Add Murch’s fuzz seeds June 2024 (2nd attempt) #186

I tried a variant of the prior approach. I moved the upstream seeds to a separate directory, created a set_cover_merge from the existing and the new seeds from scratch, then restored the upstream entries.
After that I did a second set_cover_merge with the target directory already having the resulting seeds from first merge. I found that it added seeds to several targets that increased the feature count, but on a few targets also increased coverage.

mv fuzz_seed_corpus fuzz_inputs_upstream
test/fuzz/test_runner.py -l DEBUG --par $( nproc ) --m_dir ./fuzz_inputs_upstream/  --m_dir ./active-fuzzing      fuzz_seed_corpus
git restore -- ./fuzz_seed_corpus
test/fuzz/test_runner.py -l DEBUG --par $( nproc ) --m_dir ./fuzz_inputs_upstream/  --m_dir ./active-fuzzing      fuzz_seed_corpus
git add ./fuzz_seed_corpus
git commit -m "Add Murch’s fuzz seeds June 2024"

I also did some additional fuzzing for timeoffsets and scriptpubkeyman given their recent updates.

Before: https://drahtbot.space/host_reports/DrahtBot/reports/coverage_fuzz/monotree/f7a6d3444973421b/cad8fa8d8c4d8264/fuzz.coverage/index.html After: https://drahtbot.space/host_reports/DrahtBot/reports/coverage_fuzz/monotree/9efc2af3be581797/8d624b44419f46bc/fuzz.coverage/index.html

I found that it added seeds to several targets that increased the feature count, but on a few targets also increased coverage.

This is expected, see https://github.com/bitcoin/bitcoin/issues/29018

About the CI error: I guess you'll have to increase the rss limit for run_once (c.f. https://github.com/bitcoin/bitcoin/blame/9efc2af3be5817972d9899893c343fc4deab7df5/test/fuzz/test_runner.py#L299C14-L299C28), or change the fuzz target.

Looks like 30 more lines are covered, according to my coverage report.

However, the msan task runtime also doubled, apart from the failure? Seems odd, because the others stayed roughly the same.

Perhaps it found some significantly longer seeds that increase the coverage but take longer to run?

I could merge the package_rbf seeds again with a lower limit?

It could also be a bug in the fuzz target. Not sure if it changed recently.

I think package_rbf just got added in March or April.

I did fuzz the three targets feefrac, build_and_compare_feerate_diagram, and package_rbf somewhat heavily when I got my new workstation since they were pretty new, so my active fuzzing directory would have the results of a few hundred extra CPU hours fuzzing package_rbf.

I realized that wallet_bdb_parser got added and fuzzed it a bit last night. Just added the seeds in a second commit.

Run wallet_bdb_parser with args ['/ci_container_base/ci/scratch/build/bitcoin-x86_64-pc-linux-gnu/src/test/fuzz/fuzz', '-runs=1', PosixPath('/ci_container_base/ci/scratch/qa-assets/fuzz_seed_corpus/wallet_bdb_parser')]INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3961532020
INFO: Loaded 1 modules   (583901 inline 8-bit counters): 583901 [0x55692c3d17e8, 0x55692c4600c5), 
INFO: Loaded 1 PC tables (583901 PCs): 583901 [0x55692c4600c8,0x55692cd48e98), 
INFO:       44 files found in /ci_container_base/ci/scratch/qa-assets/fuzz_seed_corpus/wallet_bdb_parser
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: seed corpus: files: 44 min: 1b max: 1237b total: 32203b rss: 160Mb
wallet/migrate.cpp:554:35: runtime error: implicit conversion from type 'int64_t' (aka 'long') of value -1 (64-bit, signed) to type 'uint32_t' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned)
    [#0](/bitcoin-core-qa-assets/0/) 0x55692a5f5353 in wallet::BerkeleyRODatabase::Open() src/wallet/migrate.cpp:554:35
    [#1](/bitcoin-core-qa-assets/1/) 0x55692a605a6e in wallet::BerkeleyRODatabase::BerkeleyRODatabase(fs::path const&, bool) src/./wallet/migrate.h:29:19
    [#2](/bitcoin-core-qa-assets/2/) 0x55692a5fba8c in std::__detail::_MakeUniq<wallet::BerkeleyRODatabase>::__single_object std::make_unique<wallet::BerkeleyRODatabase, fs::path&>(fs::path&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/unique_ptr.h:1070:34
    [#3](/bitcoin-core-qa-assets/3/) 0x55692a5fba8c in wallet::MakeBerkeleyRODatabase(fs::path const&, wallet::DatabaseOptions const&, wallet::DatabaseStatus&, bilingual_str&) src/wallet/migrate.cpp:775:50
    [#4](/bitcoin-core-qa-assets/4/) 0x556929373d8b in wallet_bdb_parser_fuzz_target(Span<unsigned char const>) src/wallet/test/fuzz/wallet_bdb_parser.cpp:57:13
    [#5](/bitcoin-core-qa-assets/5/) 0x5569298f4d3d in std::function<void (Span<unsigned char const>)>::operator()(Span<unsigned char const>) const /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_function.h:591:9
    [#6](/bitcoin-core-qa-assets/6/) 0x5569298f4d3d in LLVMFuzzerTestOneInput src/test/fuzz/fuzz.cpp:201:5
    [#7](/bitcoin-core-qa-assets/7/) 0x55692921b044 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/ci_container_base/ci/scratch/build/bitcoin-x86_64-pc-linux-gnu/src/test/fuzz/fuzz+0x1aae044) (BuildId: 7154ae27bd1f5ece90cc0583ab3298ddfefc46d0)
    [#8](/bitcoin-core-qa-assets/8/) 0x55692921a739 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/ci_container_base/ci/scratch/build/bitcoin-x86_64-pc-linux-gnu/src/test/fuzz/fuzz+0x1aad739) (BuildId: 7154ae27bd1f5ece90cc0583ab3298ddfefc46d0)
    [#9](/bitcoin-core-qa-assets/9/) 0x55692921c356 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/ci_container_base/ci/scratch/build/bitcoin-x86_64-pc-linux-gnu/src/test/fuzz/fuzz+0x1aaf356) (BuildId: 7154ae27bd1f5ece90cc0583ab3298ddfefc46d0)
    [#10](/bitcoin-core-qa-assets/10/) 0x55692921c867 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/ci_container_base/ci/scratch/build/bitcoin-x86_64-pc-linux-gnu/src/test/fuzz/fuzz+0x1aaf867) (BuildId: 7154ae27bd1f5ece90cc0583ab3298ddfefc46d0)
    [#11](/bitcoin-core-qa-assets/11/) 0x556929209d5f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/ci_container_base/ci/scratch/build/bitcoin-x86_64-pc-linux-gnu/src/test/fuzz/fuzz+0x1a9cd5f) (BuildId: 7154ae27bd1f5ece90cc0583ab3298ddfefc46d0)
    [#12](/bitcoin-core-qa-assets/12/) 0x5569292343e6 in main (/ci_container_base/ci/scratch/build/bitcoin-x86_64-pc-linux-gnu/src/test/fuzz/fuzz+0x1ac73e6) (BuildId: 7154ae27bd1f5ece90cc0583ab3298ddfefc46d0)
    [#13](/bitcoin-core-qa-assets/13/) 0x7fe3a6d2b1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 08134323d00289185684a4cd177d202f39c2a5f3)
    [#14](/bitcoin-core-qa-assets/14/) 0x7fe3a6d2b28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 08134323d00289185684a4cd177d202f39c2a5f3)
    [#15](/bitcoin-core-qa-assets/15/) 0x5569291fed44 in _start (/ci_container_base/ci/scratch/build/bitcoin-x86_64-pc-linux-gnu/src/test/fuzz/fuzz+0x1a91d44) (BuildId: 7154ae27bd1f5ece90cc0583ab3298ddfefc46d0)

SUMMARY: UndefinedBehaviorSanitizer: implicit-signed-integer-truncation wallet/migrate.cpp:554:35 
MS: 0 ; base unit: 0000000000000000000000000000000000000000
artifact_prefix='./'; Test unit written to ./crash-580fdb975cf6c529d5f97b0c61b2ce15b59cbb98

The msan CI failure: It spends a long time hashing the large transaction, which has a large witness. The runtime is NUM_ITERS (aka 10'000) times n (size of the transaction), because the hashing is done in the loop.

https://drahtbot.space/host_reports/DrahtBot/reports/coverage_fuzz/monotree/9efc2af3be581797/24c507b3ea6263e6/fuzz.coverage/index.html

SUMMARY: UndefinedBehaviorSanitizer: implicit-signed-integer-truncation wallet/migrate.cpp:554:35 

That’s odd, my fuzzer is generally configured with --with-sanitizers=address,fuzzer,undefined

The msan CI failure: It spends a long time hashing the large transaction, which has a large witness. The runtime is NUM_ITERS (aka 10'000) times n (size of the transaction), because the hashing is done in the loop.

Sounds like we should limit the size of the transaction in the fuzz target?

That’s odd, my fuzzer is generally configured with --with-sanitizers=address,fuzzer,undefined

The integer sanitizer is a different sanitizer from the undefined sanitizer

One downside of only submitting every two months is that I rediscover every time how all of this actually works. :sweat_smile:

I am now redoing the merge with all sanitizers. I then intend to manually re-merge package_rbf enforcing a shorter limit for the seeds.

As discussed, I removed the two problematic seeds for the moment. I used a separate commit to make it easy to revert the removal, when the underlying issue has been addressed.

There is still one or more ISan triggering inputs in the wallet_bdb_parser corpus

You can test locally if you removed all violating fuzz inputs:

CC=clang CXX=clang++ ./configure --enable-fuzz --with-sanitizers=fuzzer,undefined,integer,float-divide-by-zero && make clean && make
FUZZ=wallet_bdb_parser UBSAN_OPTIONS="suppressions=$(pwd)/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1" ./src/test/fuzz/fuzz -runs=1 ../qa-assets/fuzz_seed_corpus/wallet_bdb_parser

lgtm