fuzz: fix dead HD keypaths (de)serialization round-trip
What the developer wrote
Authored by Sebastian Falbesoner
fuzz: fix dead HD keypaths (de)serialization round-trip
`DeserializeHDKeypaths()` was writing into the original `hd_keypaths`
map instead of `deserialized_hd_keypaths`. As a result the latter was
always empty and the round-trip assertion following was trivially true,
so the serialize/deserialize round-trip wasn't actually being exercised.
That bug was introduced with the commit introducing the fuzz target
(commit f898ef65c947776750e49d050633f830546bbdc6, #18994).
What changed, and why it matters
This commit fixes a one-line bug in a Bitcoin Core fuzz test (an automated testing tool). The test was supposed to check that serializing and then deserializing HD keypaths produced the same data, but it accidentally wrote the deserialized result back into the original map. This made the test's final check always pass, so the round-trip was not actually being tested. It is a test-only bug, not a vulnerability in live Bitcoin Core code.
No production action needed. The fix is already merged. Fuzzing infrastructure will now exercise the HD keypath round-trip correctly.
Security signals we found
Test-only bug with no runtime effect
Incorrect assertion target weakened fuzz coverage
No change to consensus, networking, wallet, or serialization logic
Evidence from the diff
In src/test/fuzz/script_sign.cpp, the fuzz target for script signing called DeserializeHDKeypaths(serialized, key, hd_keypaths) instead of DeserializeHDKeypaths(serialized, key, deserialized_hd_keypaths). Because the destination map was the source map, deserialized_hd_keypaths remained empty, and the subsequent assertion hd_keypaths.size() >= deserialized_hd_keypaths.size() was trivially satisfied. The fix passes the intended destination map so the round-trip is actually validated.
Changed components
src/test/fuzz/script_sign.cppInspect captured patch +1 / −1
diff --git a/src/test/fuzz/script_sign.cpp b/src/test/fuzz/script_sign.cpp
index 036b9ff3..ba269bed 100644
--- a/src/test/fuzz/script_sign.cpp
+++ b/src/test/fuzz/script_sign.cpp
@@ -67,7 +67,7 @@ FUZZ_TARGET(script_sign, .init = initialize_script_sign)
}
std::map<CPubKey, KeyOriginInfo> deserialized_hd_keypaths;
try {
- DeserializeHDKeypaths(serialized, key, hd_keypaths);
+ DeserializeHDKeypaths(serialized, key, deserialized_hd_keypaths);
} catch (const std::ios_base::failure&) {
}
assert(hd_keypaths.size() >= deserialized_hd_keypaths.size());
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.