fuzz: Restore SendMessages coverage in process_message(s) fuzz targets
What the developer wrote
Authored by MarcoFalke
fuzz: Restore SendMessages coverage in process_message(s) fuzz targets
What changed, and why it matters
This commit only changes Bitcoin Core's internal fuzz testing code (test harnesses that randomly feed network messages to the software to find bugs). It does not alter the live Bitcoin network node code that users run. The change restores a previously dropped test step (calling SendMessages during fuzzing) and fixes how test objects are reset between runs so that memory-sanitizing tools can catch dangling pointers. There is no direct security impact on production Bitcoin nodes.
No security action required for operators. Developers can treat this as a normal fuzz-harness improvement and ensure fuzz targets still build and run under AddressSanitizer/UndefinedBehaviorSanitizer.
Security signals we found
Change is confined to test/fuzz harness files and a test utility header
No modifications to consensus, net, net_processing, wallet, or RPC production logic
Commit message describes a fuzzing coverage restoration, not a vulnerability fix
Reset of node.banman/addrman/peerman is for sanitizer detection of dangling pointers in tests
Evidence from the diff
The patch modifies src/test/fuzz/process_message.cpp, src/test/fuzz/process_messages.cpp, and src/test/util/net.h. It switches the fuzz targets from creating local AddrMan/PeerManager/warnings objects to reusing the global node objects (node.addrman, node.peerman, node.warnings), resets them before each fuzz iteration, and adds a ConnmanTestMsg::SetAddrman helper so the connection manager references the same AddrMan. The stated goal is to restore SendMessages coverage in these fuzz targets and to make dangling pointers detectable by sanitizers. No production networking, consensus, or wallet code is changed.
Changed components
src/test/fuzz/process_message.cppsrc/test/fuzz/process_messages.cppsrc/test/util/net.hInspect captured patch +34 / −22
diff --git a/src/test/fuzz/process_message.cpp b/src/test/fuzz/process_message.cpp
index 809831a6..ef8cb686 100644
--- a/src/test/fuzz/process_message.cpp
+++ b/src/test/fuzz/process_message.cpp
@@ -2,6 +2,7 @@
// Distributed under the MIT software license, see the accompanying
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+#include <banman.h>
#include <consensus/consensus.h>
#include <net.h>
#include <net_processing.h>
@@ -67,27 +68,31 @@ FUZZ_TARGET(process_message, .init = initialize_process_message)
SeedRandomStateForTest(SeedRand::ZEROS);
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
- auto& connman = static_cast<ConnmanTestMsg&>(*g_setup->m_node.connman);
+ auto& node{g_setup->m_node};
+ auto& connman{static_cast<ConnmanTestMsg&>(*node.connman)};
connman.ResetAddrCache();
connman.ResetMaxOutboundCycle();
- auto& chainman = static_cast<TestChainstateManager&>(*g_setup->m_node.chainman);
+ auto& chainman{static_cast<TestChainstateManager&>(*node.chainman)};
const auto block_index_size{WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())};
SetMockTime(1610000000); // any time to successfully reset ibd
chainman.ResetIbd();
chainman.DisableNextWrite();
- node::Warnings warnings{};
- NetGroupManager netgroupman{{}};
- AddrMan addrman{netgroupman, /*deterministic=*/true, /*consistency_check_ratio=*/0};
- auto peerman = PeerManager::make(connman, addrman,
+ // Reset, so that dangling pointers can be detected by sanitizers.
+ node.banman.reset();
+ node.addrman.reset();
+ node.peerman.reset();
+ node.addrman = std::make_unique<AddrMan>(*node.netgroupman, /*deterministic=*/true, /*consistency_check_ratio=*/0);
+ node.peerman = PeerManager::make(connman, *node.addrman,
/*banman=*/nullptr, chainman,
- *g_setup->m_node.mempool, warnings,
+ *node.mempool, *node.warnings,
PeerManager::Options{
.reconcile_txs = true,
.deterministic_rng = true,
});
- connman.SetMsgProc(peerman.get());
+ connman.SetMsgProc(node.peerman.get());
+ connman.SetAddrman(*node.addrman);
LOCK(NetEventsInterface::g_msgproc_mutex);
const std::string random_message_type{fuzzed_data_provider.ConsumeBytesAsString(CMessageHeader::MESSAGE_TYPE_SIZE).c_str()};
@@ -116,10 +121,10 @@ FUZZ_TARGET(process_message, .init = initialize_process_message)
more_work = connman.ProcessMessagesOnce(p2p_node);
} catch (const std::ios_base::failure&) {
}
- g_setup->m_node.peerman->SendMessages(&p2p_node);
+ node.peerman->SendMessages(&p2p_node);
}
- g_setup->m_node.validation_signals->SyncWithValidationInterfaceQueue();
- g_setup->m_node.connman->StopNodes();
+ node.validation_signals->SyncWithValidationInterfaceQueue();
+ node.connman->StopNodes();
if (block_index_size != WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())) {
// Reuse the global chainman, but reset it when it is dirty
ResetChainman(*g_setup);
diff --git a/src/test/fuzz/process_messages.cpp b/src/test/fuzz/process_messages.cpp
index baaeffe3..f36f528b 100644
--- a/src/test/fuzz/process_messages.cpp
+++ b/src/test/fuzz/process_messages.cpp
@@ -2,6 +2,7 @@
// Distributed under the MIT software license, see the accompanying
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+#include <banman.h>
#include <consensus/consensus.h>
#include <net.h>
#include <net_processing.h>
@@ -57,26 +58,30 @@ FUZZ_TARGET(process_messages, .init = initialize_process_messages)
SeedRandomStateForTest(SeedRand::ZEROS);
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
- auto& connman = static_cast<ConnmanTestMsg&>(*g_setup->m_node.connman);
+ auto& node{g_setup->m_node};
+ auto& connman{static_cast<ConnmanTestMsg&>(*node.connman)};
connman.ResetAddrCache();
connman.ResetMaxOutboundCycle();
- auto& chainman = static_cast<TestChainstateManager&>(*g_setup->m_node.chainman);
+ auto& chainman{static_cast<TestChainstateManager&>(*node.chainman)};
const auto block_index_size{WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())};
SetMockTime(1610000000); // any time to successfully reset ibd
chainman.ResetIbd();
chainman.DisableNextWrite();
- node::Warnings warnings{};
- NetGroupManager netgroupman{{}};
- AddrMan addrman{netgroupman, /*deterministic=*/true, /*consistency_check_ratio=*/0};
- auto peerman = PeerManager::make(connman, addrman,
+ // Reset, so that dangling pointers can be detected by sanitizers.
+ node.banman.reset();
+ node.addrman.reset();
+ node.peerman.reset();
+ node.addrman = std::make_unique<AddrMan>(*node.netgroupman, /*deterministic=*/true, /*consistency_check_ratio=*/0);
+ node.peerman = PeerManager::make(connman, *node.addrman,
/*banman=*/nullptr, chainman,
- *g_setup->m_node.mempool, warnings,
+ *node.mempool, *node.warnings,
PeerManager::Options{
.reconcile_txs = true,
.deterministic_rng = true,
});
- connman.SetMsgProc(peerman.get());
+ connman.SetMsgProc(node.peerman.get());
+ connman.SetAddrman(*node.addrman);
LOCK(NetEventsInterface::g_msgproc_mutex);
@@ -115,11 +120,11 @@ FUZZ_TARGET(process_messages, .init = initialize_process_messages)
more_work = connman.ProcessMessagesOnce(random_node);
} catch (const std::ios_base::failure&) {
}
- g_setup->m_node.peerman->SendMessages(&random_node);
+ node.peerman->SendMessages(&random_node);
}
}
- g_setup->m_node.validation_signals->SyncWithValidationInterfaceQueue();
- g_setup->m_node.connman->StopNodes();
+ node.validation_signals->SyncWithValidationInterfaceQueue();
+ node.connman->StopNodes();
if (block_index_size != WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())) {
// Reuse the global chainman, but reset it when it is dirty
ResetChainman(*g_setup);
diff --git a/src/test/util/net.h b/src/test/util/net.h
index 605b2fa8..ee02d404 100644
--- a/src/test/util/net.h
+++ b/src/test/util/net.h
@@ -40,6 +40,8 @@ struct ConnmanTestMsg : public CConnman {
m_msgproc = msgproc;
}
+ void SetAddrman(AddrMan& in) { addrman = in; }
+
void SetPeerConnectTimeout(std::chrono::seconds timeout)
{
m_peer_connect_timeout = timeout;
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.