Skip to content

Commit 44abf41

Browse files
tests: Add fuzzing harness for various functions taking std::string as input
1 parent d69145a commit 44abf41

File tree

3 files changed

+112
-6
lines changed

3 files changed

+112
-6
lines changed

src/Makefile.test.include

+13-6
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ FUZZ_TARGETS = \
9393
test/fuzz/service_deserialize \
9494
test/fuzz/snapshotmetadata_deserialize \
9595
test/fuzz/spanparsing \
96+
test/fuzz/string \
9697
test/fuzz/strprintf \
9798
test/fuzz/sub_net_deserialize \
9899
test/fuzz/transaction \
@@ -808,12 +809,24 @@ test_fuzz_service_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
808809
test_fuzz_service_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
809810
test_fuzz_service_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
810811

812+
test_fuzz_snapshotmetadata_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DSNAPSHOTMETADATA_DESERIALIZE=1
813+
test_fuzz_snapshotmetadata_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
814+
test_fuzz_snapshotmetadata_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
815+
test_fuzz_snapshotmetadata_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
816+
test_fuzz_snapshotmetadata_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
817+
811818
test_fuzz_spanparsing_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
812819
test_fuzz_spanparsing_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
813820
test_fuzz_spanparsing_LDADD = $(FUZZ_SUITE_LD_COMMON)
814821
test_fuzz_spanparsing_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
815822
test_fuzz_spanparsing_SOURCES = $(FUZZ_SUITE) test/fuzz/spanparsing.cpp
816823

824+
test_fuzz_string_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
825+
test_fuzz_string_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
826+
test_fuzz_string_LDADD = $(FUZZ_SUITE_LD_COMMON)
827+
test_fuzz_string_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
828+
test_fuzz_string_SOURCES = $(FUZZ_SUITE) test/fuzz/string.cpp
829+
817830
test_fuzz_strprintf_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
818831
test_fuzz_strprintf_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
819832
test_fuzz_strprintf_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -826,12 +839,6 @@ test_fuzz_sub_net_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
826839
test_fuzz_sub_net_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
827840
test_fuzz_sub_net_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
828841

829-
test_fuzz_snapshotmetadata_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DSNAPSHOTMETADATA_DESERIALIZE=1
830-
test_fuzz_snapshotmetadata_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
831-
test_fuzz_snapshotmetadata_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
832-
test_fuzz_snapshotmetadata_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
833-
test_fuzz_snapshotmetadata_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
834-
835842
test_fuzz_transaction_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
836843
test_fuzz_transaction_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
837844
test_fuzz_transaction_LDADD = $(FUZZ_SUITE_LD_COMMON)

src/test/fuzz/string.cpp

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <blockfilter.h>
6+
#include <clientversion.h>
7+
#include <logging.h>
8+
#include <netbase.h>
9+
#include <outputtype.h>
10+
#include <rpc/client.h>
11+
#include <rpc/request.h>
12+
#include <rpc/server.h>
13+
#include <rpc/util.h>
14+
#include <script/descriptor.h>
15+
#include <test/fuzz/FuzzedDataProvider.h>
16+
#include <test/fuzz/fuzz.h>
17+
#include <test/fuzz/util.h>
18+
#include <util/error.h>
19+
#include <util/fees.h>
20+
#include <util/message.h>
21+
#include <util/settings.h>
22+
#include <util/strencodings.h>
23+
#include <util/string.h>
24+
#include <util/system.h>
25+
#include <util/translation.h>
26+
#include <util/url.h>
27+
28+
#include <cstdint>
29+
#include <string>
30+
#include <vector>
31+
32+
void test_one_input(const std::vector<uint8_t>& buffer)
33+
{
34+
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
35+
const std::string random_string_1 = fuzzed_data_provider.ConsumeRandomLengthString(32);
36+
const std::string random_string_2 = fuzzed_data_provider.ConsumeRandomLengthString(32);
37+
const std::vector<std::string> random_string_vector = ConsumeRandomLengthStringVector(fuzzed_data_provider);
38+
39+
(void)AmountErrMsg(random_string_1, random_string_2);
40+
(void)AmountHighWarn(random_string_1);
41+
BlockFilterType block_filter_type;
42+
(void)BlockFilterTypeByName(random_string_1, block_filter_type);
43+
(void)Capitalize(random_string_1);
44+
(void)CopyrightHolders(random_string_1);
45+
FeeEstimateMode fee_estimate_mode;
46+
(void)FeeModeFromString(random_string_1, fee_estimate_mode);
47+
(void)FormatParagraph(random_string_1, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 1000), fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 1000));
48+
(void)FormatSubVersion(random_string_1, fuzzed_data_provider.ConsumeIntegral<int>(), random_string_vector);
49+
(void)GetDescriptorChecksum(random_string_1);
50+
(void)HelpExampleCli(random_string_1, random_string_2);
51+
(void)HelpExampleRpc(random_string_1, random_string_2);
52+
(void)HelpMessageGroup(random_string_1);
53+
(void)HelpMessageOpt(random_string_1, random_string_2);
54+
(void)IsDeprecatedRPCEnabled(random_string_1);
55+
(void)Join(random_string_vector, random_string_1);
56+
(void)JSONRPCError(fuzzed_data_provider.ConsumeIntegral<int>(), random_string_1);
57+
const util::Settings settings;
58+
(void)OnlyHasDefaultSectionSetting(settings, random_string_1, random_string_2);
59+
(void)ParseNetwork(random_string_1);
60+
try {
61+
(void)ParseNonRFCJSONValue(random_string_1);
62+
} catch (const std::runtime_error&) {
63+
}
64+
OutputType output_type;
65+
(void)ParseOutputType(random_string_1, output_type);
66+
(void)ResolveErrMsg(random_string_1, random_string_2);
67+
try {
68+
(void)RPCConvertNamedValues(random_string_1, random_string_vector);
69+
} catch (const std::runtime_error&) {
70+
}
71+
try {
72+
(void)RPCConvertValues(random_string_1, random_string_vector);
73+
} catch (const std::runtime_error&) {
74+
}
75+
(void)SanitizeString(random_string_1);
76+
(void)SanitizeString(random_string_1, fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 3));
77+
(void)ShellEscape(random_string_1);
78+
int port_out;
79+
std::string host_out;
80+
SplitHostPort(random_string_1, port_out, host_out);
81+
(void)TimingResistantEqual(random_string_1, random_string_2);
82+
(void)ToLower(random_string_1);
83+
(void)ToUpper(random_string_1);
84+
(void)TrimString(random_string_1);
85+
(void)TrimString(random_string_1, random_string_2);
86+
(void)urlDecode(random_string_1);
87+
(void)ValidAsCString(random_string_1);
88+
(void)_(random_string_1.c_str());
89+
}

src/test/fuzz/util.h

+10
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,16 @@ NODISCARD inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataPr
2525
return {s.begin(), s.end()};
2626
}
2727

28+
NODISCARD inline std::vector<std::string> ConsumeRandomLengthStringVector(FuzzedDataProvider& fuzzed_data_provider, size_t max_vector_size = 16, size_t max_string_length = 16) noexcept
29+
{
30+
const size_t n_elements = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_vector_size);
31+
std::vector<std::string> r;
32+
for (size_t i = 0; i < n_elements; ++i) {
33+
r.push_back(fuzzed_data_provider.ConsumeRandomLengthString(max_string_length));
34+
}
35+
return r;
36+
}
37+
2838
template <typename T>
2939
NODISCARD inline Optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, size_t max_length = 4096) noexcept
3040
{

0 commit comments

Comments
 (0)