fuzz-tests: Replace hardcoded chunk size with iteration over sizes
What the developer wrote
Authored by Chandra Pratap
fuzz-tests: Replace hardcoded chunk size with iteration over sizes
Changelog-None: The exisiting fuzz test only extracts chunks of
a fixed size (8) from the fuzzer's input. Replace this with an
iteration over a set of chunk sizes (1 to BIGSIZE_MAX_LEN) for
better coverage.
While at it, get rid of the check `if (bs != 0)` because 0 is a
valid value for bigsize_t as well.
What changed, and why it matters
This commit only changes a fuzz test file. Fuzz tests are automated tools used to find bugs by feeding random data into functions. The change makes the test try more input chunk sizes and removes a special-case skip for zero values. There is no change to the actual production code that handles real network data or funds, so this commit does not introduce or fix a security vulnerability in the running software.
No security action required. Treat as a normal test-quality improvement.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies tests/fuzz/fuzz-bigsize.c. It replaces a single hardcoded chunk size of 8 with a loop over sizes 1 through BIGSIZE_MAX_LEN, and removes the if (bs != 0) guard so zero-valued bigsize_t inputs are also exercised. These are test-harness improvements intended to increase fuzzing coverage. The underlying fromwire_bigsize, bigsize_put, bigsize_len, and towire_bigsize implementations are untouched.
Changed components
tests/fuzz/fuzz-bigsize.cInspect captured patch +7 / −8
diff --git a/tests/fuzz/fuzz-bigsize.c b/tests/fuzz/fuzz-bigsize.c
index 8b8f1ea6..43b6af46 100644
--- a/tests/fuzz/fuzz-bigsize.c
+++ b/tests/fuzz/fuzz-bigsize.c
@@ -14,14 +14,13 @@ void run(const uint8_t *data, size_t size)
const uint8_t **wire_chunks, *wire_ptr;
size_t wire_max;
- wire_chunks = get_chunks(NULL, data, size, 8);
- for (size_t i = 0; i < tal_count(wire_chunks); i++) {
- wire_max = tal_count(wire_chunks[i]);
- wire_ptr = wire_chunks[i];
+ for (size_t max = 1; max <= BIGSIZE_MAX_LEN; max++) {
+ wire_chunks = get_chunks(NULL, data, size, max);
+ for (size_t i = 0; i < tal_count(wire_chunks); i++) {
+ wire_max = tal_count(wire_chunks[i]);
+ wire_ptr = wire_chunks[i];
- bigsize_t bs = fromwire_bigsize(&wire_ptr, &wire_max);
- if (bs != 0) {
- /* We have a valid bigsize type, now we should not error. */
+ bigsize_t bs = fromwire_bigsize(&wire_ptr, &wire_max);
assert(bigsize_put(buff, bs) > 0);
assert(bigsize_len(bs));
@@ -29,6 +28,6 @@ void run(const uint8_t *data, size_t size)
towire_bigsize(&wire_buff, bs);
tal_free(wire_buff);
}
+ tal_free(wire_chunks);
}
- tal_free(wire_chunks);
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.