What the developer wrote
Authored by marcofleon
fuzz: Remove ConsumeUniValue
The helper created a UniValue with hard-coded constants, which
isn't ideal for fuzz tests. Replace it in the ipc fuzz test with
parsing a UniValue directly from the fuzzed data provider.
What changed, and why it matters
This commit removes a fuzz-test helper that built a UniValue from hard-coded constants and replaces it with parsing a UniValue from random fuzz data. It only affects test code and does not change production behavior or fix a security vulnerability.
No action required. This is a benign fuzz-test refactoring.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change deletes ConsumeUniValue() from src/test/fuzz/util.cpp/util.h and updates src/ipc/test/fuzz/ipc.cpp to call UniValue::read() on a random-length string from the fuzzed data provider. The previous helper always produced the same object shape with a fixed string, reducing fuzz coverage. The new approach exercises the UniValue parser with arbitrary input. This is a test-quality improvement, not a runtime security fix.
Changed components
src/test/fuzz/util.cppsrc/test/fuzz/util.hsrc/ipc/test/fuzz/ipc.cppInspect captured patch +2 / −14
diff --git a/src/ipc/test/fuzz/ipc.cpp b/src/ipc/test/fuzz/ipc.cpp
index 76374c43..ab789f3a 100644
--- a/src/ipc/test/fuzz/ipc.cpp
+++ b/src/ipc/test/fuzz/ipc.cpp
@@ -123,7 +123,8 @@ FUZZ_TARGET(ipc, .init = initialize_ipc)
assert(ipc.m_client->passScript(script) == expected);
},
[&] {
- UniValue value = ConsumeUniValue(fuzzed_data_provider);
+ UniValue value;
+ if (!value.read(fuzzed_data_provider.ConsumeRandomLengthString(512))) return;
assert(ipc.m_client->passUniValue(value).write() == value.write());
},
[&] {
diff --git a/src/test/fuzz/util.cpp b/src/test/fuzz/util.cpp
index 3c4c0a20..da0e2dea 100644
--- a/src/test/fuzz/util.cpp
+++ b/src/test/fuzz/util.cpp
@@ -237,16 +237,6 @@ CKey ConsumePrivateKey(FuzzedDataProvider& fuzzed_data_provider, std::optional<b
return key;
}
-UniValue ConsumeUniValue(FuzzedDataProvider& fuzzed_data_provider) noexcept
-{
- UniValue value{UniValue::VOBJ};
- value.pushKV("bool", fuzzed_data_provider.ConsumeBool());
- value.pushKV("number", fuzzed_data_provider.ConsumeIntegralInRange<int>(-1'000'000, 1'000'000));
- value.pushKV("string", "ipc fuzz");
-
- return value;
-}
-
bool ContainsSpentInput(const CTransaction& tx, const CCoinsViewCache& inputs) noexcept
{
for (const CTxIn& tx_in : tx.vin) {
diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h
index 0bcb6ccf..04edef0b 100644
--- a/src/test/fuzz/util.h
+++ b/src/test/fuzz/util.h
@@ -5,7 +5,6 @@
#ifndef BITCOIN_TEST_FUZZ_UTIL_H
#define BITCOIN_TEST_FUZZ_UTIL_H
-#include <univalue.h>
#include <addresstype.h>
#include <arith_uint256.h>
#include <coins.h>
@@ -229,8 +228,6 @@ template <class Dur>
[[nodiscard]] CKey ConsumePrivateKey(FuzzedDataProvider& fuzzed_data_provider, std::optional<bool> compressed = std::nullopt) noexcept;
-[[nodiscard]] UniValue ConsumeUniValue(FuzzedDataProvider& fuzzed_data_provider) noexcept;
-
template <typename T>
[[nodiscard]] bool MultiplicationOverflow(const T i, const T j) noexcept
{
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.