Skip to content

Commit 1fcf66a

Browse files
author
MarcoFalke
committed
Merge bitcoin#21798: fuzz: Create a block template in tx_pool targets
fa03d0a fuzz: Create a block template in tx_pool targets (MarcoFalke) fa61ce5 fuzz: Limit mocktime to MTP in tx_pool targets (MarcoFalke) fab646b fuzz: Use correct variant of ConsumeRandomLengthString instead of hardcoding a maximum size (MarcoFalke) fae2c8b fuzz: Allow to pass min/max to ConsumeTime (MarcoFalke) Pull request description: Relatively simple check to ensure a block can always be created from the mempool ACKs for top commit: practicalswift: Tested ACK fa03d0a Tree-SHA512: e613376ccc88591cbe594db14ea21ebc9b2b191f6325b3aa4ee0cd379695352ad3b480e286134ef6ee30f043d486cf9792a1bc7e44445c41045ac8c3b931c7ff
2 parents 9c05da4 + fa03d0a commit 1fcf66a

File tree

4 files changed

+80
-31
lines changed

4 files changed

+80
-31
lines changed

‎src/test/fuzz/tx_pool.cpp‎

Lines changed: 59 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
44

55
#include <consensus/validation.h>
6+
#include <miner.h>
67
#include <test/fuzz/FuzzedDataProvider.h>
78
#include <test/fuzz/fuzz.h>
89
#include <test/fuzz/util.h>
@@ -77,13 +78,44 @@ void SetMempoolConstraints(ArgsManager& args, FuzzedDataProvider& fuzzed_data_pr
7778
ToString(fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 999)));
7879
}
7980

81+
void Finish(FuzzedDataProvider& fuzzed_data_provider, MockedTxPool& tx_pool, CChainState& chainstate)
82+
{
83+
WITH_LOCK(::cs_main, tx_pool.check(chainstate));
84+
{
85+
BlockAssembler::Options options;
86+
options.nBlockMaxWeight = fuzzed_data_provider.ConsumeIntegralInRange(0U, MAX_BLOCK_WEIGHT);
87+
options.blockMinFeeRate = CFeeRate{ConsumeMoney(fuzzed_data_provider)};
88+
auto assembler = BlockAssembler{chainstate, *static_cast<CTxMemPool*>(&tx_pool), ::Params(), options};
89+
auto block_template = assembler.CreateNewBlock(CScript{} << OP_TRUE);
90+
Assert(block_template->block.vtx.size() >= 1);
91+
}
92+
const auto info_all = tx_pool.infoAll();
93+
if (!info_all.empty()) {
94+
const auto& tx_to_remove = *PickValue(fuzzed_data_provider, info_all).tx;
95+
WITH_LOCK(tx_pool.cs, tx_pool.removeRecursive(tx_to_remove, /* dummy */ MemPoolRemovalReason::BLOCK));
96+
std::vector<uint256> all_txids;
97+
tx_pool.queryHashes(all_txids);
98+
assert(all_txids.size() < info_all.size());
99+
WITH_LOCK(::cs_main, tx_pool.check(chainstate));
100+
}
101+
SyncWithValidationInterfaceQueue();
102+
}
103+
104+
void MockTime(FuzzedDataProvider& fuzzed_data_provider, const CChainState& chainstate)
105+
{
106+
const auto time = ConsumeTime(fuzzed_data_provider,
107+
chainstate.m_chain.Tip()->GetMedianTimePast() + 1,
108+
std::numeric_limits<decltype(chainstate.m_chain.Tip()->nTime)>::max());
109+
SetMockTime(time);
110+
}
111+
80112
FUZZ_TARGET_INIT(tx_pool_standard, initialize_tx_pool)
81113
{
82114
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
83115
const auto& node = g_setup->m_node;
84116
auto& chainstate = node.chainman->ActiveChainstate();
85117

86-
SetMockTime(ConsumeTime(fuzzed_data_provider));
118+
MockTime(fuzzed_data_provider, chainstate);
87119
SetMempoolConstraints(*node.args, fuzzed_data_provider);
88120

89121
// All RBF-spendable outpoints
@@ -163,7 +195,7 @@ FUZZ_TARGET_INIT(tx_pool_standard, initialize_tx_pool)
163195
}();
164196

165197
if (fuzzed_data_provider.ConsumeBool()) {
166-
SetMockTime(ConsumeTime(fuzzed_data_provider));
198+
MockTime(fuzzed_data_provider, chainstate);
167199
}
168200
if (fuzzed_data_provider.ConsumeBool()) {
169201
SetMempoolConstraints(*node.args, fuzzed_data_provider);
@@ -237,23 +269,17 @@ FUZZ_TARGET_INIT(tx_pool_standard, initialize_tx_pool)
237269
}
238270
}
239271
}
240-
WITH_LOCK(::cs_main, tx_pool.check(chainstate));
241-
const auto info_all = tx_pool.infoAll();
242-
if (!info_all.empty()) {
243-
const auto& tx_to_remove = *PickValue(fuzzed_data_provider, info_all).tx;
244-
WITH_LOCK(tx_pool.cs, tx_pool.removeRecursive(tx_to_remove, /* dummy */ MemPoolRemovalReason::BLOCK));
245-
std::vector<uint256> all_txids;
246-
tx_pool.queryHashes(all_txids);
247-
assert(all_txids.size() < info_all.size());
248-
WITH_LOCK(::cs_main, tx_pool.check(chainstate));
249-
}
250-
SyncWithValidationInterfaceQueue();
272+
Finish(fuzzed_data_provider, tx_pool, chainstate);
251273
}
252274

253275
FUZZ_TARGET_INIT(tx_pool, initialize_tx_pool)
254276
{
255277
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
256278
const auto& node = g_setup->m_node;
279+
auto& chainstate = node.chainman->ActiveChainstate();
280+
281+
MockTime(fuzzed_data_provider, chainstate);
282+
SetMempoolConstraints(*node.args, fuzzed_data_provider);
257283

258284
std::vector<uint256> txids;
259285
for (const auto& outpoint : g_outpoints_coinbase_init_mature) {
@@ -265,11 +291,29 @@ FUZZ_TARGET_INIT(tx_pool, initialize_tx_pool)
265291
txids.push_back(ConsumeUInt256(fuzzed_data_provider));
266292
}
267293

268-
CTxMemPool tx_pool{/* estimator */ nullptr, /* check_ratio */ 1};
294+
CTxMemPool tx_pool_{/* estimator */ nullptr, /* check_ratio */ 1};
295+
MockedTxPool& tx_pool = *static_cast<MockedTxPool*>(&tx_pool_);
269296

270297
while (fuzzed_data_provider.ConsumeBool()) {
271298
const auto mut_tx = ConsumeTransaction(fuzzed_data_provider, txids);
272299

300+
if (fuzzed_data_provider.ConsumeBool()) {
301+
MockTime(fuzzed_data_provider, chainstate);
302+
}
303+
if (fuzzed_data_provider.ConsumeBool()) {
304+
SetMempoolConstraints(*node.args, fuzzed_data_provider);
305+
}
306+
if (fuzzed_data_provider.ConsumeBool()) {
307+
tx_pool.RollingFeeUpdate();
308+
}
309+
if (fuzzed_data_provider.ConsumeBool()) {
310+
const auto& txid = fuzzed_data_provider.ConsumeBool() ?
311+
mut_tx.GetHash() :
312+
PickValue(fuzzed_data_provider, txids);
313+
const auto delta = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-50 * COIN, +50 * COIN);
314+
tx_pool.PrioritiseTransaction(txid, delta);
315+
}
316+
273317
const auto tx = MakeTransactionRef(mut_tx);
274318
const bool bypass_limits = fuzzed_data_provider.ConsumeBool();
275319
::fRequireStandard = fuzzed_data_provider.ConsumeBool();
@@ -278,8 +322,7 @@ FUZZ_TARGET_INIT(tx_pool, initialize_tx_pool)
278322
if (accepted) {
279323
txids.push_back(tx->GetHash());
280324
}
281-
282-
SyncWithValidationInterfaceQueue();
283325
}
326+
Finish(fuzzed_data_provider, tx_pool, chainstate);
284327
}
285328
} // namespace

‎src/test/fuzz/util.cpp‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
#include <test/fuzz/util.h>
66
#include <test/util/script.h>
77
#include <util/rbf.h>
8+
#include <util/time.h>
89
#include <version.h>
910

1011
FuzzedSock::FuzzedSock(FuzzedDataProvider& fuzzed_data_provider)
@@ -216,6 +217,14 @@ void FillNode(FuzzedDataProvider& fuzzed_data_provider, CNode& node, bool init_v
216217
}
217218
}
218219

220+
int64_t ConsumeTime(FuzzedDataProvider& fuzzed_data_provider, const std::optional<int64_t>& min, const std::optional<int64_t>& max) noexcept
221+
{
222+
// Avoid t=0 (1970-01-01T00:00:00Z) since SetMockTime(0) disables mocktime.
223+
static const int64_t time_min = ParseISO8601DateTime("1970-01-01T00:00:01Z");
224+
static const int64_t time_max = ParseISO8601DateTime("9999-12-31T23:59:59Z");
225+
return fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(min.value_or(time_min), max.value_or(time_max));
226+
}
227+
219228
CMutableTransaction ConsumeTransaction(FuzzedDataProvider& fuzzed_data_provider, const std::optional<std::vector<uint256>>& prevout_txids, const int max_num_in, const int max_num_out) noexcept
220229
{
221230
CMutableTransaction tx_mut;
@@ -267,7 +276,7 @@ CScriptWitness ConsumeScriptWitness(FuzzedDataProvider& fuzzed_data_provider, co
267276
return ret;
268277
}
269278

270-
CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length, const bool maybe_p2wsh) noexcept
279+
CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length, const bool maybe_p2wsh) noexcept
271280
{
272281
const std::vector<uint8_t> b = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
273282
CScript r_script{b.begin(), b.end()};

‎src/test/fuzz/util.h‎

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@
2626
#include <test/util/net.h>
2727
#include <txmempool.h>
2828
#include <uint256.h>
29-
#include <util/time.h>
3029
#include <version.h>
3130

3231
#include <algorithm>
@@ -58,18 +57,20 @@ auto& PickValue(FuzzedDataProvider& fuzzed_data_provider, Collection& col)
5857
return *it;
5958
}
6059

61-
[[nodiscard]] inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
60+
[[nodiscard]] inline std::vector<uint8_t> ConsumeRandomLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt) noexcept
6261
{
63-
const std::string s = fuzzed_data_provider.ConsumeRandomLengthString(max_length);
62+
const std::string s = max_length ?
63+
fuzzed_data_provider.ConsumeRandomLengthString(*max_length) :
64+
fuzzed_data_provider.ConsumeRandomLengthString();
6465
return {s.begin(), s.end()};
6566
}
6667

67-
[[nodiscard]] inline std::vector<bool> ConsumeRandomLengthBitVector(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
68+
[[nodiscard]] inline std::vector<bool> ConsumeRandomLengthBitVector(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt) noexcept
6869
{
6970
return BytesToBits(ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length));
7071
}
7172

72-
[[nodiscard]] inline CDataStream ConsumeDataStream(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
73+
[[nodiscard]] inline CDataStream ConsumeDataStream(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt) noexcept
7374
{
7475
return CDataStream{ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length), SER_NETWORK, INIT_PROTO_VERSION};
7576
}
@@ -96,7 +97,7 @@ template <typename T>
9697
}
9798

9899
template <typename T>
99-
[[nodiscard]] inline std::optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096) noexcept
100+
[[nodiscard]] inline std::optional<T> ConsumeDeserializable(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt) noexcept
100101
{
101102
const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
102103
CDataStream ds{buffer, SER_NETWORK, INIT_PROTO_VERSION};
@@ -127,19 +128,13 @@ template <typename WeakEnumType, size_t size>
127128
return fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, MAX_MONEY);
128129
}
129130

130-
[[nodiscard]] inline int64_t ConsumeTime(FuzzedDataProvider& fuzzed_data_provider) noexcept
131-
{
132-
// Avoid t=0 (1970-01-01T00:00:00Z) since SetMockTime(0) is a no-op.
133-
static const int64_t time_min = ParseISO8601DateTime("1970-01-01T00:00:01Z");
134-
static const int64_t time_max = ParseISO8601DateTime("9999-12-31T23:59:59Z");
135-
return fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(time_min, time_max);
136-
}
131+
[[nodiscard]] int64_t ConsumeTime(FuzzedDataProvider& fuzzed_data_provider, const std::optional<int64_t>& min = std::nullopt, const std::optional<int64_t>& max = std::nullopt) noexcept;
137132

138133
[[nodiscard]] CMutableTransaction ConsumeTransaction(FuzzedDataProvider& fuzzed_data_provider, const std::optional<std::vector<uint256>>& prevout_txids, const int max_num_in = 10, const int max_num_out = 10) noexcept;
139134

140135
[[nodiscard]] CScriptWitness ConsumeScriptWitness(FuzzedDataProvider& fuzzed_data_provider, const size_t max_stack_elem_size = 32) noexcept;
141136

142-
[[nodiscard]] CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length = 4096, const bool maybe_p2wsh = false) noexcept;
137+
[[nodiscard]] CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, const std::optional<size_t>& max_length = std::nullopt, const bool maybe_p2wsh = false) noexcept;
143138

144139
[[nodiscard]] uint32_t ConsumeSequence(FuzzedDataProvider& fuzzed_data_provider) noexcept;
145140

‎test/sanitizer_suppressions/ubsan‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
# names can be used.
66
# See https://github.com/google/sanitizers/issues/1364
77
signed-integer-overflow:txmempool.cpp
8+
# https://github.com/bitcoin/bitcoin/pull/21798#issuecomment-829180719
9+
signed-integer-overflow:policy/feerate.cpp
810

911
# -fsanitize=integer suppressions
1012
# ===============================

0 commit comments

Comments
 (0)