|
1 | 1 | #include "config.h" |
2 | 2 |
|
3 | 3 | #include <bitcoin/chainparams.h> |
| 4 | +#include <bitcoin/privkey.h> |
4 | 5 | #include <common/bech32.h> |
5 | 6 | #include <common/bolt11.h> |
6 | 7 | #include <common/features.h> |
@@ -42,6 +43,35 @@ static size_t initial_input(uint8_t *fuzz_data, size_t size, size_t max_size) |
42 | 43 | return size; |
43 | 44 | } |
44 | 45 |
|
| 46 | +static bool test_sign(const u5 *u5bytes, |
| 47 | + const u8 *hrpu8, |
| 48 | + secp256k1_ecdsa_recoverable_signature *rsig, |
| 49 | + void *unused UNUSED) |
| 50 | +{ |
| 51 | + struct hash_u5 hu5; |
| 52 | + char *hrp; |
| 53 | + struct sha256 sha; |
| 54 | + struct privkey privkey; |
| 55 | + |
| 56 | + memset(&privkey, 'a', sizeof(privkey)); |
| 57 | + |
| 58 | + hrp = tal_dup_arr(NULL, char, (char *)hrpu8, tal_count(hrpu8), 1); |
| 59 | + hrp[tal_count(hrpu8)] = '\0'; |
| 60 | + |
| 61 | + hash_u5_init(&hu5, hrp); |
| 62 | + hash_u5(&hu5, u5bytes, tal_count(u5bytes)); |
| 63 | + hash_u5_done(&hu5, &sha); |
| 64 | + tal_free(hrp); |
| 65 | + |
| 66 | + if (!secp256k1_ecdsa_sign_recoverable(secp256k1_ctx, rsig, |
| 67 | + (const u8 *)&sha, |
| 68 | + privkey.secret.data, |
| 69 | + NULL, NULL)) |
| 70 | + abort(); |
| 71 | + |
| 72 | + return true; |
| 73 | +} |
| 74 | + |
45 | 75 | // We use a custom mutator to produce an input corpus that consists entirely of |
46 | 76 | // correctly encoded bech32 strings. This enables us to efficiently fuzz the |
47 | 77 | // bolt11 decoding logic without the fuzzer getting stuck on fuzzing the bech32 |
@@ -187,9 +217,13 @@ size_t LLVMFuzzerCustomCrossOver(const u8 *in1, size_t in1_size, const u8 *in2, |
187 | 217 | void run(const uint8_t *data, size_t size) |
188 | 218 | { |
189 | 219 | char *invoice_str = to_string(tmpctx, data, size); |
190 | | - char *fail; |
| 220 | + char *fail = NULL; |
191 | 221 |
|
192 | | - bolt11_decode(tmpctx, invoice_str, NULL, NULL, NULL, &fail); |
| 222 | + struct bolt11 *b11 = bolt11_decode(tmpctx, invoice_str, NULL, NULL, NULL, &fail); |
| 223 | + if (b11) |
| 224 | + bolt11_encode(tmpctx, b11, false, test_sign, NULL); |
| 225 | + else |
| 226 | + assert(fail); |
193 | 227 |
|
194 | 228 | clean_tmpctx(); |
195 | 229 | } |
0 commit comments