fuzz: Exclude too expensive inputs in miniscript_string target
What the developer wrote
Authored by MarcoFalke
fuzz: Exclude too expensive inputs in miniscript_string target
What changed, and why it matters
This commit changes a Bitcoin Core fuzz test (an automated testing tool, not production code) to skip inputs that are unusually complex. The goal is to avoid wasting fuzzing time on strings that would be too slow to parse, not to fix a security bug in live Bitcoin software.
No production action required. Treat as routine fuzzing infrastructure improvement. Reviewers may verify that `HasTooManySubFrag` and `HasTooManyWrappers` thresholds are reasonable for the fuzz target.
Security signals we found
Adds resource-limit check in test harness only
Targets overly complex Miniscript string parsing during fuzzing
No change to production Miniscript parser or consensus code
Evidence from the diff
The patch adds a helper is_too_expensive in the miniscript_string fuzz target. It calls HasTooManySubFrag and HasTooManyWrappers from test/fuzz/util/descriptor.h and returns early if the input string is deemed too expensive. This is a fuzzing-efficiency/DoS-in-test-harness hardening change; it does not alter consensus, P2P, wallet, or any production parsing path.
Changed components
src/test/fuzz/miniscript.cppminiscript_string fuzz targetInspect captured patch +4 / −0
diff --git a/src/test/fuzz/miniscript.cpp b/src/test/fuzz/miniscript.cpp
index 5d9a39bb..c6f8202d 100644
--- a/src/test/fuzz/miniscript.cpp
+++ b/src/test/fuzz/miniscript.cpp
@@ -11,6 +11,7 @@
#include <test/fuzz/FuzzedDataProvider.h>
#include <test/fuzz/fuzz.h>
#include <test/fuzz/util.h>
+#include <test/fuzz/util/descriptor.h>
#include <util/strencodings.h>
#include <algorithm>
@@ -1234,9 +1235,12 @@ FUZZ_TARGET(miniscript_smart, .init = FuzzInitSmart)
/* Fuzz tests that test parsing from a string, and roundtripping via string. */
FUZZ_TARGET(miniscript_string, .init = FuzzInit)
{
+ constexpr auto is_too_expensive{[](std::span<const uint8_t> buf) { return HasTooManySubFrag(buf) || HasTooManyWrappers(buf); }};
+
if (buffer.empty()) return;
FuzzedDataProvider provider(buffer.data(), buffer.size());
auto str = provider.ConsumeBytesAsString(provider.remaining_bytes() - 1);
+ if (is_too_expensive(MakeUCharSpan(str))) return;
const ParserContext parser_ctx{(MsCtx)provider.ConsumeBool()};
auto parsed = miniscript::FromString(str, parser_ctx);
if (!parsed) return;
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.