Skip to content

Conversation

practicalswift
Copy link
Contributor

@practicalswift practicalswift commented May 24, 2020

Add fuzzing harness for CAddrMan.

Fill some fuzzing coverage gaps for functions in addrdb.h, merkleblock.h and outputtype.h.

See doc/fuzzing.md for information on how to fuzz Bitcoin Core. Don't forget to contribute any coverage increasing inputs you find to the Bitcoin Core fuzzing corpus repo.

Happy fuzzing :)

@practicalswift practicalswift force-pushed the fuzzers-2020-05-23 branch 2 times, most recently from 5579f7f to 403c5ad Compare May 25, 2020 21:06
@practicalswift practicalswift force-pushed the fuzzers-2020-05-23 branch 3 times, most recently from 979174f to 4e16f76 Compare May 26, 2020 18:21
@practicalswift
Copy link
Contributor Author

Anything left to do here? :) The changes are limited to src/test/fuzz/ and should hopefully be trivial to review.

@Crypt-iQ
Copy link
Contributor

Crypt-iQ commented Jul 13, 2020

I cannot build this branch with either clang/clang++ or afl-gcc/afl-g++:

clang version: 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
afl-gcc/afl-g++ built from afl master

Make output:

Making all in src
  2 make[1]: Entering directory '/root/bitcoin/src'
  3 make[2]: Entering directory '/root/bitcoin/src'
  4   CXX      test/fuzz/test_fuzz_addition_overflow-addition_overflow.o
  5 In file included from test/fuzz/addition_overflow.cpp:7:
  6 ./test/fuzz/util.h:62:18: error: no template named 'optional' in namespace 'std'; did you mean 'Optional'?
  7 NODISCARD inline std::optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, const si    ze_t max_length = 4096) noexcept
  8                  ^~~~~~~~~~~~~
  9                  Optional
 10 ./optional.h:14:1: note: 'Optional' declared here
 11 using Optional = boost::optional<T>;
 12 ^
 13 In file included from test/fuzz/addition_overflow.cpp:7:
 14 ./test/fuzz/util.h:70:16: error: no member named 'nullopt' in namespace 'std'; did you mean simply 'nullop    t'?
 15         return std::nullopt;
 16                ^~~~~~~~~~~~
 17                nullopt
 18 ./optional.h:24:14: note: 'nullopt' declared here
 19 static auto& nullopt = boost::none;
 20              ^
 21 2 errors generated.
 22 Makefile:14081: recipe for target 'test/fuzz/test_fuzz_addition_overflow-addition_overflow.o' failed
 23 make[2]: *** [test/fuzz/test_fuzz_addition_overflow-addition_overflow.o] Error 1
 24 make[2]: Leaving directory '/root/bitcoin/src'
 25 Makefile:17268: recipe for target 'all-recursive' failed
 26 make[1]: *** [all-recursive] Error 1
 27 make[1]: Leaving directory '/root/bitcoin/src'
 28 Makefile:785: recipe for target 'all-recursive' failed
 29 make: *** [all-recursive] Error 1

Am I doing something wrong? I have C++17 features and can build on master.

@maflcko
Copy link
Member

maflcko commented Jul 13, 2020

@Crypt-iQ So to clarify, you can build current master, but not this pull request merged into current master?

@Crypt-iQ
Copy link
Contributor

@MarcoFalke I can build the current master branch, but not this branch as it is. I checkout this branch via:

git fetch origin pull/19065/head:addrmanfuzz

@practicalswift
Copy link
Contributor Author

@Crypt-iQ Oh, that's weird! Thanks for reporting. I've now rebased this PR on current master. Would you mind testing again? :)

@Crypt-iQ
Copy link
Contributor

@practicalswift I think you may have forgotten to push it up :) And will test once it's up

@practicalswift
Copy link
Contributor Author

@Crypt-iQ Oh, thanks for letting me know! Now pushed for real :)

@DrahtBot
Copy link
Contributor

DrahtBot commented Jul 15, 2020

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Conflicts

Reviewers, this pull request conflicts with the following ones:

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

@Crypt-iQ
Copy link
Contributor

Crypt-iQ commented Jul 15, 2020

@practicalswift Able to build this branch with afl and with libfuzzer (clang-10).

Coverage from 24 hours of AFL fuzzing here: https://crypt-iq.github.io/addrman_fuzz_outs/src/index.html
With more time it should hit the collision code but it was very slow ~4-5 execs/s.

Copy link
Contributor

@Crypt-iQ Crypt-iQ left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still fuzzing addrman to hit the collision code, will report back. Fuzzed merkleblock & kitchensink for ~32 hours each with libfuzzer and --with-sanitizers=address,fuzzer,undefined: https://crypt-iq.github.io/merkleblock_and_kitchensink_cov/src/index.html

Only two minor comments.

@practicalswift
Copy link
Contributor Author

@Crypt-iQ Thanks a lot for reviewing! Feedback addressed. Would you mind re-reviewing? :)

@practicalswift
Copy link
Contributor Author

practicalswift commented Nov 5, 2020

Ready for merge? :)

PR touches code only in src/test/fuzz/ and has two Tested ACK:s.

Edit: Noticed that I had unaddressed feedback from @Crypt-iQ in #19065 (comment). Will address. Sorry.

@Crypt-iQ
Copy link
Contributor

Crypt-iQ commented Nov 8, 2020

@practicalswift Just had that one comment remaining about GetGroup. I tried with @MarcoFalke suggested patch of insecure_rand being deterministic and after about a week the fuzzer still did not hit the collision code according to lcov. Granted, I am not throwing very many cores at it (2), and some input could probably be engineered to trigger it - just haven't had the time. As a newcomer to the codebase, I don't know what is considered out of scope PR-wise, but test determinism is always nice-to-have.

@practicalswift
Copy link
Contributor Author

practicalswift commented Nov 8, 2020

@Crypt-iQ Thanks for clarifying! I've now moved the AS-map code to allow for use via GetGroup. I'm now also mocking the time, but I skipped the suggested insecure_rand change since I don't want to change any code outside of src/test/fuzz/ in this PR. That can be taken in a follow-up if deemed necessary.

I think this PR should be ready for final review now. Many thanks for your patience: may I ask you to review for the n:th time? :)

@maflcko
Copy link
Member

maflcko commented Nov 10, 2020

Concept ACK. Will review

@practicalswift practicalswift changed the title tests: Add fuzzing harness for CAddrMan. Fill some fuzzing coverage gaps. tests: Add fuzzing harness for CAddrMan Nov 11, 2020
@practicalswift
Copy link
Contributor Author

@MarcoFalke Thanks for reviewing. Addressed your optimization request and dropped all changes that are unrelated to CAddrMan. Should hopefully be ready for merge now :)

@practicalswift
Copy link
Contributor Author

@MarcoFalke Thanks for re-reviewing! Addressed all feedback. Should hopefully be ready for final review now :)

@practicalswift
Copy link
Contributor Author

@MarcoFalke Thanks for re-re-reviewing! Addressed all feedback. Should hopefully be ready for final final review now :)

@maflcko
Copy link
Member

maflcko commented Nov 13, 2020

review ACK d04a17a

@maflcko maflcko merged commit 28cb616 into bitcoin:master Nov 13, 2020
sidhujag pushed a commit to syscoin/syscoin that referenced this pull request Nov 13, 2020
@practicalswift practicalswift deleted the fuzzers-2020-05-23 branch April 10, 2021 19:42
kwvg added a commit to kwvg/dash that referenced this pull request Aug 11, 2022
@bitcoin bitcoin locked as resolved and limited conversation to collaborators Aug 18, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants