test: add libFuzzer harness #1956

This is the harness of PR #744, rebased on the current tree. It is
built as one binary, `fuzz`, which picks the target from the FUZZ
environment variable, as Bitcoin Core does. Like the tests, it includes
secp256k1.c, so that targets for internal functions can be added later.
Module targets live in src/modules/<module>/fuzz_impl.h.

The code is updated to the current API (secp256k1_context_static,
SECP256K1_CONTEXT_NONE, secp256k1_ec_seckey_*), uses
secp256k1_memcmp_var, and is C89 clean under the project's warning
flags. The checks are those of #744, with these changes:

- consume_pubkey copies the x coordinate after the prefix byte instead
  of over it.
- The Pubkey(seckey1+seckey2) check accepts seckey1 + seckey2 == 0 mod
  n, where seckey_tweak_add, pubkey_combine and pubkey_tweak_add all
  return 0. It checks that they agree and fail exactly in that case.
- secret_msg and predefined_pubkey are one byte longer, for the NUL: a
  32-byte literal in a 32-byte array fails -Werror with
  -Wunterminated-string-initialization (clang 23, GCC 15).
- The scratch space block is dropped: secp256k1_scratch_space_create
  left the API in 0.6.0.
- A NULL data pointer with size 0 is replaced by a non-NULL one, since
  the targets do arithmetic on it.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

The fuzz target is built with --enable-fuzz or -DSECP256K1_BUILD_FUZZ=ON
and is off by default. Like tests, it is compiled with VERIFY, so the
library's internal VERIFY_CHECKs run. It is not a test and does not run
in make check or ctest.

The fuzzing engine is linked from FUZZ_LIBS (SECP256K1_FUZZ_LIBS in
CMake), default -fsanitize=fuzzer, into the fuzz target only.
Instrumentation comes from CFLAGS, e.g.
-fsanitize=fuzzer-no-link,address,undefined. This is the split Bitcoin
Core and OSS-Fuzz use, so that LIB_FUZZING_ENGINE can be passed as
FUZZ_LIBS.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

extrakeys checks that keypair and x-only keys agree with
ec_pubkey_create, that x-only keys round-trip through serialization,
and that keypair_xonly_tweak_add, xonly_pubkey_tweak_add and
xonly_pubkey_tweak_add_check agree. Where the two tweak functions
fail, it checks the cause: a tweak >= n, or one that cancels the even-y
secret key.

schnorrsig checks that signing succeeds and verifies, that sign_custom
with a 32-byte message equals sign32, that a NULL aux_rand32 equals an
all-zero one, that a signature with one bit flipped does not verify,
and that a garbage signature does not verify for a key whose secret
nobody knows.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

It checks that decode(encode(pubkey)) is pubkey, that every 64-byte
string decodes to a key that re-parses, that ellswift_create decodes to
ec_pubkey_create's key, and that both parties of ellswift_xdh get the
same secret. Against 64 arbitrary bytes from the peer, as in BIP324, it
checks that the shared x is the x of our secret key times the decoded
peer key.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

Each input runs one two-signer session. It checks that nonce_gen
succeeds for a non-zero session_secrand32, that sorted key aggregation
does not depend on the key order, that both partial signatures verify,
that the aggregate signature verifies with schnorrsig_verify, and that
a tampered partial signature does not verify.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

One sender input pays one recipient. The recipient scans the sent
output among decoys: its own spend key and up to two x-only keys from
the fuzz input. The target checks that the sent output is found, and
that every found output is spendable with the spend key plus its tweak.

create_outputs fails, with one valid input key, only for a spend key
equal to minus the output tweak. There the target retries with the
negated spend key and checks that cause.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

The targets skip inputs that the library rejects as invalid. A library
that rejected every valid secret key, public key or signature would
then pass every run without reaching a check. At startup, the fuzz
binary now aborts unless secret key 1, the generator, a compact ECDSA
signature and, where their modules are enabled, the generator's
x-only key and a partial signature are accepted.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

The job builds with clang, ASan and UBSan, and runs every fuzz target
on an empty corpus for 10000 runs or 20 seconds, whichever comes first.

It passes -len_control=0, so inputs have full length from the first
run. Otherwise libFuzzer lengthens them slowly, and in 10000 runs they
stay under 100 bytes, too short for the musig, ellswift and
silentpayments targets to reach their last checks.

CFLAGS carry -fsanitize=fuzzer-no-link, not -fsanitize=fuzzer: on Linux
clang links the latter as a whole archive, libFuzzer's main included,
into every program it links, which clashes with the main of configure's
checks, the tests and the examples.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

fuzz_check_bool checks that a library function returns 0 or 1, as the
API documents.

Public keys parsed from raw input, compressed and uncompressed, must
serialize back to the input, with a hybrid 0x06/0x07 prefix as 0x04.
This catches a parser that accepts a non-canonical encoding.

Raw 32-byte input also checks that ec_pubkey_create and
ec_seckey_verify accept the same secret keys.

The startup check now runs the consume helpers on secret key 1 and the
generator, instead of the library's parsers, which the unit tests
cover. It aborts on a harness bug like the one in #744's
consume_pubkey, which copied the x coordinate over the prefix byte.

Suggested by erickcestari in #1956.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

The fuzz context is shared across inputs, and secp256k1_context_randomize
builds on the current blinding. The state used for an input therefore
depended on the inputs run before it, and a crash might not reproduce
from its input alone.

Reset the blinding with a NULL seed first. Suggested by erickcestari.