src/test/test_bitcoin_fuzzy.cpp

   1 // Copyright (c) 2009-2016 The Bitcoin Core developers
   2 // Distributed under the MIT software license, see the accompanying
   3 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
   4
   5 #if defined(HAVE_CONFIG_H)
   6 #include "config/bitcoin-config.h"
   7 #endif
   8
   9 #include "consensus/merkle.h"
  10 #include "primitives/block.h"
  11 #include "script/script.h"
  12 #include "addrman.h"
  13 #include "chain.h"
  14 #include "coins.h"
  15 #include "compressor.h"
  16 #include "net.h"
  17 #include "protocol.h"
  18 #include "streams.h"
  19 #include "undo.h"
  20 #include "version.h"
  21 #include "pubkey.h"
  22
  23 #include <stdint.h>
  24 #include <unistd.h>
  25
  26 #include <algorithm>
  27 #include <vector>
  28
  29 enum TEST_ID {
  30     CBLOCK_DESERIALIZE=0,
  31     CTRANSACTION_DESERIALIZE,
  32     CBLOCKLOCATOR_DESERIALIZE,
  33     CBLOCKMERKLEROOT,
  34     CADDRMAN_DESERIALIZE,
  35     CBLOCKHEADER_DESERIALIZE,
  36     CBANENTRY_DESERIALIZE,
  37     CTXUNDO_DESERIALIZE,
  38     CBLOCKUNDO_DESERIALIZE,
  39     CCOINS_DESERIALIZE,
  40     CNETADDR_DESERIALIZE,
  41     CSERVICE_DESERIALIZE,
  42     CMESSAGEHEADER_DESERIALIZE,
  43     CADDRESS_DESERIALIZE,
  44     CINV_DESERIALIZE,
  45     CBLOOMFILTER_DESERIALIZE,
  46     CDISKBLOCKINDEX_DESERIALIZE,
  47     CTXOUTCOMPRESSOR_DESERIALIZE,
  48     TEST_ID_END
  49 };
  50
  51 bool read_stdin(std::vector<char> &data) {
  52     char buffer[1024];
  53     ssize_t length=0;
  54     while((length = read(STDIN_FILENO, buffer, 1024)) > 0) {
  55         data.insert(data.end(), buffer, buffer+length);
  56
  57         if (data.size() > (1<<20)) return false;
  58     }
  59     return length==0;
  60 }
  61
  62 int do_fuzz()
  63 {
  64     std::vector<char> buffer;
  65     if (!read_stdin(buffer)) return 0;
  66
  67     if (buffer.size() < sizeof(uint32_t)) return 0;
  68
  69     uint32_t test_id = 0xffffffff;
  70     memcpy(&test_id, buffer.data(), sizeof(uint32_t));
  71     buffer.erase(buffer.begin(), buffer.begin() + sizeof(uint32_t));
  72
  73     if (test_id >= TEST_ID_END) return 0;
  74
  75     CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
  76     try {
  77         int nVersion;
  78         ds >> nVersion;
  79         ds.SetVersion(nVersion);
  80     } catch (const std::ios_base::failure& e) {
  81         return 0;
  82     }
  83
  84     switch(test_id) {
  85         case CBLOCK_DESERIALIZE:
  86         {
  87             try
  88             {
  89                 CBlock block;
  90                 ds >> block;
  91             } catch (const std::ios_base::failure& e) {return 0;}
  92             break;
  93         }
  94         case CTRANSACTION_DESERIALIZE:
  95         {
  96             try
  97             {
  98                 CTransaction tx(deserialize, ds);
  99             } catch (const std::ios_base::failure& e) {return 0;}
 100             break;
 101         }
 102         case CBLOCKLOCATOR_DESERIALIZE:
 103         {
 104             try
 105             {
 106                 CBlockLocator bl;
 107                 ds >> bl;
 108             } catch (const std::ios_base::failure& e) {return 0;}
 109             break;
 110         }
 111         case CBLOCKMERKLEROOT:
 112         {
 113             try
 114             {
 115                 CBlock block;
 116                 ds >> block;
 117                 bool mutated;
 118                 BlockMerkleRoot(block, &mutated);
 119             } catch (const std::ios_base::failure& e) {return 0;}
 120             break;
 121         }
 122         case CADDRMAN_DESERIALIZE:
 123         {
 124             try
 125             {
 126                 CAddrMan am;
 127                 ds >> am;
 128             } catch (const std::ios_base::failure& e) {return 0;}
 129             break;
 130         }
 131         case CBLOCKHEADER_DESERIALIZE:
 132         {
 133             try
 134             {
 135                 CBlockHeader bh;
 136                 ds >> bh;
 137             } catch (const std::ios_base::failure& e) {return 0;}
 138             break;
 139         }
 140         case CBANENTRY_DESERIALIZE:
 141         {
 142             try
 143             {
 144                 CBanEntry be;
 145                 ds >> be;
 146             } catch (const std::ios_base::failure& e) {return 0;}
 147             break;
 148         }
 149         case CTXUNDO_DESERIALIZE:
 150         {
 151             try
 152             {
 153                 CTxUndo tu;
 154                 ds >> tu;
 155             } catch (const std::ios_base::failure& e) {return 0;}
 156             break;
 157         }
 158         case CBLOCKUNDO_DESERIALIZE:
 159         {
 160             try
 161             {
 162                 CBlockUndo bu;
 163                 ds >> bu;
 164             } catch (const std::ios_base::failure& e) {return 0;}
 165             break;
 166         }
 167         case CCOINS_DESERIALIZE:
 168         {
 169             try
 170             {
 171                 Coin coin;
 172                 ds >> coin;
 173             } catch (const std::ios_base::failure& e) {return 0;}
 174             break;
 175         }
 176         case CNETADDR_DESERIALIZE:
 177         {
 178             try
 179             {
 180                 CNetAddr na;
 181                 ds >> na;
 182             } catch (const std::ios_base::failure& e) {return 0;}
 183             break;
 184         }
 185         case CSERVICE_DESERIALIZE:
 186         {
 187             try
 188             {
 189                 CService s;
 190                 ds >> s;
 191             } catch (const std::ios_base::failure& e) {return 0;}
 192             break;
 193         }
 194         case CMESSAGEHEADER_DESERIALIZE:
 195         {
 196             CMessageHeader::MessageStartChars pchMessageStart = {0x00, 0x00, 0x00, 0x00};
 197             try
 198             {
 199                 CMessageHeader mh(pchMessageStart);
 200                 ds >> mh;
 201                 if (!mh.IsValid(pchMessageStart)) {return 0;}
 202             } catch (const std::ios_base::failure& e) {return 0;}
 203             break;
 204         }
 205         case CADDRESS_DESERIALIZE:
 206         {
 207             try
 208             {
 209                 CAddress a;
 210                 ds >> a;
 211             } catch (const std::ios_base::failure& e) {return 0;}
 212             break;
 213         }
 214         case CINV_DESERIALIZE:
 215         {
 216             try
 217             {
 218                 CInv i;
 219                 ds >> i;
 220             } catch (const std::ios_base::failure& e) {return 0;}
 221             break;
 222         }
 223         case CBLOOMFILTER_DESERIALIZE:
 224         {
 225             try
 226             {
 227                 CBloomFilter bf;
 228                 ds >> bf;
 229             } catch (const std::ios_base::failure& e) {return 0;}
 230             break;
 231         }
 232         case CDISKBLOCKINDEX_DESERIALIZE:
 233         {
 234             try
 235             {
 236                 CDiskBlockIndex dbi;
 237                 ds >> dbi;
 238             } catch (const std::ios_base::failure& e) {return 0;}
 239             break;
 240         }
 241         case CTXOUTCOMPRESSOR_DESERIALIZE:
 242         {
 243             CTxOut to;
 244             CTxOutCompressor toc(to);
 245             try
 246             {
 247                 ds >> toc;
 248             } catch (const std::ios_base::failure& e) {return 0;}
 249
 250             break;
 251         }
 252         default:
 253             return 0;
 254     }
 255     return 0;
 256 }
 257
 258 int main(int argc, char **argv)
 259 {
 260     ECCVerifyHandle globalVerifyHandle;
 261 #ifdef __AFL_INIT
 262     // Enable AFL deferred forkserver mode. Requires compilation using
 263     // afl-clang-fast++. See fuzzing.md for details.
 264     __AFL_INIT();
 265 #endif
 266
 267 #ifdef __AFL_LOOP
 268     // Enable AFL persistent mode. Requires compilation using afl-clang-fast++.
 269     // See fuzzing.md for details.
 270     while (__AFL_LOOP(1000)) {
 271         do_fuzz();
 272     }
 273     return 0;
 274 #else
 275     return do_fuzz();
 276 #endif
 277 }