fuzz: Use LIMITED_WHILE over for-loop with consumed size integral
What the developer wrote
Authored by MarcoFalke
fuzz: Use LIMITED_WHILE over for-loop with consumed size integral
This is a style cleanup. The general pattern to use `LIMITED_WHILE`,
which all other fuzz tests use, has some benefits:
* When no data is available, a simple and single (let's say) 64 value in
the fuzz input will not result in 64 loops over the same body with the
same default/fallback values.
* When no data is available, `ConsumeBool` falls back to `false` and
breaks the loop early.
* When further data is available, the overhead is just a single byte,
making it also possibly easier for the fuzz engine to mutate the data,
as a single int that influences the whole remainder of the fuzz input
can lead to the 'havoc' effect.
* When a crash is reduced, deleting bytes will directly influence the
execution length, so byte-length of the fuzz input roughly corresponds
to run-time length.
What changed, and why it matters
This commit is a minor style cleanup inside a fuzz test (a test that feeds random data to software to find bugs). It replaces a loop that reads a number from fuzz input with a standard helper that reads a single true/false byte each iteration. There is no change to production Bitcoin Core code, no user-facing behavior change, and no security fix.
No security action needed. Treat as normal code-quality/test-maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
In src/ipc/test/fuzz/ipc.cpp, the fuzz target previously consumed a size_t in the range [1,64] to drive loop iterations. The patch switches to the LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 64) idiom used by other fuzz targets. This only affects how the fuzz harness interprets its input bytes; the IPC call dispatch body is unchanged. It is not a vulnerability patch and does not alter consensus, networking, wallet, or node logic.
Changed components
src/ipc/test/fuzz/ipc.cppInspect captured patch +1 / −3
diff --git a/src/ipc/test/fuzz/ipc.cpp b/src/ipc/test/fuzz/ipc.cpp
index ab789f3a..ee424e2a 100644
--- a/src/ipc/test/fuzz/ipc.cpp
+++ b/src/ipc/test/fuzz/ipc.cpp
@@ -91,9 +91,7 @@ FUZZ_TARGET(ipc, .init = initialize_ipc)
{
auto& ipc = *g_ipc;
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
- const size_t iterations = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 64);
-
- for (size_t i = 0; i < iterations; ++i) {
+ LIMITED_WHILE (fuzzed_data_provider.ConsumeBool(), 64) {
CallOneOf(
fuzzed_data_provider,
[&] {
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.