diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml index 4322c0e..a6e6038 100644 --- a/fuzz/Cargo.toml +++ b/fuzz/Cargo.toml @@ -51,3 +51,7 @@ path = "fuzz_targets/outpoint_string.rs" [[bin]] name = "deserialize_psbt" path = "fuzz_targets/deserialize_psbt.rs" + +[[bin]] +name = "deserialize_raw_network_message" +path = "fuzz_targets/deserialize_raw_network_message.rs" \ No newline at end of file diff --git a/fuzz/fuzz_targets/deserialize_raw_network_message.rs b/fuzz/fuzz_targets/deserialize_raw_network_message.rs new file mode 100644 index 0000000..e2c1a0a --- /dev/null +++ b/fuzz/fuzz_targets/deserialize_raw_network_message.rs @@ -0,0 +1,52 @@ +extern crate bitcoin; + +fn do_test(data: &[u8]) { + let _: Result = bitcoin::consensus::encode::deserialize(data); +} + +#[cfg(feature = "afl")] +#[macro_use] extern crate afl; +#[cfg(feature = "afl")] +fn main() { + fuzz!(|data| { + do_test(&data); + }); +} + +#[cfg(feature = "honggfuzz")] +#[macro_use] extern crate honggfuzz; +#[cfg(feature = "honggfuzz")] +fn main() { + loop { + fuzz!(|data| { + do_test(data); + }); + } +} + +#[cfg(test)] +mod tests { + fn extend_vec_from_hex(hex: &str, out: &mut Vec) { + let mut b = 0; + for (idx, c) in hex.as_bytes().iter().enumerate() { + b <<= 4; + match *c { + b'A'...b'F' => b |= c - b'A' + 10, + b'a'...b'f' => b |= c - b'a' + 10, + b'0'...b'9' => b |= c - b'0', + _ => panic!("Bad hex"), + } + if (idx & 1) == 1 { + out.push(b); + b = 0; + } + } + } + + #[test] + fn duplicate_crash() { + let mut a = Vec::new(); + extend_vec_from_hex("00", &mut a); + super::do_test(&a); + } +}