Differential D8710

fuzz: Stop nodes in process_message* fuzzers
ClosedPublic
Actions

Authored by Fabien on Dec 21 2020, 10:48.

Details

Reviewers

majcosta

Group Reviewers

Restricted Project

Commits

rABC306b94dd6d36: fuzz: Stop nodes in process_message* fuzzers

Summary

Background is that I saw an integer overflow in net_processing

#30629113	REDUCE cov: 25793 ft: 142917 corp: 3421/2417Kb
lim: 4096exec/s: 89 rss: 614Mb L: 1719/4096 MS: 1 EraseBytes...
net_processing.cpp:977:25: runtime error: signed integer overflow:
2147483624 + 100 cannot be represented in type 'int'

UndefinedBehaviorSanitizer: undefined-behavior
net_processing.cpp:977:25 in
net_processing.cpp:985:9: runtime error: signed integer overflow:
-2147483572 - 100 cannot be represented in type 'int'
SUMMMARY: UndefinedBehaviorSanitizer: undefined-behavior
net_processing.cpp:985:9 in

Telling from the line numbers, it looks like nMisbehavior wrapped
around.

Fix that by calling StopNodes after each exec, which should clear the
node state and thus nMisbehavior.

Backport of core PR18875

Test Plan

ninja bitcoin-fuzzers
./test/fuzz/test_runner.py <path_to_corpus>

Diff Detail

Repository

rABC Bitcoin ABC

Branch

PR18875

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 14461
Build 28886: Build Diff	build-without-wallet · lint-circular-dependencies · build-clang-tidy · build-clang · build-diff · build-debug
Build 28885: arc lint + arc unit

Event Timeline

Fabien created this revision.Dec 21 2020, 10:48

Herald added a reviewer: Restricted Project. · View Herald TranscriptDec 21 2020, 10:48

Fabien requested review of this revision.Dec 21 2020, 10:48

Harbormaster completed remote builds in B14461: Diff 26456.Dec 21 2020, 11:07

majcosta retitled this revision from fuzz: Stop nodes in process_message* fuzzers ``` Background is that I saw an integer overflow in net_processing #30629113 REDUCE cov: 25793 ft: 142917 corp: 3421/2417Kb lim: 4096 exec/s: 89 rss: 614Mb L: 1719/4096 MS: 1 EraseBytes... to fuzz: Stop nodes in process_message* fuzzers```Background is that I saw an integer overflow in net_processing#30629113 REDUCE cov: 25793 ft: 142917 corp: 3421/2417Kb lim: 4096exec/s: 89 rss: 614Mb L: 1719/4096 MS: 1 EraseBytes....Dec 21 2020, 11:59

majcosta edited the summary of this revision. (Show Details)

Fabien retitled this revision from fuzz: Stop nodes in process_message* fuzzers```Background is that I saw an integer overflow in net_processing#30629113 REDUCE cov: 25793 ft: 142917 corp: 3421/2417Kb lim: 4096exec/s: 89 rss: 614Mb L: 1719/4096 MS: 1 EraseBytes... to fuzz: Stop nodes in process_message* fuzzers.Dec 21 2020, 12:02

Fabien edited the summary of this revision. (Show Details)

majcosta accepted this revision.Dec 21 2020, 12:02

This revision is now accepted and ready to land.Dec 21 2020, 12:02

Fabien added a child revision: D8712: [net/refactor] Introduce an enum to distinguish type of connection.Dec 21 2020, 12:49

Fabien mentioned this in D8712: [net/refactor] Introduce an enum to distinguish type of connection.Dec 21 2020, 12:49

Closed by commit rABC306b94dd6d36: fuzz: Stop nodes in process_message* fuzzers (authored by MarcoFalke <falke.marco@gmail.com>, committed by Fabien). · Explain WhyDec 21 2020, 15:32

This revision was automatically updated to reflect the committed changes.

Fabien added a commit: rABC306b94dd6d36: fuzz: Stop nodes in process_message* fuzzers.