:18: runtime error: implicit conversion from type 'size_type' (aka 'unsigned long') of value 18446744073709551615 (64-bit, unsigned) to type 'int' changed the value to -1 (32-bit, signed)

fuzz: Cover block filter P2P messages fa488f53c3
DrahtBot added the label Fuzzing on Sep 25, 2026
DrahtBot commented at 5:34 PM on September 25, 2026: contributor



The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/36337.



Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.
DrahtBot added the label CI failed on Sep 25, 2026
DrahtBot commented at 6:34 PM on September 25, 2026: contributor


🚧 At least one of the CI tasks failed. <sub>Task MSan, fuzz: https://github.com/bitcoin/bitcoin/actions/runs/36168019330/job/108180422242</sub> <sub>LLM reason (✨ experimental): MemorySanitizer (fuzz test) reported a use of an uninitialized value in BaseIndex::Stop() (base.cpp:479), causing exit code 1 and the CI failure.</sub>

<details><summary>Hints</summary>

Try to run the tests locally, according to the documentation. However, a CI failure may still happen due to a number of reasons, for example:
- Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.
- A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.
- An intermittent issue.
Leave a comment here, if you need help tracking down a confusing failure.

</details>
Crypt-iQ commented at 3:37 PM on September 26, 2026: contributor

I think CI failures are because in process_message(s) the static testing_setup is destructed before static g_filter_indexes so BaseIndex::Stop will try to access testing_setup.m_node.

in src/test/util/validation.cpp:150 in fa488f53c3

 145 | +        Assert(index.Init());
 146 | +        index.Sync();
 147 | +        // The index serves the static setup chain only. Leaving it registered
 148 | +        // deadlocks with ImmediateBackgroundTaskRunner when a fuzzed block
 149 | +        // connects under cs_main.
 150 | +        index.Stop();

Crypt-iQ commented at 4:28 PM on September 26, 2026:

Can you explain why it deadlocks? I couldn't figure this bit out

Contributors

Labels

Linked (view graph)

#36321 net: cast vector size to avoid overflow, truncation, sign change

fuzz: Cover block filter P2P messages #36337

Code Coverage & Benchmarks

Reviews