// Copyright (c) 2020-present The Bitcoin Core developers // Distributed under the MIT software license, see the accompanying // file COPYING or http://www.opensource.org/licenses/mit-license.php. #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include namespace { TestingSetup* g_setup; void ResetChainman(TestingSetup& setup) { SetMockTime(setup.m_node.chainman->GetParams().GenesisBlock().Time()); setup.m_node.chainman.reset(); setup.m_make_chainman(); setup.LoadVerifyActivateChainstate(); node::BlockCreateOptions options; for (int i = 0; i < 2 * COINBASE_MATURITY; i++) { MineBlock(setup.m_node, options); } } } // namespace void initialize_process_messages() { static const auto testing_setup{ MakeNoLogFileContext( /*chain_type=*/ChainType::REGTEST, {}), }; g_setup = testing_setup.get(); ResetChainman(*g_setup); } FUZZ_TARGET(process_messages, .init = initialize_process_messages) { SeedRandomStateForTest(SeedRand::ZEROS); FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); auto& node{g_setup->m_node}; auto& connman{static_cast(*node.connman)}; connman.Reset(); auto& chainman{static_cast(*node.chainman)}; const auto block_index_size{WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())}; NodeClockContext clock_ctx{1610000000s}; // any time to successfully reset ibd chainman.ResetIbd(); chainman.DisableNextWrite(); // Reset, so that dangling pointers can be detected by sanitizers. node.banman.reset(); node.addrman.reset(); node.peerman.reset(); node.addrman = std::make_unique(*node.netgroupman, /*deterministic=*/true, /*consistency_check_ratio=*/0); node.peerman = PeerManager::make(connman, *node.addrman, /*banman=*/nullptr, chainman, *node.mempool, *node.warnings, PeerManager::Options{ .reconcile_txs = true, .deterministic_rng = true, }); connman.SetMsgProc(node.peerman.get()); connman.SetAddrman(*node.addrman); node.validation_signals->RegisterValidationInterface(node.peerman.get()); LOCK(NetEventsInterface::g_msgproc_mutex); std::vector peers; const auto num_peers_to_add = fuzzed_data_provider.ConsumeIntegralInRange(1, 3); for (int i = 0; i < num_peers_to_add; ++i) { peers.push_back(ConsumeNodeAsUniquePtr(fuzzed_data_provider, i).release()); CNode& p2p_node = *peers.back(); FillNode(fuzzed_data_provider, connman, p2p_node); connman.AddTestNode(p2p_node); } LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 30) { const std::string random_message_type{fuzzed_data_provider.ConsumeBytesAsString(CMessageHeader::MESSAGE_TYPE_SIZE).c_str()}; clock_ctx.set(ConsumeTime(fuzzed_data_provider)); CSerializedNetMsg net_msg; net_msg.m_type = random_message_type; net_msg.data = ConsumeRandomLengthByteVector(fuzzed_data_provider, MAX_PROTOCOL_MESSAGE_LENGTH); CNode& random_node = *PickValue(fuzzed_data_provider, peers); connman.FlushSendBuffer(random_node); (void)connman.ReceiveMsgFrom(random_node, std::move(net_msg)); bool more_work{true}; while (more_work) { // Ensure that every message is eventually processed in some way or another random_node.fPauseSend = false; try { more_work = connman.ProcessMessagesOnce(random_node); } catch (const std::ios_base::failure&) { } node.peerman->SendMessages(random_node); } } node.validation_signals->SyncWithValidationInterfaceQueue(); node.validation_signals->UnregisterValidationInterface(node.peerman.get()); node.connman->StopNodes(); if (block_index_size != WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())) { // Reuse the global chainman, but reset it when it is dirty ResetChainman(*g_setup); } }