Merge rust-bitcoin/rust-bitcoin#6814: fuzz: delete stale `hashes_0_32_cbor` target
What the developer wrote
Authored by Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6814: fuzz: delete stale `hashes_0_32_cbor` target
b384c8fd5707b8977372ff4728245440d86ae59e fuzz: delete hashes_0_32_cbor target (satsfy (Renato Britto))
Pull request description:
Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6813
As https://github.com/rust-bitcoin/rust-bitcoin/issues/6813#issuecomment-5493237551 says:
> The fuzz failure here is "real" but it's a 0.32.x that we deleted on master in https://github.com/rust-bitcoin/rust-bitcoin/pull/2803 because it was triggering false positives.
>
> We should just delete the test.
Corpus job crashes because `serde_cbor` accepts various encodings for the same input, producing false positives.
The current hashes crate deleted this test long ago. Drop the unused `serde_cbor` dependency.
Branches 0.32.xx and 0.32.xxx don't have fuzz targets so the problem is not applicable there.
ACKs for top commit:
apoelstra:
ACK b384c8fd5707b8977372ff4728245440d86ae59e; successfully ran local tests
Tree-SHA512: 644c2bdace7e70b17d42a9bf70491c1fedd3881e270a1bd0da12664a38a067ba074dc0ba7e18fd3837304a601ef501cc72719871d5c86b4a279e65c2bf651028
What changed, and why it matters
This commit removes an old fuzzing test that was producing false alarms. The test checked that data could be decoded and re-encoded by an old library (serde_cbor) and get the exact same bytes back, but that library has multiple valid ways to encode the same thing, so the test was unreliable. There is no security vulnerability being fixed here—just cleanup of a stale test and its unused dependency.
No security action required. This is routine repository maintenance. If tracking supply-chain hygiene, note that `serde_cbor` (and its `half` transitive dependency) is no longer in the dependency tree for this crate.
Security signals we found
No security signal: removal of stale fuzz target causing false-positive corpus crashes
No runtime code changes
No bug fix or vulnerability patch present in diff
Evidence from the diff
The merge deletes the hashes_0_32_cbor fuzz target and drops the serde_cbor dependency from the fuzz crate. The deleted target round-tripped CBOR-encoded hash/HMAC structures and asserted byte-for-byte equality between input and re-encoded output. Because serde_cbor accepts multiple canonical encodings for the same value, the fuzzer reported spurious failures. The corresponding test was already removed from the current hashes crate in PR #2803. This change only affects fuzzing infrastructure; no runtime library code is modified.
Changed components
fuzz/fuzz_targets/hashes_0_32/cbor.rsfuzz/Cargo.tomlCargo-minimal.lockCargo-recent.lockInspect captured patch +0 / −77
### Cargo-minimal.lock
@@ -181,7 +181,6 @@ dependencies = [
"bitcoin-p2p-messages",
"libfuzzer-sys",
"serde",
- "serde_cbor",
"serde_json",
"standard_test",
]
@@ -469,12 +468,6 @@ dependencies = [
"windows-targets",
]
-[[package]]
-name = "half"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a581f551b77eb3e177584e922a8c057e14311a857f859fd39d9574d97d3547da"
-
[[package]]
name = "hex-conservative"
version = "0.2.2"
@@ -709,17 +702,6 @@ dependencies = [
"serde_derive",
]
-[[package]]
-name = "serde_cbor"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45cd6d95391b16cd57e88b68be41d504183b7faae22030c0cc3b3f73dd57b2fd"
-dependencies = [
- "byteorder",
- "half",
- "serde",
-]
-
[[package]]
name = "serde_derive"
version = "1.0.195"
### Cargo-recent.lock
@@ -93,7 +93,6 @@ dependencies = [
"bitcoin_hashes 1.2.0",
"bitcoinconsensus",
"hex-conservative 1.1.0",
-
"secp256k1 0.33.0",
"serde",
"serde_json",
@@ -175,7 +174,6 @@ dependencies = [
"bitcoin-p2p-messages",
"libfuzzer-sys",
"serde",
- "serde_cbor",
"serde_json",
"standard_test",
]
@@ -394,12 +392,6 @@ dependencies = [
"wasip2",
]
-[[package]]
-name = "half"
-version = "1.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b43ede17f21864e81be2fa654110bf1e793774238d86ef8555c37e6519c0403"
-
[[package]]
name = "hex-conservative"
version = "0.2.2"
@@ -588,17 +580,6 @@ dependencies = [
"serde_derive",
]
-[[package]]
-name = "serde_cbor"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45cd6d95391b16cd57e88b68be41d504183b7faae22030c0cc3b3f73dd57b2fd"
-dependencies = [
- "byteorder",
- "half",
- "serde",
-]
-
[[package]]
name = "serde_derive"
version = "1.0.210"
### fuzz/Cargo.toml
@@ -25,7 +25,6 @@ arbitrary = { version = "1.4.1" }
libfuzzer-sys = { version = "0.4.13" }
serde = { version = "1.0.195", features = [ "derive" ] }
serde_json = "1.0.68"
-serde_cbor = "0.9"
standard_test = "0.1.0"
[lints.rust]
@@ -788,13 +787,6 @@ test = false
doc = false
bench = false
-[[bin]]
-name = "hashes_0_32_cbor"
-path = "fuzz_targets/hashes_0_32/cbor.rs"
-test = false
-doc = false
-bench = false
-
[[bin]]
name = "p2p_arbitrary_addrv2"
path = "fuzz_targets/p2p/arbitrary_addrv2.rs"
### fuzz/fuzz_targets/hashes_0_32/cbor.rs
@@ -1,32 +0,0 @@
-#![cfg_attr(fuzzing, no_main)]
-#![cfg_attr(not(fuzzing), allow(unused))]
-
-use libfuzzer_sys::fuzz_target;
-use serde::{Deserialize, Serialize};
-
-#[derive(Deserialize, Serialize)]
-struct Hmacs {
- sha1: bitcoin_0_32::hashes::hmac::Hmac<bitcoin_0_32::hashes::sha1::Hash>,
- sha512: bitcoin_0_32::hashes::hmac::Hmac<bitcoin_0_32::hashes::sha512::Hash>,
-}
-
-#[derive(Deserialize, Serialize)]
-struct Main {
- hmacs: Hmacs,
- ripemd: bitcoin_0_32::hashes::ripemd160::Hash,
- sha2d: bitcoin_0_32::hashes::sha256d::Hash,
-}
-
-#[cfg(not(fuzzing))]
-fn main() {}
-
-fn do_test(data: &[u8]) {
- if let Ok(m) = serde_cbor::from_slice::<Main>(data) {
- let vec = serde_cbor::to_vec(&m).unwrap();
- assert_eq!(data, &vec[..]);
- }
-}
-
-fuzz_target!(|data: &[u8]| {
- do_test(data);
-});Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.