diff --git a/tests/fuzz/fuzz-bigsize.c b/tests/fuzz/fuzz-bigsize.c new file mode 100644 index 000000000..3b32678c8 --- /dev/null +++ b/tests/fuzz/fuzz-bigsize.c @@ -0,0 +1,36 @@ +#include +#include +#include +#include + +#include +#include + +void init(int *argc, char ***argv) +{ +} + +void run(const uint8_t *data, size_t size) +{ + uint8_t *wire_buff, buff[BIGSIZE_MAX_LEN]; + const uint8_t **wire_chunks, *wire_ptr; + size_t wire_max; + + wire_chunks = get_chunks(NULL, data, size, 8); + for (size_t i = 0; i < tal_count(wire_chunks); i++) { + wire_max = tal_count(wire_chunks[i]); + wire_ptr = wire_chunks[i]; + + bigsize_t bs = fromwire_bigsize(&wire_ptr, &wire_max); + if (bs != 0) { + /* We have a valid bigsize type, now we should not error. */ + assert(bigsize_put(buff, bs) > 0); + assert(bigsize_len(bs)); + + wire_buff = tal_arr(NULL, uint8_t, 8); + towire_bigsize(&wire_buff, bs); + tal_free(wire_buff); + } + } + tal_free(wire_chunks); +} diff --git a/tests/fuzz/libfuzz.c b/tests/fuzz/libfuzz.c index 81c6f22e7..273de5523 100644 --- a/tests/fuzz/libfuzz.c +++ b/tests/fuzz/libfuzz.c @@ -1,5 +1,9 @@ #include +#include +#include +#include + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size); int LLVMFuzzerInitialize(int *argc, char ***argv); @@ -14,3 +18,16 @@ int LLVMFuzzerInitialize(int *argc, char ***argv) { return 0; } + +const uint8_t **get_chunks(const void *ctx, const uint8_t *data, + size_t data_size, size_t chunk_size) +{ + size_t n_chunks = data_size / chunk_size; + const uint8_t **chunks = tal_arr(ctx, const uint8_t *, n_chunks); + + for (size_t i = 0; i < n_chunks; i++) + chunks[i] = tal_dup_arr(chunks, const uint8_t, + data + i * chunk_size, chunk_size, 0); + + return chunks; +}