// Copyright (c) 2020-present The Bitcoin Core developers // Distributed under the MIT software license, see the accompanying // file COPYING or http://www.opensource.org/licenses/mit-license.php. #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include namespace { TestingSetup* g_setup; std::string_view LIMIT_TO_MESSAGE_TYPE{}; void ResetChainman(TestingSetup& setup) { SetMockTime(setup.m_node.chainman->GetParams().GenesisBlock().Time()); setup.m_node.chainman.reset(); setup.m_make_chainman(); setup.LoadVerifyActivateChainstate(); for (int i = 0; i < 2 * COINBASE_MATURITY; i++) { node::BlockCreateOptions options; MineBlock(setup.m_node, options); } } } // namespace void initialize_process_message() { if (const auto val{std::getenv("LIMIT_TO_MESSAGE_TYPE")}) { LIMIT_TO_MESSAGE_TYPE = val; Assert(std::count(ALL_NET_MESSAGE_TYPES.begin(), ALL_NET_MESSAGE_TYPES.end(), LIMIT_TO_MESSAGE_TYPE)); // Unknown message type passed } static const auto testing_setup{ MakeNoLogFileContext( /*chain_type=*/ChainType::REGTEST, {}), }; g_setup = testing_setup.get(); ResetChainman(*g_setup); } FUZZ_TARGET(process_message, .init = initialize_process_message) { SeedRandomStateForTest(SeedRand::ZEROS); FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); auto& node{g_setup->m_node}; auto& connman{static_cast(*node.connman)}; connman.Reset(); auto& chainman{static_cast(*node.chainman)}; const auto block_index_size{WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())}; FakeNodeClock clock{1610000000s}; // any time to successfully reset ibd FakeSteadyClock steady_clock; chainman.ResetIbd(); chainman.DisableNextWrite(); // Reset, so that dangling pointers can be detected by sanitizers. node.banman.reset(); node.addrman.reset(); node.peerman.reset(); node.addrman = std::make_unique(*node.netgroupman, /*deterministic=*/true, /*consistency_check_ratio=*/0); node.peerman = PeerManager::make(connman, *node.addrman, /*banman=*/nullptr, chainman, *node.mempool, *node.warnings, PeerManager::Options{ .reconcile_txs = true, .deterministic_rng = true, }); connman.SetMsgProc(node.peerman.get()); connman.SetAddrman(*node.addrman); LOCK(NetEventsInterface::g_msgproc_mutex); const std::string random_message_type{fuzzed_data_provider.ConsumeBytesAsString(CMessageHeader::MESSAGE_TYPE_SIZE).c_str()}; if (!LIMIT_TO_MESSAGE_TYPE.empty() && random_message_type != LIMIT_TO_MESSAGE_TYPE) { return; } node.validation_signals->RegisterValidationInterface(node.peerman.get()); CNode& p2p_node = *ConsumeNodeAsUniquePtr(fuzzed_data_provider, steady_clock).release(); connman.AddTestNode(p2p_node); FillNode(fuzzed_data_provider, connman, p2p_node); clock.set(ConsumeTime(fuzzed_data_provider)); CSerializedNetMsg net_msg; net_msg.m_type = random_message_type; net_msg.data = ConsumeRandomLengthByteVector(fuzzed_data_provider, MAX_PROTOCOL_MESSAGE_LENGTH); connman.FlushSendBuffer(p2p_node); (void)connman.ReceiveMsgFrom(p2p_node, std::move(net_msg)); bool more_work{true}; while (more_work) { p2p_node.fPauseSend = false; try { more_work = connman.ProcessMessagesOnce(p2p_node); } catch (const std::ios_base::failure&) { } node.peerman->SendMessages(p2p_node); } node.validation_signals->SyncWithValidationInterfaceQueue(); node.validation_signals->UnregisterValidationInterface(node.peerman.get()); node.connman->StopNodes(); if (block_index_size != WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())) { // Reuse the global chainman, but reset it when it is dirty ResetChainman(*g_setup); } }