Merge pull request #54 from hax0kartik/bitcoin-fuzz

Replace fuzzer.cpp with bitcoin core's fuzz.cpp
brunoerg · Jul 3, 2024 · caf44c1 · caf44c1
2 parents 21c9ab9 + 385d429
commit caf44c1
Show file tree

Hide file tree

Showing 21 changed files with 32 additions and 146 deletions.
diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml
@@ -62,4 +62,4 @@ jobs:
           fi
 
       - name: Test
-        run: ./bitcoinfuzz -detect_leaks=0 -runs=0
+        run: PRINT_ALL_FUZZ_TARGETS_AND_ABORT=1 ./bitcoinfuzz
diff --git a/Makefile b/Makefile
@@ -18,7 +18,7 @@ endif
 .PHONY: bitcoinfuzz bitcoin cargo go clean
 
 bitcoinfuzz: set $(OBJS) bitcoin cargo go
-	$(CXX) fuzzer.cpp -o $@ $(OBJS) $(CXXFLAGS) $(LDFLAGS)
+	$(CXX) dependencies/bitcoin/src/test/fuzz/fuzz.cpp -o $@ $(OBJS) $(CXXFLAGS) $(LDFLAGS)
 
 $(OBJS) : build/%.o: %.cpp
 	@[ -d $(@D) ] || mkdir -p $(@D)

diff --git a/fuzzer.cpp b/fuzzer.cpp
diff --git a/targets/addrv2.cpp b/targets/addrv2.cpp
@@ -3,12 +3,12 @@
 #include <optional>
 #include <stdio.h>
 
-#include "addrv2.h"
+#include "bitcoin/src/test/fuzz/fuzz.h"
 #include "bitcoin/src/protocol.h"
 #include "bitcoin/src/streams.h"
 
-extern "C" bool rust_bitcoin_addrv2(uint8_t *data, size_t len, uint64_t *count);
-extern "C" bool go_btcd_addrv2(uint8_t *data, size_t len, uint64_t *count);
+extern "C" bool rust_bitcoin_addrv2(const uint8_t *data, size_t len, uint64_t *count);
+extern "C" bool go_btcd_addrv2(const uint8_t *data, size_t len, uint64_t *count);
 
 std::optional<std::pair<uint64_t, uint64_t>> Addrv2Core(Span<const uint8_t> buffer) 
 {
@@ -29,9 +29,8 @@ std::optional<std::pair<uint64_t, uint64_t>> Addrv2Core(Span<const uint8_t> buff
     return std::make_pair(addrs.size(), clearnet_tor_count);
 }
 
-void Addrv2(FuzzedDataProvider& provider)
+FUZZ_TARGET(addrv2)
 {
-    std::vector<uint8_t> buffer{provider.ConsumeRemainingBytes<uint8_t>()};
     uint64_t count_rust = 0, count_btcd = 0;
     [[maybe_unused]] bool rust_bitcoin{rust_bitcoin_addrv2(buffer.data(), buffer.size(), &count_rust)};
     [[maybe_unused]] bool btcd{go_btcd_addrv2(buffer.data(), buffer.size(), &count_btcd)};

diff --git a/targets/addrv2.h b/targets/addrv2.h
diff --git a/targets/bech32.cpp b/targets/bech32.cpp
@@ -3,11 +3,11 @@
 #include <iostream>
 #include <stdio.h>
 
-#include "bech32.h"
+#include "bitcoin/src/test/fuzz/fuzz.h"
 #include "bitcoin/src/bech32.h"
 #include "bitcoin/src/streams.h"
 
-extern "C" char* go_btcd_bech32(uint8_t *data, size_t len);
+extern "C" char* go_btcd_bech32(const uint8_t *data, size_t len);
 
 std::string Bech32Core(Span<const uint8_t> buffer)
 {
@@ -20,10 +20,8 @@ std::string Bech32Core(Span<const uint8_t> buffer)
 }
 
 
-void Bech32(FuzzedDataProvider& provider) 
+FUZZ_TARGET(bech32)
 {
-    std::vector<uint8_t> buffer{provider.ConsumeRemainingBytes<uint8_t>()};
-
     std::string core{Bech32Core(buffer)};
     std::string go_btcd{go_btcd_bech32(buffer.data(), buffer.size())};
 

diff --git a/targets/bech32.h b/targets/bech32.h
diff --git a/targets/block_des.cpp b/targets/block_des.cpp
@@ -3,12 +3,12 @@
 #include <iostream>
 #include <stdio.h>
 
-#include "block_des.h"
+#include "bitcoin/src/test/fuzz/fuzz.h"
 #include "bitcoin/src/primitives/block.h"
 #include "bitcoin/src/streams.h"
 
 extern "C" char* rust_bitcoin_des_block(const uint8_t *data, size_t len);
-extern "C" char* go_btcd_des_block(uint8_t *data, size_t len);
+extern "C" char* go_btcd_des_block(const uint8_t *data, size_t len);
 
 std::string BlockDesCore(Span<const uint8_t> buffer)
 {
@@ -24,10 +24,8 @@ std::string BlockDesCore(Span<const uint8_t> buffer)
 }
 
 // This target is expected to crash, needs some verification (e.g. segwit version).
-void BlockDes(FuzzedDataProvider& provider) 
+FUZZ_TARGET(block_des)
 {
-    std::vector<uint8_t> buffer{provider.ConsumeRemainingBytes<uint8_t>()};
-
     std::string core{BlockDesCore(buffer)};
     std::string rust_bitcoin{rust_bitcoin_des_block(buffer.data(), buffer.size())};
     std::string go_btcd{go_btcd_des_block(buffer.data(), buffer.size())};

diff --git a/targets/block_des.h b/targets/block_des.h
diff --git a/targets/cmpctblocks.cpp b/targets/cmpctblocks.cpp
@@ -2,11 +2,11 @@
 #include <string>
 #include <iostream>
 
-#include "cmpctblocks.h"
+#include "bitcoin/src/test/fuzz/fuzz.h"
 #include "bitcoin/src/blockencodings.h"
 #include "bitcoin/src/streams.h"
 
-extern "C" int rust_bitcoin_cmpctblocks(uint8_t *data, size_t len);
+extern "C" int rust_bitcoin_cmpctblocks(const uint8_t *data, size_t len);
 
 int CmpctBlocksCore(Span<const uint8_t> buffer) 
 {
@@ -22,9 +22,8 @@ int CmpctBlocksCore(Span<const uint8_t> buffer)
     return block_header_and_short_txids.BlockTxCount();
 }
 
-void CmpctBlocks(FuzzedDataProvider& provider)
+FUZZ_TARGET(cmpct_blocks)
 {
-    std::vector<uint8_t> buffer{provider.ConsumeRemainingBytes<uint8_t>()};
     int core{CmpctBlocksCore(buffer)};
     int rust_bitcoin{rust_bitcoin_cmpctblocks(buffer.data(), buffer.size())};
 

diff --git a/targets/cmpctblocks.h b/targets/cmpctblocks.h
diff --git a/targets/miniscript_string.cpp b/targets/miniscript_string.cpp
@@ -3,7 +3,7 @@
 #include <iostream>
 #include <script/miniscript.h>
 
-#include "miniscript_string.h"
+#include "bitcoin/src/test/fuzz/fuzz.h"
 #include "bitcoin/src/pubkey.h"
 #include "bitcoin/src/key.h"
 
@@ -184,8 +184,11 @@ bool BitcoinCoreString(const std::string& input_str)
     return false;
 }
 
-void MiniscriptFromString(FuzzedDataProvider& provider) 
+FUZZ_TARGET(miniscript_from_string)
 {
+    if (buffer.empty()) return;
+    FuzzedDataProvider provider(buffer.data(), buffer.size());
+
     std::string input_str{provider.ConsumeRemainingBytesAsString().c_str()};
     const bool core{BitcoinCoreString(input_str)};
     const std::string rust_miniscript{rust_miniscript_from_str_check_key(input_str.c_str())};

diff --git a/targets/miniscript_string.h b/targets/miniscript_string.h
diff --git a/targets/prefilledtransaction.cpp b/targets/prefilledtransaction.cpp
@@ -3,6 +3,7 @@
 #include <iostream>
 #include <stdio.h>
 
+#include "bitcoin/src/test/fuzz/fuzz.h"
 #include "bitcoin/src/blockencodings.h"
 #include "bitcoin/src/streams.h"
 
@@ -20,9 +21,8 @@ std::optional<uint16_t> PrefilledTransactionCore(Span<const uint8_t> buffer)
     return tx.index;
 }
 
-void PrefilledTransactionTarget(FuzzedDataProvider& provider) 
+FUZZ_TARGET(prefilled_transaction)
 {
-    std::vector<uint8_t> buffer{provider.ConsumeRemainingBytes<uint8_t>()};
     auto core{PrefilledTransactionCore(buffer)};
     std::string rust_bitcoin{rust_bitcoin_prefilledtransaction(buffer.data(), buffer.size())};
     if (rust_bitcoin == "unsupported segwit version") return;

diff --git a/targets/prefilledtransaction.h b/targets/prefilledtransaction.h
diff --git a/targets/psbt.cpp b/targets/psbt.cpp
@@ -4,11 +4,13 @@
 #include <stdio.h>
 
 #include "psbt.h"
+
+#include "bitcoin/src/test/fuzz/fuzz.h"
 #include "bitcoin/src/psbt.h"
 #include "bitcoin/src/span.h"
 #include "bitcoin/src/node/psbt.h"
 
-extern "C" char* rust_bitcoin_psbt(uint8_t *data, size_t len);
+extern "C" char* rust_bitcoin_psbt(const uint8_t *data, size_t len);
 
 bool PSBTCore(Span<const uint8_t> buffer)
 {
@@ -21,9 +23,8 @@ bool PSBTCore(Span<const uint8_t> buffer)
 }
 
 
-void Psbt(FuzzedDataProvider& provider)
+FUZZ_TARGET(psbt)
 {
-    std::vector<uint8_t> buffer{provider.ConsumeRemainingBytes<uint8_t>()};
     bool core{PSBTCore(buffer)};
     std::string rust_bitcoin{rust_bitcoin_psbt(buffer.data(), buffer.size())};
     if (rust_bitcoin == "invalid xonly public key" || 

diff --git a/targets/psbt.h b/targets/psbt.h
diff --git a/targets/script.cpp b/targets/script.cpp
@@ -2,11 +2,11 @@
 #include <iostream>
 #include <stdio.h>
 
-#include "script.h"
+#include "bitcoin/src/test/fuzz/fuzz.h"
 #include "bitcoin/src/streams.h"
 #include "bitcoin/src/script/script.h"
 
-extern "C" bool rust_bitcoin_script(uint8_t *data, size_t len);
+extern "C" bool rust_bitcoin_script(const uint8_t *data, size_t len);
 
 bool CoreScript(Span<const uint8_t> buffer)
 {
@@ -22,9 +22,8 @@ bool CoreScript(Span<const uint8_t> buffer)
 }
 
 
-void Script(FuzzedDataProvider& provider)
+FUZZ_TARGET(script)
 {
-    std::vector<uint8_t> buffer{provider.ConsumeRemainingBytes<uint8_t>()};
     bool core{CoreScript(buffer)};
     bool rust_bitcoin{rust_bitcoin_script(buffer.data(), buffer.size())};
     assert(core == rust_bitcoin);

diff --git a/targets/script.h b/targets/script.h
diff --git a/targets/tx_des.cpp b/targets/tx_des.cpp
@@ -3,13 +3,13 @@
 #include <iostream>
 #include <stdio.h>
 
-#include "tx_des.h"
+#include "bitcoin/src/test/fuzz/fuzz.h"
 #include "bitcoin/src/consensus/tx_check.h"
 #include "bitcoin/src/consensus/validation.h"
 #include "bitcoin/src/primitives/block.h"
 #include "bitcoin/src/streams.h"
 
-extern "C" char* go_btcd_des_tx(uint8_t *data, size_t len);
+extern "C" char* go_btcd_des_tx(const uint8_t *data, size_t len);
 
 std::string TransactionDesCore(Span<const uint8_t> buffer)
 {
@@ -28,10 +28,8 @@ std::string TransactionDesCore(Span<const uint8_t> buffer)
     return "";
 }
 
-void TransactionDes(FuzzedDataProvider& provider) 
+FUZZ_TARGET(transaction_des)
 {
-    std::vector<uint8_t> buffer{provider.ConsumeRemainingBytes<uint8_t>()};
-
     std::string core{TransactionDesCore(buffer)};
     std::string go_btcd{go_btcd_des_tx(buffer.data(), buffer.size())};
     assert(core == go_btcd);

diff --git a/targets/tx_des.h b/targets/tx_des.h