fuzz: send blocktxn messages in cmpctblock harness
What changed, and why it matters
This commit adds a new test case to an existing fuzzing harness for Bitcoin Core's compact block (cmpctblock) handling. It does not change production code, network behavior, or wallet logic. The new code only runs inside a fuzz test and randomly sends 'blocktxn' messages to exercise more code paths during automated testing. There is no security vulnerability here.
No action required. This is a benign test-only change. Normal code review and CI approval are sufficient.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch extends src/test/fuzz/cmpctblock.cpp by adding another lambda in the fuzz target’s switch table. When triggered, it picks a previously-generated block from the harness’s internal state and constructs a BlockTransactions (BLOCKTXN) P2P message containing a random subset of that block’s transactions. This is purely a fuzzing coverage improvement for compact-block reconstruction logic and does not modify consensus, mempool, net_processing, or any runtime node behavior.
Changed components
src/test/fuzz/cmpctblock.cppInspect captured patch +23 / −0
diff --git a/src/test/fuzz/cmpctblock.cpp b/src/test/fuzz/cmpctblock.cpp
index e14930a0..3e4268cb 100644
--- a/src/test/fuzz/cmpctblock.cpp
+++ b/src/test/fuzz/cmpctblock.cpp
@@ -379,6 +379,29 @@ FUZZ_TARGET(cmpctblock, .init = initialize_cmpctblock)
CBlockHeaderAndShortTxIDs base_cmpctblock = cmpctblock;
net_msg = NetMsg::Make(NetMsgType::CMPCTBLOCK, base_cmpctblock);
},
+ [&]() {
+ // Send a blocktxn message for an existing block (if one exists).
+ size_t num_blocks = info.size();
+ if (num_blocks == 0) {
+ sent_net_msg = false;
+ return;
+ }
+
+ // Fetch an existing block and randomly choose transactions to send over.
+ size_t index = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, num_blocks - 1);
+ const BlockInfo& block_info = info[index];
+ BlockTransactions block_txn;
+ block_txn.blockhash = block_info.hash;
+ std::shared_ptr<CBlock> cblock = block_info.block;
+
+ for (size_t i = 0; i < cblock->vtx.size(); i++) {
+ if (fuzzed_data_provider.ConsumeBool()) continue;
+
+ block_txn.txn.push_back(cblock->vtx[i]);
+ }
+
+ net_msg = NetMsg::Make(NetMsgType::BLOCKTXN, block_txn);
+ },
[&]() {
// Send a headers message for an existing block (if one exists).
size_t num_blocks = info.size();
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.