mirror of
https://github.com/bitcoin/bitcoin.git
synced 2026-04-06 21:57:54 +02:00
eeeeb2a0b9
This refactor does not change any behavior. However, it is nice to know that no global mocktime leaks from the fuzz init step to the first fuzz input, or from one fuzz input execution to the next. With the clock context, the global is re-set at the end of the context.
52 lines
2.0 KiB
C++
52 lines
2.0 KiB
C++
// Copyright (c) 2020-present The Bitcoin Core developers
|
|
// Distributed under the MIT software license, see the accompanying
|
|
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
|
|
#include <netaddress.h>
|
|
#include <netbase.h>
|
|
#include <test/fuzz/FuzzedDataProvider.h>
|
|
#include <test/fuzz/fuzz.h>
|
|
#include <test/fuzz/util.h>
|
|
#include <test/fuzz/util/net.h>
|
|
#include <test/util/setup_common.h>
|
|
#include <test/util/time.h>
|
|
#include <util/time.h>
|
|
|
|
#include <cstdint>
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
extern std::chrono::milliseconds g_socks5_recv_timeout;
|
|
|
|
namespace {
|
|
decltype(g_socks5_recv_timeout) default_socks5_recv_timeout;
|
|
};
|
|
|
|
void initialize_socks5()
|
|
{
|
|
static const auto testing_setup = MakeNoLogFileContext<const BasicTestingSetup>();
|
|
default_socks5_recv_timeout = g_socks5_recv_timeout;
|
|
}
|
|
|
|
FUZZ_TARGET(socks5, .init = initialize_socks5)
|
|
{
|
|
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
|
|
NodeClockContext clock_ctx{ConsumeTime(fuzzed_data_provider)};
|
|
ProxyCredentials proxy_credentials;
|
|
proxy_credentials.username = fuzzed_data_provider.ConsumeRandomLengthString(512);
|
|
proxy_credentials.password = fuzzed_data_provider.ConsumeRandomLengthString(512);
|
|
if (fuzzed_data_provider.ConsumeBool()) {
|
|
g_socks5_interrupt();
|
|
}
|
|
// Set FUZZED_SOCKET_FAKE_LATENCY=1 to exercise recv timeout code paths. This
|
|
// will slow down fuzzing.
|
|
g_socks5_recv_timeout = (fuzzed_data_provider.ConsumeBool() && std::getenv("FUZZED_SOCKET_FAKE_LATENCY") != nullptr) ? 1ms : default_socks5_recv_timeout;
|
|
FuzzedSock fuzzed_sock = ConsumeSock(fuzzed_data_provider);
|
|
// This Socks5(...) fuzzing harness would have caught CVE-2017-18350 within
|
|
// a few seconds of fuzzing.
|
|
auto str_dest = fuzzed_data_provider.ConsumeRandomLengthString(512);
|
|
auto port = fuzzed_data_provider.ConsumeIntegral<uint16_t>();
|
|
auto* auth = fuzzed_data_provider.ConsumeBool() ? &proxy_credentials : nullptr;
|
|
(void)Socks5(str_dest, port, auth, fuzzed_sock);
|
|
}
|