fuzz-tests: add a test for handle_peer_error_or_warning()
What changed, and why it matters
This commit only adds a new automated fuzz test for a message-handling function. It does not change the actual network or message-handling code, so it cannot introduce a security vulnerability by itself. It is a testing improvement.
No security action needed. Treat as normal test coverage addition.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit adds a fuzz target (tests/fuzz/fuzz-error-warning.c) and its Makefile dependencies for handle_peer_error_or_warning() in common/read_peer_msg.{c,h}. The fuzz harness mocks peer_failed_connection_lost() and peer_failed_received_errmsg() and feeds arbitrary bytes to the parser. No production code is modified.
Changed components
tests/fuzz/fuzz-error-warning.ctests/fuzz/MakefileInspect captured patch +48 / −0
diff --git a/tests/fuzz/Makefile b/tests/fuzz/Makefile
index 3caf76c3..2fadf25d 100644
--- a/tests/fuzz/Makefile
+++ b/tests/fuzz/Makefile
@@ -73,5 +73,11 @@ FUZZ_COMMON_OBJS := \
$(FUZZ_TARGETS_OBJS): $(COMMON_HEADERS) $(WIRE_HEADERS) $(COMMON_SRC)
$(FUZZ_TARGETS_BIN): $(LIBFUZZ_OBJS) $(FUZZ_COMMON_OBJS) $(BITCOIN_OBJS)
+tests/fuzz/fuzz-error-warning: common/peer_billboard.o \
+ common/wire_error.o \
+ common/peer_io.o \
+ common/read_peer_msg.o \
+ common/peer_status_wiregen.o
+
ALL_C_SOURCES += $(FUZZ_TARGETS_SRC) $(LIBFUZZ_SRC)
ALL_FUZZ_TARGETS += $(FUZZ_TARGETS_BIN)
diff --git a/tests/fuzz/fuzz-error-warning.c b/tests/fuzz/fuzz-error-warning.c
new file mode 100644
index 00000000..b28c70b6
--- /dev/null
+++ b/tests/fuzz/fuzz-error-warning.c
@@ -0,0 +1,42 @@
+#include "config.h"
+#include <stdio.h>
+#include <fcntl.h>
+#include <setjmp.h>
+#include <common/per_peer_state.h>
+#include <common/peer_failed.h>
+#include <common/read_peer_msg.h>
+#include <common/status.h>
+#include <common/utils.h>
+#include <tests/fuzz/libfuzz.h>
+
+static jmp_buf exit_jmp;
+
+/* MOCKS START */
+/* Stub for peer_failed_connection_lost */
+void peer_failed_connection_lost(void)
+{ fprintf(stderr, "peer_failed_connection_lost called!\n"); abort(); }
+/* Stub for peer_failed_received_errmsg */
+void peer_failed_received_errmsg(struct per_peer_state *pps UNNEEDED,
+ bool disconnect UNNEEDED,
+ const char *desc)
+
+{ longjmp(exit_jmp, 1); }
+/* MOCKS END */
+
+void init(int *argc, char ***argv)
+{
+ int devnull = open("/dev/null", O_WRONLY);
+ status_setup_sync(devnull);
+}
+
+void run(const u8 *data, size_t size)
+{
+ if (setjmp(exit_jmp) != 0)
+ return;
+
+ u8 *msg = tal_dup_arr(tmpctx, u8, data, size, 0);
+ struct per_peer_state pps = { .peer_fd = -1 };
+ handle_peer_error_or_warning(&pps, msg);
+
+ clean_tmpctx();
+}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.