ci: add libcpp hardening flags to macOS fuzz job
What the developer wrote
Authored by fanquake
ci: add libcpp hardening flags to macOS fuzz job
Follows up to
https://github.com/bitcoin/bitcoin/pull/33425#issuecomment-3323149107.
What changed, and why it matters
This commit changes only a macOS CI fuzz-testing script. It adds a compiler flag that turns on extra safety checks in Apple's C++ standard library during automated fuzz testing. It does not change any production code, wallet logic, networking, or consensus behavior. There is no indication this fixes a security bug in Bitcoin Core itself; it is a testing-hardening configuration change.
No security action required. Treat as routine CI hardening. Reviewers may verify the flag is supported by the Xcode toolchain used in the macOS CI runner.
Security signals we found
CI-only configuration change
Adds libc++ hardening to fuzz job
No source-code or build-system default changes
No bug fix or vulnerability patch in Bitcoin Core code
Evidence from the diff
The diff modifies ci/test/00_setup_env_mac_native_fuzz.sh to append -D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG to CPPFLAGS for the macOS native fuzz CI job. This enables libc++ debug hardening (e.g., iterator and container bounds checks) so that fuzz targets crash earlier on library misuse. It is a CI/test-only change and does not alter Bitcoin Core source code, build defaults for users, or runtime behavior of released binaries.
Changed components
ci/test/00_setup_env_mac_native_fuzz.shInspect captured patch +1 / −1
diff --git a/ci/test/00_setup_env_mac_native_fuzz.sh b/ci/test/00_setup_env_mac_native_fuzz.sh
index a8010c7a..ea074e47 100755
--- a/ci/test/00_setup_env_mac_native_fuzz.sh
+++ b/ci/test/00_setup_env_mac_native_fuzz.sh
@@ -8,7 +8,7 @@ export LC_ALL=C.UTF-8
export CONTAINER_NAME="ci_mac_native_fuzz" # macos does not use a container, but the env var is needed for logging
export CMAKE_GENERATOR="Ninja"
-export BITCOIN_CONFIG="-DBUILD_FOR_FUZZING=ON -DCMAKE_EXE_LINKER_FLAGS='-Wl,-stack_size -Wl,0x80000'"
+export BITCOIN_CONFIG="-DBUILD_FOR_FUZZING=ON -DCMAKE_EXE_LINKER_FLAGS='-Wl,-stack_size -Wl,0x80000' -DAPPEND_CPPFLAGS='-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG'"
export CI_OS_NAME="macos"
export NO_DEPENDS=1
export OSX_SDK=""
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.