What changed, and why it matters
This commit adds a new automated fuzz test for the Weight type in the rust-bitcoin library. Fuzz tests feed random or semi-random inputs to code to find crashes or unexpected behavior. There is no change to production code, no bug fix, and no security patch in this commit.
No security action required. This is a testing/infrastructure addition. Reviewers may optionally verify the fuzz target compiles and runs correctly.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit introduces a new honggfuzz-based fuzz target at fuzz/fuzz_targets/units/arbitrary_weight.rs that exercises Weight::arbitrary, conversion methods (to_wu, to_kwu_ceil/floor, to_vbytes_ceil/floor), checked arithmetic operations (checked_add, checked_sub, checked_mul, checked_div), and constructors (from_wu, from_witness_data_size, from_non_witness_data_size, from_vb, from_kwu). It also registers the target in fuzz/Cargo.toml and in the cron-daily-fuzz GitHub Actions workflow. No library source code is modified.
Changed components
fuzz/fuzz_targets/units/arbitrary_weight.rsfuzz/Cargo.toml.github/workflows/cron-daily-fuzz.ymlInspect captured patch +92 / −0
diff --git a/.github/workflows/cron-daily-fuzz.yml b/.github/workflows/cron-daily-fuzz.yml
index a6bc7252..1b65ff00 100644
--- a/.github/workflows/cron-daily-fuzz.yml
+++ b/.github/workflows/cron-daily-fuzz.yml
@@ -35,6 +35,7 @@ jobs:
hashes_sha256,
hashes_sha512,
hashes_sha512_256,
+ units_arbitrary_weight,
units_parse_amount,
]
steps:
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index e2e955e6..27d23705 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -89,6 +89,10 @@ path = "fuzz_targets/hashes/sha512.rs"
name = "hashes_sha512_256"
path = "fuzz_targets/hashes/sha512_256.rs"
+[[bin]]
+name = "units_arbitrary_weight"
+path = "fuzz_targets/units/arbitrary_weight.rs"
+
[[bin]]
name = "units_parse_amount"
path = "fuzz_targets/units/parse_amount.rs"
diff --git a/fuzz/fuzz_targets/units/arbitrary_weight.rs b/fuzz/fuzz_targets/units/arbitrary_weight.rs
new file mode 100644
index 00000000..4fe66fed
--- /dev/null
+++ b/fuzz/fuzz_targets/units/arbitrary_weight.rs
@@ -0,0 +1,87 @@
+use arbitrary::{Arbitrary, Unstructured};
+use honggfuzz::fuzz;
+use bitcoin::Weight;
+
+fn do_test(data: &[u8]) {
+ let mut u = Unstructured::new(data);
+ let w = Weight::arbitrary(&mut u);
+
+ if let Ok(weight) = w {
+ weight.to_wu();
+ weight.to_kwu_ceil();
+ weight.to_kwu_floor();
+ weight.to_vbytes_ceil();
+ weight.to_vbytes_floor();
+
+ // Operations that take u64 as the rhs
+ for operation in [Weight::checked_mul, Weight::checked_div] {
+ if let Ok(val) = u.arbitrary() {
+ let _ = operation(weight, val);
+ } else {
+ return;
+ }
+ }
+
+ // Operations that take Weight as the rhs
+ for operation in [Weight::checked_add, Weight::checked_sub] {
+ if let Ok(val) = u.arbitrary() {
+ let _ = operation(weight, val);
+ } else {
+ return;
+ }
+ }
+ }
+
+ // Constructors that return a Weight
+ for constructor in [Weight::from_wu, Weight::from_witness_data_size, Weight::from_non_witness_data_size] {
+ if let Ok(val) = u.arbitrary() {
+ constructor(val);
+ } else {
+ return;
+ }
+ }
+
+ // Constructors that return an Option<Weight>
+ for constructor in [Weight::from_vb, Weight::from_kwu] {
+ if let Ok(val) = u.arbitrary() {
+ constructor(val);
+ } else {
+ return;
+ }
+ }
+}
+
+fn main() {
+ loop {
+ fuzz!(|data| {
+ do_test(data);
+ });
+ }
+}
+
+#[cfg(all(test, fuzzing))]
+mod tests {
+ fn extend_vec_from_hex(hex: &str, out: &mut Vec<u8>) {
+ let mut b = 0;
+ for (idx, c) in hex.as_bytes().iter().enumerate() {
+ b <<= 4;
+ match *c {
+ b'A'..=b'F' => b |= c - b'A' + 10,
+ b'a'..=b'f' => b |= c - b'a' + 10,
+ b'0'..=b'9' => b |= c - b'0',
+ _ => panic!("Bad hex"),
+ }
+ if (idx & 1) == 1 {
+ out.push(b);
+ b = 0;
+ }
+ }
+ }
+
+ #[test]
+ fn duplicate_crash() {
+ let mut a = Vec::new();
+ extend_vec_from_hex("00", &mut a);
+ super::do_test(&a);
+ }
+}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.