fuzz: Fix incorrect loop bounds in `clusterlin_postlinearize_tree`
What the developer wrote
Authored by marcofleon
fuzz: Fix incorrect loop bounds in `clusterlin_postlinearize_tree`
The dependency graphs generated by this test can have holes
(unused indices) in them. This means some of the transactions
were skipped when using `depgraph_gen.TxCount()` as the upper
bound of the loop. Switch to using `depgraph.Positions()` to
correctly handle sparse graphs.
What changed, and why it matters
This commit fixes a bug in an internal Bitcoin Core fuzz test (a randomized self-test used during development). The test was looping over transaction indices using the total transaction count, but some indices can be unused 'holes' in the generated test data. As a result, the test sometimes skipped valid transactions or accessed unused slots. The fix makes the loop iterate over only the actually-used positions. This appears to be a test-only correctness issue, not a vulnerability in live Bitcoin Core code.
No production action required. Include this fix in normal development/testing to keep fuzz tests accurate and avoid false negatives in coverage-guided fuzzing.
Security signals we found
Test-only code change
Loop bounds corrected to skip unused graph indices
No consensus, P2P, wallet, RPC, or cryptographic code modified
Evidence from the diff
In src/test/fuzz/cluster_linearize.cpp, the clusterlin_postlinearize_tree fuzz target builds a dependency graph tree from a generated depgraph. The generated depgraph may contain sparse indices (holes), so TxCount() overestimates the set of valid positions. The patch replaces two for loops that used i < depgraph_gen.TxCount() with range-based iteration over depgraph_gen.Positions(), ensuring every processed index corresponds to an actual transaction in the graph. This is a fuzz-test logic correction; the changed code is not part of consensus, networking, wallet, or RPC handling.
Changed components
src/test/fuzz/cluster_linearize.cppclusterlin_postlinearize_tree fuzz targetInspect captured patch +2 / −2
diff --git a/src/test/fuzz/cluster_linearize.cpp b/src/test/fuzz/cluster_linearize.cpp
index 61b95c71..86734591 100644
--- a/src/test/fuzz/cluster_linearize.cpp
+++ b/src/test/fuzz/cluster_linearize.cpp
@@ -1275,14 +1275,14 @@ FUZZ_TARGET(clusterlin_postlinearize_tree)
depgraph_tree.RemoveTransactions(TestBitSet::Fill(depgraph_gen.PositionRange()) - depgraph_gen.Positions());
if (direction & 1) {
- for (DepGraphIndex i = 0; i < depgraph_gen.TxCount(); ++i) {
+ for (DepGraphIndex i : depgraph_gen.Positions()) {
auto children = depgraph_gen.GetReducedChildren(i);
if (children.Any()) {
depgraph_tree.AddDependencies(TestBitSet::Singleton(i), children.First());
}
}
} else {
- for (DepGraphIndex i = 0; i < depgraph_gen.TxCount(); ++i) {
+ for (DepGraphIndex i : depgraph_gen.Positions()) {
auto parents = depgraph_gen.GetReducedParents(i);
if (parents.Any()) {
depgraph_tree.AddDependencies(TestBitSet::Singleton(parents.First()), i);
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.