Bitcoin Core 29.99.0
P2P Digital Currency
fuzz.cpp
Go to the documentation of this file.
1// Copyright (c) 2009-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#include <test/fuzz/fuzz.h>
6
7#include <netaddress.h>
8#include <netbase.h>
10#include <test/util/coverage.h>
11#include <test/util/random.h>
13#include <util/check.h>
14#include <util/fs.h>
15#include <util/sock.h>
16#include <util/time.h>
17
18#include <algorithm>
19#include <csignal>
20#include <cstdint>
21#include <cstdio>
22#include <cstdlib>
23#include <cstring>
24#include <exception>
25#include <fstream>
26#include <functional>
27#include <iostream>
28#include <map>
29#include <memory>
30#include <random>
31#include <string>
32#include <tuple>
33#include <utility>
34#include <vector>
35
36#if defined(PROVIDE_FUZZ_MAIN_FUNCTION) && defined(__AFL_FUZZ_INIT)
37__AFL_FUZZ_INIT();
38#endif
39
40const std::function<void(const std::string&)> G_TEST_LOG_FUN{};
41
49static std::vector<const char*> g_args;
50
51static void SetArgs(int argc, char** argv) {
52 for (int i = 1; i < argc; ++i) {
53 // Only take into account arguments that start with `--`. The others are for the fuzz engine:
54 // `fuzz -runs=1 fuzz_corpora/address_deserialize_v2 --checkaddrman=5`
55 if (strlen(argv[i]) > 2 && argv[i][0] == '-' && argv[i][1] == '-') {
56 g_args.push_back(argv[i]);
57 }
58 }
59}
60
61const std::function<std::vector<const char*>()> G_TEST_COMMAND_LINE_ARGUMENTS = []() {
62 return g_args;
63};
64
65struct FuzzTarget {
68};
69
71{
72 static std::map<std::string_view, FuzzTarget> g_fuzz_targets;
73 return g_fuzz_targets;
74}
75
77{
78 const auto [it, ins]{FuzzTargets().try_emplace(name, FuzzTarget /* temporary can be dropped after Apple-Clang-16 ? */ {std::move(target), std::move(opts)})};
79 Assert(ins);
80}
81
82static std::string_view g_fuzz_target;
83static const TypeTestOneInput* g_test_one_input{nullptr};
84
85static void test_one_input(FuzzBufferType buffer)
86{
87 CheckGlobals check{};
88 (*Assert(g_test_one_input))(buffer);
89}
90
91const std::function<std::string()> G_TEST_GET_FULL_NAME{[]{
92 return std::string{g_fuzz_target};
93}};
94
95static void initialize()
96{
97 // By default, make the RNG deterministic with a fixed seed. This will affect all
98 // randomness during the fuzz test, except:
99 // - GetStrongRandBytes(), which is used for the creation of private key material.
100 // - Randomness obtained before this call in g_rng_temp_path_init
102
103 // Set time to the genesis block timestamp for deterministic initialization.
104 SetMockTime(1231006505);
105
106 // Terminate immediately if a fuzzing harness ever tries to create a socket.
107 // Individual tests can override this by pointing CreateSock to a mocked alternative.
108 CreateSock = [](int, int, int) -> std::unique_ptr<Sock> { std::terminate(); };
109
110 // Terminate immediately if a fuzzing harness ever tries to perform a DNS lookup.
111 g_dns_lookup = [](const std::string& name, bool allow_lookup) {
112 if (allow_lookup) {
113 std::terminate();
114 }
115 return WrappedGetAddrInfo(name, false);
116 };
117
118 bool should_exit{false};
119 if (std::getenv("PRINT_ALL_FUZZ_TARGETS_AND_ABORT")) {
120 for (const auto& [name, t] : FuzzTargets()) {
121 if (t.opts.hidden) continue;
122 std::cout << name << std::endl;
123 }
124 should_exit = true;
125 }
126 if (const char* out_path = std::getenv("WRITE_ALL_FUZZ_TARGETS_AND_ABORT")) {
127 std::cout << "Writing all fuzz target names to '" << out_path << "'." << std::endl;
128 std::ofstream out_stream{out_path, std::ios::binary};
129 for (const auto& [name, t] : FuzzTargets()) {
130 if (t.opts.hidden) continue;
131 out_stream << name << std::endl;
132 }
133 should_exit = true;
134 }
135 if (should_exit) {
136 std::exit(EXIT_SUCCESS);
137 }
138 if (const auto* env_fuzz{std::getenv("FUZZ")}) {
139 // To allow for easier fuzz executable binary modification,
140 static std::string g_copy{env_fuzz}; // create copy to avoid compiler optimizations, and
141 g_fuzz_target = g_copy.c_str(); // strip string after the first null-char.
142 } else {
143 std::cerr << "Must select fuzz target with the FUZZ env var." << std::endl;
144 std::cerr << "Hint: Set the PRINT_ALL_FUZZ_TARGETS_AND_ABORT=1 env var to see all compiled targets." << std::endl;
145 std::exit(EXIT_FAILURE);
146 }
147 const auto it = FuzzTargets().find(g_fuzz_target);
148 if (it == FuzzTargets().end()) {
149 std::cerr << "No fuzz target compiled for " << g_fuzz_target << "." << std::endl;
150 std::exit(EXIT_FAILURE);
151 }
152 if constexpr (!G_FUZZING) {
153 std::cerr << "Must compile with -DBUILD_FOR_FUZZING=ON to execute a fuzz target." << std::endl;
154 std::exit(EXIT_FAILURE);
155 }
157 g_test_one_input = &it->second.test_one_input;
158 it->second.opts.init();
159
161}
162
163#if defined(PROVIDE_FUZZ_MAIN_FUNCTION)
164static bool read_stdin(std::vector<uint8_t>& data)
165{
166 std::istream::char_type buffer[1024];
167 std::streamsize length;
168 while ((std::cin.read(buffer, 1024), length = std::cin.gcount()) > 0) {
169 data.insert(data.end(), buffer, buffer + length);
170 }
171 return length == 0;
172}
173#endif
174
175#if defined(PROVIDE_FUZZ_MAIN_FUNCTION) && !defined(__AFL_LOOP)
176static bool read_file(fs::path p, std::vector<uint8_t>& data)
177{
178 uint8_t buffer[1024];
179 FILE* f = fsbridge::fopen(p, "rb");
180 if (f == nullptr) return false;
181 do {
182 const size_t length = fread(buffer, sizeof(uint8_t), sizeof(buffer), f);
183 if (ferror(f)) return false;
184 data.insert(data.end(), buffer, buffer + length);
185 } while (!feof(f));
186 fclose(f);
187 return true;
188}
189#endif
190
191#if defined(PROVIDE_FUZZ_MAIN_FUNCTION) && !defined(__AFL_LOOP)
192static fs::path g_input_path;
193void signal_handler(int signal)
194{
195 if (signal == SIGABRT) {
196 std::cerr << "Error processing input " << g_input_path << std::endl;
197 } else {
198 std::cerr << "Unexpected signal " << signal << " received\n";
199 }
200 std::_Exit(EXIT_FAILURE);
201}
202#endif
203
204// This function is used by libFuzzer
205extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
206{
207 test_one_input({data, size});
208 return 0;
209}
210
211// This function is used by libFuzzer
212extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv)
213{
214 SetArgs(*argc, *argv);
215 initialize();
216 return 0;
217}
218
219#if defined(PROVIDE_FUZZ_MAIN_FUNCTION)
220int main(int argc, char** argv)
221{
222 initialize();
223#ifdef __AFL_LOOP
224 // Enable AFL persistent mode. Requires compilation using afl-clang-fast++.
225 // See fuzzing.md for details.
226 const uint8_t* buffer = __AFL_FUZZ_TESTCASE_BUF;
227 while (__AFL_LOOP(100000)) {
228 size_t buffer_len = __AFL_FUZZ_TESTCASE_LEN;
229 test_one_input({buffer, buffer_len});
230 }
231#else
232 std::vector<uint8_t> buffer;
233 if (argc <= 1) {
234 if (!read_stdin(buffer)) {
235 return 0;
236 }
237 test_one_input(buffer);
238 return 0;
239 }
240 std::signal(SIGABRT, signal_handler);
241 const auto start_time{Now<SteadySeconds>()};
242 int tested = 0;
243 for (int i = 1; i < argc; ++i) {
244 fs::path input_path(*(argv + i));
245 if (fs::is_directory(input_path)) {
246 std::vector<fs::path> files;
247 for (fs::directory_iterator it(input_path); it != fs::directory_iterator(); ++it) {
248 if (!fs::is_regular_file(it->path())) continue;
249 files.emplace_back(it->path());
250 }
251 std::ranges::shuffle(files, std::mt19937{std::random_device{}()});
252 for (const auto& input_path : files) {
253 g_input_path = input_path;
254 Assert(read_file(input_path, buffer));
255 test_one_input(buffer);
256 ++tested;
257 buffer.clear();
258 }
259 } else {
260 g_input_path = input_path;
261 Assert(read_file(input_path, buffer));
262 test_one_input(buffer);
263 ++tested;
264 buffer.clear();
265 }
266 }
267 const auto end_time{Now<SteadySeconds>()};
268 std::cout << g_fuzz_target << ": succeeded against " << tested << " files in " << count_seconds(end_time - start_time) << "s." << std::endl;
269#endif
270 return 0;
271}
272#endif
int main(int argc, char **argv)
return EXIT_SUCCESS
constexpr bool G_FUZZING
Definition: check.h:16
#define Assert(val)
Identity function.
Definition: check.h:85
void ResetCoverageCounters()
Definition: coverage.cpp:21
static void test_one_input(FuzzBufferType buffer)
Definition: fuzz.cpp:85
auto & FuzzTargets()
Definition: fuzz.cpp:70
void FuzzFrameworkRegisterTarget(std::string_view name, TypeTestOneInput target, FuzzTargetOptions opts)
Definition: fuzz.cpp:76
const std::function< void(const std::string &)> G_TEST_LOG_FUN
This is connected to the logger.
Definition: fuzz.cpp:40
static const TypeTestOneInput * g_test_one_input
Definition: fuzz.cpp:83
static void SetArgs(int argc, char **argv)
Definition: fuzz.cpp:51
const std::function< std::vector< const char * >()> G_TEST_COMMAND_LINE_ARGUMENTS
Retrieve the command line arguments.
Definition: fuzz.cpp:61
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
Definition: fuzz.cpp:205
int LLVMFuzzerInitialize(int *argc, char ***argv)
Definition: fuzz.cpp:212
static void initialize()
Definition: fuzz.cpp:95
static std::string_view g_fuzz_target
Definition: fuzz.cpp:82
static std::vector< const char * > g_args
A copy of the command line arguments that start with --.
Definition: fuzz.cpp:49
const std::function< std::string()> G_TEST_GET_FULL_NAME
Retrieve the unit test name.
Definition: fuzz.cpp:91
std::span< const uint8_t > FuzzBufferType
Definition: fuzz.h:25
std::function< void(FuzzBufferType)> TypeTestOneInput
Definition: fuzz.h:27
FILE * fopen(const fs::path &p, const char *mode)
Definition: fs.cpp:26
std::function< std::unique_ptr< Sock >(int, int, int)> CreateSock
Socket factory.
Definition: netbase.cpp:581
std::vector< CNetAddr > WrappedGetAddrInfo(const std::string &name, bool allow_lookup)
Wrapper for getaddrinfo(3).
Definition: netbase.cpp:45
DNSLookupFn g_dns_lookup
Definition: netbase.cpp:98
const char * name
Definition: rest.cpp:49
const TypeTestOneInput test_one_input
Definition: fuzz.cpp:66
const FuzzTargetOptions opts
Definition: fuzz.cpp:67
void SeedRandomStateForTest(SeedRand seedtype)
Seed the global RNG state for testing and log the seed value.
Definition: random.cpp:19
@ ZEROS
Seed with a compile time constant of zeros.
void SetMockTime(int64_t nMockTimeIn)
DEPRECATED Use SetMockTime with chrono type.
Definition: time.cpp:40
constexpr int64_t count_seconds(std::chrono::seconds t)
Definition: time.h:82