fuzz-tests: fix overflow of u32 in `fuzz-close-tx`
What the developer wrote
Authored by Chandra Pratap
fuzz-tests: fix overflow of u32 in `fuzz-close-tx`
Changelog-None: The value WALLY_SATOSHI_PER_BTC * WALLY_BTC_MAX
is equal to 2.1e15, which is much higher than the maximum capacity
of a u32, which is 4.29e9.
Hence, use a u64 to store this value instead.
What changed, and why it matters
This commit fixes a variable type bug in a fuzz test, not in the main Core Lightning software. A fuzz test is an automated testing tool that feeds random data to a program to find crashes. The bug was that a calculation used a 32-bit integer (u32) to hold a value far larger than it can represent, causing an overflow. The fix changes the variable type to a 64-bit integer (u64). Because this is only in a test file, it does not directly affect real Lightning nodes or user funds.
No urgent action for node operators. Developers should ensure fuzz harnesses are compiled with sanitizer flags and review similar casts in other fuzz tests for analogous overflow patterns.
Security signals we found
Integer overflow in test-only fuzz harness
Type-widening fix from u32 to u64
No production code or consensus logic modified
Evidence from the diff
In tests/fuzz/fuzz-close_tx.c, the expression (u32)WALLY_SATOSHI_PER_BTC * WALLY_BTC_MAX was evaluated using a 32-bit unsigned integer, resulting in integer overflow because the product (~2.1e15) exceeds the u32 maximum (~4.29e9). The patch casts to u64 instead, preserving the intended maximum-satoshi value. This is a test-only correction; the production close-transaction logic is not changed.
Changed components
tests/fuzz/fuzz-close_tx.cInspect captured patch +1 / −1
diff --git a/tests/fuzz/fuzz-close_tx.c b/tests/fuzz/fuzz-close_tx.c
index 58f4a67..0fd29e5 100644
--- a/tests/fuzz/fuzz-close_tx.c
+++ b/tests/fuzz/fuzz-close_tx.c
@@ -54,7 +54,7 @@ void run(const uint8_t *data, size_t size)
if (!(amount_sat_add(&funding, to_us, to_them)))
return;
/* .. And < max_btc as we assert it's not nonsensical! */
- max = AMOUNT_SAT((u32)WALLY_SATOSHI_PER_BTC * WALLY_BTC_MAX);
+ max = AMOUNT_SAT((u64)WALLY_SATOSHI_PER_BTC * WALLY_BTC_MAX);
if (amount_sat_greater(funding, max)) {
funding = max;
to_us = amount_sat_div(max, 2);
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.