fuzz: Fix txorphan timeout by limiting block weight
What the developer wrote
Authored by marcofleon
fuzz: Fix txorphan timeout by limiting block weight
What changed, and why it matters
This change only affects an internal fuzz test (automated randomized testing) for orphan transaction handling. It prevents the fuzz test from creating unrealistically huge blocks that could cause the test to time out. There is no change to production Bitcoin node code, so real users or the live network are not affected.
No production action required. Merge as a test-quality improvement. Ensure fuzz CI jobs pick up the change.
Security signals we found
Test-only fuzz harness hardening
Denial-of-service-like condition limited to automated fuzzing infrastructure
Resource limit enforcement (MAX_BLOCK_WEIGHT) added
Evidence from the diff
In src/test/fuzz/txorphan.cpp, the fuzz target builds a CBlock from randomly chosen historical transactions and then calls orphanage->EraseForBlock(block). Previously it could add up to 1000 arbitrary transactions without checking block weight, potentially exceeding MAX_BLOCK_WEIGHT and causing long processing or timeout in the fuzz harness. The patch tracks block_weight, computes GetTransactionWeight for each selected tx, and stops adding transactions once MAX_BLOCK_WEIGHT would be exceeded. This is a test-only hardening fix.
Changed components
src/test/fuzz/txorphan.cppInspect captured patch +4 / −0
diff --git a/src/test/fuzz/txorphan.cpp b/src/test/fuzz/txorphan.cpp
index 8a21a506..394aed30 100644
--- a/src/test/fuzz/txorphan.cpp
+++ b/src/test/fuzz/txorphan.cpp
@@ -197,9 +197,13 @@ FUZZ_TARGET(txorphan, .init = initialize_orphanage)
[&] {
// Make a block out of txs and then EraseForBlock
CBlock block;
+ int64_t block_weight{0};
int num_txs = fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(0, 1000);
for (int i{0}; i < num_txs; ++i) {
auto& tx_to_remove = PickValue(fuzzed_data_provider, tx_history);
+ const auto tx_weight = GetTransactionWeight(*tx_to_remove);
+ if (block_weight + tx_weight > MAX_BLOCK_WEIGHT) break;
+ block_weight += tx_weight;
block.vtx.push_back(tx_to_remove);
}
orphanage->EraseForBlock(block);
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.