fuzz-tests: Replace manual allocations with `tal_arr()`
What the developer wrote
Authored by Chandra Pratap
fuzz-tests: Replace manual allocations with `tal_arr()`
Changelog-None: Use the common library utilities for temporary
allocations instead of manually calling `malloc` and `free`.
This makes the code conformant with rest of the codebase and
reduces the chances of leaks.
What changed, and why it matters
This change only affects a fuzz test file, not the main Core Lightning software. It swaps manual malloc/free memory calls for the project's standard temporary-memory helper (tal_arr). That makes the test code match the rest of the codebase and removes the chance of forgetting to free memory inside the test. There is no direct security fix for live users.
No action required for production deployments. Treat as a normal code-quality/test-maintenance commit.
Security signals we found
Memory-management hardening in test harness
Removal of manual malloc/free pairs
Use of project-standard tal_arr allocator
Evidence from the diff
In tests/fuzz/fuzz-bech32.c, all malloc()/free() pairs are replaced with tal_arr(tmpctx, …) allocations and a final clean_tmpctx(). The change removes explicit free() calls and relies on tmpctx cleanup. The file is a fuzzing harness, so this is a code-quality/test-hardening refactor rather than a patch for a reachable runtime vulnerability.
Changed components
tests/fuzz/fuzz-bech32.cInspect captured patch +7 / −12
diff --git a/tests/fuzz/fuzz-bech32.c b/tests/fuzz/fuzz-bech32.c
index a397dc86..beda53be 100644
--- a/tests/fuzz/fuzz-bech32.c
+++ b/tests/fuzz/fuzz-bech32.c
@@ -1,6 +1,6 @@
#include "config.h"
#include <assert.h>
-
+#include <common/utils.h>
#include <common/bech32.h>
#include <stdint.h>
#include <string.h>
@@ -25,11 +25,11 @@ void run(const uint8_t *data, size_t size)
/* Buffer size is defined in each function's doc comment. */
benc = data[0] ? BECH32_ENCODING_BECH32 : BECH32_ENCODING_BECH32M;
bech32_str_cap = (size - 1) + strlen(hrp_inv) + 8;
- bech32_str = malloc(bech32_str_cap);
+ bech32_str = tal_arr(tmpctx, char, bech32_str_cap);
if (bech32_encode(bech32_str, hrp_inv, data + 1, size - 1,
bech32_str_cap, benc) == 1) {
- hrp_out = malloc(strlen(bech32_str) - 6);
- data_out = malloc(strlen(bech32_str) - 8);
+ hrp_out = tal_arr(tmpctx, char, strlen(bech32_str) - 6);
+ data_out = tal_arr(tmpctx, uint8_t, strlen(bech32_str) - 8);
benc_decoded = bech32_decode(hrp_out, data_out, &data_out_len,
bech32_str, bech32_str_cap);
@@ -37,13 +37,9 @@ void run(const uint8_t *data, size_t size)
assert(strcmp(hrp_inv, hrp_out) == 0);
assert(data_out_len == size - 1);
assert(memcmp(data_out, data + 1, data_out_len) == 0);
-
- free(hrp_out);
- free(data_out);
}
- free(bech32_str);
- data_out = malloc(size);
+ data_out = tal_arr(tmpctx, uint8_t, size);
/* This is also used as part of sign and check message. */
data_out_len = 0;
@@ -51,7 +47,7 @@ void run(const uint8_t *data, size_t size)
data_out_len = 0;
bech32_convert_bits(data_out, &data_out_len, 8, data, size, 5, 0);
- addr = malloc(73 + strlen(hrp_addr));
+ addr = tal_arr(tmpctx, char, 73 + strlen(hrp_addr));
for (int wit_version = 0; wit_version < 2; ++wit_version) {
if (segwit_addr_encode(addr, hrp_addr, wit_version, data,
size) == 0)
@@ -63,7 +59,6 @@ void run(const uint8_t *data, size_t size)
assert(data_out_len == size);
assert(memcmp(data_out, data, data_out_len) == 0);
}
- free(addr);
- free(data_out);
+ clean_tmpctx();
}
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.