diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml index 95460ba5..4322c0e2 100644 --- a/fuzz/Cargo.toml +++ b/fuzz/Cargo.toml @@ -47,3 +47,7 @@ path = "fuzz_targets/deserialize_udecimal.rs" [[bin]] name = "outpoint_string" path = "fuzz_targets/outpoint_string.rs" + +[[bin]] +name = "deserialize_psbt" +path = "fuzz_targets/deserialize_psbt.rs" diff --git a/fuzz/fuzz_targets/deserialize_psbt.rs b/fuzz/fuzz_targets/deserialize_psbt.rs new file mode 100644 index 00000000..9021fc3b --- /dev/null +++ b/fuzz/fuzz_targets/deserialize_psbt.rs @@ -0,0 +1,52 @@ +extern crate bitcoin; + +fn do_test(data: &[u8]) { + let _: Result = bitcoin::consensus::encode::deserialize(data); +} + +#[cfg(feature = "afl")] +#[macro_use] extern crate afl; +#[cfg(feature = "afl")] +fn main() { + fuzz!(|data| { + do_test(&data); + }); +} + +#[cfg(feature = "honggfuzz")] +#[macro_use] extern crate honggfuzz; +#[cfg(feature = "honggfuzz")] +fn main() { + loop { + fuzz!(|data| { + do_test(data); + }); + } +} + +#[cfg(test)] +mod tests { + fn extend_vec_from_hex(hex: &str, out: &mut Vec) { + let mut b = 0; + for (idx, c) in hex.as_bytes().iter().enumerate() { + b <<= 4; + match *c { + b'A'...b'F' => b |= c - b'A' + 10, + b'a'...b'f' => b |= c - b'a' + 10, + b'0'...b'9' => b |= c - b'0', + _ => panic!("Bad hex"), + } + if (idx & 1) == 1 { + out.push(b); + b = 0; + } + } + } + + #[test] + fn duplicate_crash() { + let mut a = Vec::new(); + extend_vec_from_hex("00", &mut a); + super::do_test(&a); + } +}