Add fuzzing dictionaries #122

pull dergoegge wants to merge 1 commits into bitcoin-core:main from dergoegge:2023-05-fuzz-dicts changing 2 files +86 −0

dergoegge commented at 3:09 PM on May 5, 2023: member

For use with libFuzzer's -dict option.
dergoegge commented at 3:11 PM on May 5, 2023: member

I think oss-fuzz supports these as well (not 100% sure)
fanquake commented at 3:37 PM on May 5, 2023: member

cc @darosior
darosior commented at 3:46 PM on May 5, 2023: member

It could be useful for the miniscript_string target, but as you mentioned libfuzzer was already pretty effective at finding them already. Is it useful beyond guiding the fuzzer through the first runs without coverage?

For what it's worth another approach i've used for initially seeding the miniscript_string corpus was to generate random miniscripts using the unit test and writing them to the corpus directory.
dergoegge commented at 4:01 PM on May 5, 2023: member

Is it useful beyond guiding the fuzzer through the first runs without coverage?

Not sure. From the libFuzzer docs: "For some input languages using a dictionary may significantly improve the search speed.". I will try to benchmark the miniscript_string target with and without the dict to see if that is the case for miniscript.

For what it's worth another approach i've used for initially seeding the miniscript_string corpus was to generate random miniscripts using the unit test and writing them to the corpus directory.

Yea that is good practice but only works for targets with common input formats (e.g. a miniscript string), for targets that use FuzzedDataProvider seeding is not really feasible.
darosior commented at 6:10 PM on May 16, 2023: member

Just used the dict for a new (more efficient) descriptor parsing target i'm working on, FWIW. Worked great and definitely easier than seeding the dir yourselves with unit tests.
dergoegge commented at 3:41 PM on May 24, 2023: member

@MarcoFalke thoughts?
maflcko commented at 7:40 AM on May 25, 2023: contributor

lgtm, but I probably won't be using them. Usually what I do is to add a instrumentation, such as std::cout, to the the data handling function (for example descriptor parse) and then write each call to a file, while running the unit test, functional tests, and some manual fiddling in production. I guess it boils down to personal preference what way people prefer (https://github.com/bitcoin-core/qa-assets/pull/122#issuecomment-1550139013)
in fuzz_dicts/miniscript.dict:23 in d1da2b9e1a outdated
```
  18 | +")"
  19 | +"/"
  20 | +"()"
  21 | +":"
  22 | +"1"
  23 | +"0"
```
darosior commented at 7:45 AM on May 25, 2023:

If you undraft this might be worth making it a descriptor dict, including output type expressions (wsh, combo, tr, {, ...). Also pk and pkh.
darosior commented at 12:14 PM on May 25, 2023:

The descriptors.dict ive been using in case you haven't written it already:

"pk_h" "pk_k" "older" "after" "sha256" "andor" "and_v" "and_b" "and_n" "or_b" "or_c" "or_d" "or_i" "multi" "multi_a" "thresh" "(" ")" "[" "]" "/" "*" "'" "h" ":" "1" "0" "combo" "sh" "wsh" "wpkh" "tr" "{" "}" "pkh" "pk" "addr" "raw" "rawtr" "sortedmulti" "sortedmulti_a"
dergoegge commented at 12:24 PM on May 25, 2023:

Thank you! I'll use this and undraft shortly
darosior commented at 12:16 PM on May 25, 2023: member

Concept ACK
dergoegge force-pushed on May 26, 2023
dergoegge marked this as ready for review on May 26, 2023
dergoegge commented at 1:29 PM on May 26, 2023: member

Updated the descriptor dict and un-drafted.
fanquake requested review from darosior on May 26, 2023

Add initial fuzzing dictionaries

Co-authored-by: Antoine Poinsot <darosior@protonmail.com>

e4f07ff3d7

in fuzz_dicts/descriptors.dict:27 in b29cdc9f0b outdated
```
  22 | +"*"
  23 | +"'"
  24 | +"h"
  25 | +":"
  26 | +"1"
  27 | +"0"
```
darosior commented at 4:36 PM on May 26, 2023:

How about adding the Miniscript type modifiers too? Maybe there is little point since it's only a single letter?

dergoegge commented at 9:48 AM on June 6, 2023:

Added them, can't hurt.
dergoegge force-pushed on Jun 6, 2023
brunoerg commented at 6:42 PM on June 13, 2023: none
Concept ACK. I've been using dicts frequently.

e.g. for net_permissions:
```
"@"
"["
"]"
"bloomfilter"
"bloom"
"noban"
"forcerelay"
"mempool"
"download"
"all"
"relay"
"addr"
```
darosior commented at 10:33 AM on June 14, 2023: member

ACK e4f07ff3d7e21d4b747149eb5cf19bf95bdf44ef
fanquake merged this on Jun 16, 2023
fanquake closed this on Jun 16, 2023

Contributors