fuzz: Reject some more "expensive" descriptors in the scriptpubkeyman target
What the developer wrote
Authored by MarcoFalke
fuzz: Reject some more "expensive" descriptors in the scriptpubkeyman target
The same are rejected in the descriptor_parse target, so it makes sense
to reject them here as well.
What changed, and why it matters
This is a small change to a Bitcoin Core fuzz test (a developer testing tool that feeds random data to code to find bugs). It makes the test skip more kinds of unusually complex descriptor strings so the fuzzer spends time on realistic inputs instead of wasting compute on pathological ones. It does not change any production wallet or network code, so it has no direct effect on real users' funds or node security.
No action needed for operators or users. Developers can treat this as a routine fuzz-target quality improvement. If reviewing, verify that HasTooManySubFrag and HasTooManyWrappers are defined and used consistently with the descriptor_parse target.
Security signals we found
Fuzz-test hardening only
No production code path changed
No memory safety, cryptographic, or consensus changes visible
Aligns filtering logic with an existing fuzz target
Evidence from the diff
The commit modifies src/wallet/test/fuzz/scriptpubkeyman.cpp. It renames TooDeepDerivPath() to IsTooExpensive() and expands the cheap pre-filter to also reject descriptors with too many sub-fragments or wrappers, using the same helpers already used in the descriptor_parse fuzz target. The change only affects fuzzing input filtering; no runtime wallet logic, consensus code, or P2P behavior is altered.
Changed components
src/wallet/test/fuzz/scriptpubkeyman.cppInspect captured patch +6 / −7
diff --git a/src/wallet/test/fuzz/scriptpubkeyman.cpp b/src/wallet/test/fuzz/scriptpubkeyman.cpp
index ea1431a7..ff9d1cc0 100644
--- a/src/wallet/test/fuzz/scriptpubkeyman.cpp
+++ b/src/wallet/test/fuzz/scriptpubkeyman.cpp
@@ -51,20 +51,19 @@ void initialize_spkm()
}
/**
- * Key derivation is expensive. Deriving deep derivation paths take a lot of compute and we'd rather spend time
- * elsewhere in this target, like on actually fuzzing the DescriptorScriptPubKeyMan. So rule out strings which could
- * correspond to a descriptor containing a too large derivation path.
+ * Deriving "expensive" descriptors will consume useful fuzz compute. The
+ * compute is better spent on a smaller subset of descriptors, which still
+ * covers all real end-user settings.
*/
-static bool TooDeepDerivPath(std::string_view desc)
+static bool IsTooExpensive(std::span<const uint8_t> desc)
{
- const FuzzBufferType desc_buf{reinterpret_cast<const unsigned char *>(desc.data()), desc.size()};
- return HasDeepDerivPath(desc_buf);
+ return HasDeepDerivPath(desc) || HasTooManySubFrag(desc) || HasTooManyWrappers(desc);
}
static std::optional<std::pair<WalletDescriptor, FlatSigningProvider>> CreateWalletDescriptor(FuzzedDataProvider& fuzzed_data_provider)
{
const std::string mocked_descriptor{fuzzed_data_provider.ConsumeRandomLengthString()};
- if (TooDeepDerivPath(mocked_descriptor)) return {};
+ if (IsTooExpensive(MakeUCharSpan(mocked_descriptor))) return {};
const auto desc_str{MOCKED_DESC_CONVERTER.GetDescriptor(mocked_descriptor)};
if (!desc_str.has_value()) return std::nullopt;
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.