test: fix P2SH output in coins cache fuzz
What the developer wrote
Authored by Lőrinc
test: fix P2SH output in coins cache fuzz
The `coinscache_sim` fuzz target builds a 23-byte P2SH scriptPubKey manually.
Place `OP_EQUAL` at index 22, after `OP_HASH160`, the 20-byte push opcode, and the 20-byte script hash.
This matches `CScript::IsPayToScriptHash()`, which checks byte 22 for `OP_EQUAL`, see src/script/script.cpp#L229
What changed, and why it matters
This commit fixes a bug in a Bitcoin Core fuzz test (a randomized testing harness), not in the main Bitcoin software. The test was building a sample P2SH (pay-to-script-hash) output incorrectly by placing an 'OP_EQUAL' instruction at byte 12 instead of byte 22. This only affects the test's internal data setup and has no effect on real transactions, wallets, or network behavior. The second change is a trivial typo fix in a comment.
No security action required. Treat as a normal test-quality fix.
Security signals we found
Test-only code change
Incorrect P2SH scriptPubKey construction in fuzz harness
No production consensus, networking, or wallet code modified
Evidence from the diff
In src/test/fuzz/coinscache_sim.cpp, the fuzz target’s precomputed coin data constructs a 23-byte P2SH scriptPubKey as OP_HASH160, a 20-byte push, the 20-byte hash, and OP_EQUAL. The original code mistakenly wrote OP_EQUAL at index 12 (inside the 20-byte hash), making the scriptPubKey invalid and not matching CScript::IsPayToScriptHash(), which checks byte 22. The patch corrects the index to 22. A second hunk removes a stray trailing ‘*/’ from a single-line comment. This is a test-only correctness fix with no production security implications.
Changed components
src/test/fuzz/coinscache_sim.cppInspect captured patch +2 / −2
diff --git a/src/test/fuzz/coinscache_sim.cpp b/src/test/fuzz/coinscache_sim.cpp
index 9d41a6c0..15ece2e4 100644
--- a/src/test/fuzz/coinscache_sim.cpp
+++ b/src/test/fuzz/coinscache_sim.cpp
@@ -70,7 +70,7 @@ struct PrecomputedData
coins[i].out.scriptPubKey[0] = OP_HASH160;
coins[i].out.scriptPubKey[1] = 20;
std::copy(hash.begin(), hash.begin() + 20, coins[i].out.scriptPubKey.begin() + 2);
- coins[i].out.scriptPubKey[12] = OP_EQUAL;
+ coins[i].out.scriptPubKey[22] = OP_EQUAL;
break;
case 2: /* P2WPKH */
coins[i].out.scriptPubKey.resize(22);
@@ -446,7 +446,7 @@ FUZZ_TARGET(coinscache_sim)
}
}
- // HaveCoinInCache ignores spent coins, so GetCacheSize() may exceed it. */
+ // HaveCoinInCache ignores spent coins, so GetCacheSize() may exceed it.
assert(cache.GetCacheSize() >= cache_size);
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.