Add http_request inputs covering the chunked body branch #293

pull jeanpablojp wants to merge 1 commits into bitcoin-core:main from jeanpablojp:http-request-chunked-seed changing 120 files +922 −0

jeanpablojp commented at 11:59 AM on September 4, 2026: none

The Transfer-Encoding: chunked branch of LoadBody() has been in master since bitcoin/bitcoin#35182, and bitcoin/bitcoin#35759 added an assertion in the http_request target for the body it produces. Neither runs today: none of the 146 inputs in this target's corpus enters the branch, so the assertion never fires.

The fuzzer does not get there on its own. Against master's target, seeded from the current corpus, 1.66M executions with fuzz_dicts/http_request.dict stayed out of the branch, and so did 1.79M with "chunked" added to that dictionary.

These inputs come from the current corpus plus one chunked request I wrote by hand, run for the 100 minutes generate_corpus uses and merged back with the flags merge_inputs uses. 52 of the 120 enter the branch and 3 reach the assertion. Merging them into the corpus keeps all 120, so none is redundant.

Add http_request inputs covering the chunked body branch

LoadBody()'s Transfer-Encoding: chunked branch has been in master since
bitcoin/bitcoin#35182, and bitcoin/bitcoin#35759 added an assertion in
the http_request target for the body that branch produces. Neither one
runs against the corpus here: of the 146 http_request inputs in main,
none enters the chunked branch and none reaches that assertion.

Getting there needs the header name and the value together inside an
otherwise valid request, and the fuzzer does not find that on its own.
Against master's target, seeded from the current corpus, neither 1.66M
executions with fuzz_dicts/http_request.dict nor 1.79M with "chunked"
added to it entered the branch, both with -use_value_profile=1 and
-max_len=32768.

Seeded with the current corpus plus one hand-written chunked request and
run for the 100 minutes generate_corpus uses, 15.7M executions, then
merged back with the flags merge_inputs uses. Of the 120 inputs, 52
enter the chunked branch and 3 reach the assertion from #35759; the rest
are what that run turned up along the way.

2e804490c1

Contributors

jeanpablojp