highperfocused/bitcoin
1
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2026-06-06 19:23:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge bitcoin/bitcoin#28832: fuzz: rule-out too deep derivation paths in descriptor parsing targets

Browse Source 
a44808fb43 fuzz: rule-out too deep derivation paths in descriptor parsing targets (Antoine Poinsot)

Pull request description:

  This fixes the `mocked_descriptor_parse` timeout reported in #28812 and direct the targets more toward what they are intended to fuzz: the descriptor syntax.

ACKs for top commit:
  sipa:
    utACK a44808fb43
  achow101:
    ACK a44808fb43
  dergoegge:
    ACK a44808fb43 - Not running into timeouts anymore
  TheCharlatan:
    ACK a44808fb43

Tree-SHA512: a5dd1dbe9adf8f088bdc435addab88b56f435e6d7d2065bd6d5c6d80a32e3f1f97d3d2323131ab233618cd6dcc477c458abe3c4c865ab569449b8bc176231e93
This commit is contained in:
Ava Chow
2024-01-04 18:04:10 -05:00
parent 737e5884cc a44808fb43
commit d44554567f
4 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/wallet/test/fuzz/scriptpubkeyman.cpp
View File

@@ -49,9 +49,21 @@ void initialize_spkm()
MOCKED_DESC_CONVERTER.Init();
}
/**
* Key derivation is expensive. Deriving deep derivation paths take a lot of compute and we'd rather spend time
* elsewhere in this target, like on actually fuzzing the DescriptorScriptPubKeyMan. So rule out strings which could
* correspond to a descriptor containing a too large derivation path.
*/
static bool TooDeepDerivPath(std::string_view desc)
{
const FuzzBufferType desc_buf{reinterpret_cast<const unsigned char *>(desc.data()), desc.size()};
return HasDeepDerivPath(desc_buf);
}
static std::optional<std::pair<WalletDescriptor, FlatSigningProvider>> CreateWalletDescriptor(FuzzedDataProvider& fuzzed_data_provider)
{
const std::string mocked_descriptor{fuzzed_data_provider.ConsumeRandomLengthString()};
if (TooDeepDerivPath(mocked_descriptor)) return {};
const auto desc_str{MOCKED_DESC_CONVERTER.GetDescriptor(mocked_descriptor)};
if (!desc_str.has_value()) return std::nullopt;