/root/bitcoin/src/test/fuzz/cmpctblock.cpp

Source
// Copyright (c) 2026 The Bitcoin Core developers
// Distributed under the MIT software license, see the accompanying
// file COPYING or http://www.opensource.org/licenses/mit-license.php.

#include <addrman.h>
#include <blockencodings.h>
#include <chain.h>
#include <chainparams.h>
#include <coins.h>
#include <consensus/amount.h>
#include <consensus/consensus.h>
#include <consensus/merkle.h>
#include <net.h>
#include <net_processing.h>
#include <netmessagemaker.h>
#include <node/blockstorage.h>
#include <node/mining_types.h>
#include <policy/truc_policy.h>
#include <primitives/block.h>
#include <primitives/transaction.h>
#include <protocol.h>
#include <script/script.h>
#include <serialize.h>
#include <sync.h>
#include <test/fuzz/FuzzedDataProvider.h>
#include <test/fuzz/fuzz.h>
#include <test/fuzz/util.h>
#include <test/fuzz/util/net.h>
#include <test/util/mining.h>
#include <test/util/net.h>
#include <test/util/random.h>
#include <test/util/script.h>
#include <test/util/setup_common.h>
#include <test/util/time.h>
#include <test/util/txmempool.h>
#include <test/util/validation.h>
#include <txmempool.h>
#include <uint256.h>
#include <util/check.h>
#include <util/task_runner.h>
#include <util/time.h>
#include <util/translation.h>
#include <validation.h>
#include <validationinterface.h>

#include <boost/multi_index/detail/hash_index_iterator.hpp>

#include <cstddef>
#include <cstdint>
#include <functional>
#include <iterator>
#include <memory>
#include <optional>
#include <string>
#include <thread>
#include <utility>
#include <vector>

namespace {

TestingSetup* g_setup;

//! Fee each created tx will pay.
const CAmount AMOUNT_FEE{1000};
//! Cached coinbases that each iteration can copy and use.
std::vector<std::pair<COutPoint, CAmount>> g_mature_coinbase;
//! Constant value used to create valid headers.
uint32_t g_nBits;
//! One for each block the fuzzer generates.
struct BlockInfo {
    std::shared_ptr<CBlock> block;
    uint256 hash;
    uint32_t height;
};
//! Used to access prefilledtxn and shorttxids.
class FuzzedCBlockHeaderAndShortTxIDs : public CBlockHeaderAndShortTxIDs
{
    using CBlockHeaderAndShortTxIDs::CBlockHeaderAndShortTxIDs;

public:
    void AddPrefilledTx(PrefilledTransaction&& prefilledtx)
    {
        prefilledtxn.push_back(std::move(prefilledtx));
    }

    void RemoveCoinbasePrefill()
    {
        prefilledtxn.erase(prefilledtxn.begin());
    }

    void InsertCoinbaseShortTxID(uint64_t shorttxid)
    {
        shorttxids.insert(shorttxids.begin(), shorttxid);
    }

    void EraseShortTxIDs(size_t index)
    {
        shorttxids.erase(shorttxids.begin() + index);
    }

    size_t PrefilledTxCount() {
        return prefilledtxn.size();
    }

    size_t ShortTxIDCount() {
        return shorttxids.size();
    }
};

void ResetChainmanAndMempool(TestingSetup& setup)
{
    SetMockTime(Params().GenesisBlock().Time());

    bilingual_str error{};
    setup.m_node.mempool.reset();
    setup.m_node.mempool = std::make_unique<CTxMemPool>(MemPoolOptionsForTest(setup.m_node), error);
    Assert(error.empty());

    setup.m_node.chainman.reset();
    setup.m_make_chainman();
    setup.LoadVerifyActivateChainstate();

    node::BlockCreateOptions options;
    options.coinbase_output_script = P2WSH_OP_TRUE;

    g_mature_coinbase.clear();

    for (int i = 0; i < 2 * COINBASE_MATURITY; ++i) {
        COutPoint prevout{MineBlock(setup.m_node, options)};
        if (i < COINBASE_MATURITY) {
            LOCK(cs_main);
            CAmount subsidy{setup.m_node.chainman->ActiveChainstate().CoinsTip().GetCoin(prevout)->out.nValue};
            g_mature_coinbase.emplace_back(prevout, subsidy);
        }
    }
}

//! Used to run tasks in a std::thread to avoid DEBUG_LOCKORDER false positives.
class ImmediateBackgroundTaskRunner : public util::TaskRunnerInterface
{
public:
    void insert(std::function<void()> func) override { std::thread(std::move(func)).join(); }
    void flush() override {}
    size_t size() override { return 0; }
};

} // namespace

extern void MakeRandDeterministicDANGEROUS(const uint256& seed) noexcept;

void initialize_cmpctblock()
{
    static const auto testing_setup = MakeNoLogFileContext<TestingSetup>();
    g_setup = testing_setup.get();
    g_nBits = Params().GenesisBlock().nBits;
    // Replace validation_signals before creating chainman and mempool so they use it.
    testing_setup->m_node.validation_signals = std::make_unique<ValidationSignals>(std::make_unique<ImmediateBackgroundTaskRunner>());
    ResetChainmanAndMempool(*g_setup);
}

FUZZ_TARGET(cmpctblock, .init = initialize_cmpctblock)
{
    SeedRandomStateForTest(SeedRand::ZEROS);
    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());

    FakeNodeClock clock{1610000000s};

    auto setup = g_setup;
    auto& mempool = *setup->m_node.mempool;
    auto& chainman = static_cast<TestChainstateManager&>(*setup->m_node.chainman);
    chainman.ResetIbd();
    chainman.DisableNextWrite();
    const size_t initial_index_size{WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())};

    AddrMan addrman{*setup->m_node.netgroupman, /*deterministic=*/true, /*consistency_check_ratio=*/0};
    auto& connman = *static_cast<ConnmanTestMsg*>(setup->m_node.connman.get());
    auto peerman = PeerManager::make(connman, addrman,
                                     /*banman=*/nullptr, chainman,
                                     mempool, *setup->m_node.warnings,
                                     PeerManager::Options{
                                         .deterministic_rng = true,
                                     });
    connman.SetMsgProc(peerman.get());

    setup->m_node.validation_signals->RegisterValidationInterface(peerman.get());
    setup->m_node.validation_signals->SyncWithValidationInterfaceQueue();

    LOCK(NetEventsInterface::g_msgproc_mutex);

    std::vector<CNode*> peers;
    for (int i = 0; i < 4; ++i) {
        peers.push_back(ConsumeNodeAsUniquePtr(fuzzed_data_provider, i).release());
        CNode& p2p_node = *peers.back();
        FillNode(fuzzed_data_provider, connman, p2p_node);
        connman.AddTestNode(p2p_node);
    }

    // Stores blocks generated this iteration.
    std::vector<BlockInfo> info;

    // Coinbase UTXOs for this iteration.
    std::vector<std::pair<COutPoint, CAmount>> mature_coinbase = g_mature_coinbase;

    const uint64_t initial_sequence{WITH_LOCK(mempool.cs, return mempool.GetSequence())};

    auto create_tx = [&]() -> CTransactionRef {
        CMutableTransaction tx_mut;
        tx_mut.version = fuzzed_data_provider.ConsumeBool() ? CTransaction::CURRENT_VERSION : TRUC_VERSION;
        tx_mut.nLockTime = fuzzed_data_provider.ConsumeBool() ? 0 : fuzzed_data_provider.ConsumeIntegral<uint32_t>();

        // Choose an outpoint from the mempool, created blocks, or coinbases.
        CAmount amount_in;
        COutPoint outpoint;
        unsigned long mempool_size = mempool.size();
        if (mempool_size != 0 && fuzzed_data_provider.ConsumeBool()) {
            size_t random_idx = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, mempool_size - 1);
            CTransactionRef tx = WITH_LOCK(mempool.cs, return mempool.txns_randomized[random_idx].second->GetSharedTx(););
            outpoint = COutPoint(tx->GetHash(), 0);
            amount_in = tx->vout[0].nValue;
        } else if (info.size() != 0 && fuzzed_data_provider.ConsumeBool()) {
            // These blocks (and txs) may be invalid, use a spent output, or not be in the main chain.
            auto info_it = info.begin();
            std::advance(info_it, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, info.size() - 1));
            auto tx_it = info_it->block->vtx.begin();
            std::advance(tx_it, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, info_it->block->vtx.size() - 1));
            outpoint = COutPoint(tx_it->get()->GetHash(), 0);
            amount_in = tx_it->get()->vout[0].nValue;
        } else {
            auto coinbase_it = mature_coinbase.begin();
            std::advance(coinbase_it, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, mature_coinbase.size() - 1));
            outpoint = coinbase_it->first;
            amount_in = coinbase_it->second;
        }

        const auto sequence = ConsumeSequence(fuzzed_data_provider);
        const auto script_sig = CScript{};
        const auto script_wit_stack = std::vector<std::vector<uint8_t>>{WITNESS_STACK_ELEM_OP_TRUE};

        CTxIn in;
        in.prevout = outpoint;
        in.nSequence = sequence;
        in.scriptSig = script_sig;
        in.scriptWitness.stack = script_wit_stack;
        tx_mut.vin.push_back(in);

        const CAmount amount_out = amount_in - AMOUNT_FEE;
        tx_mut.vout.emplace_back(amount_out, P2WSH_OP_TRUE);

        auto tx = MakeTransactionRef(tx_mut);
        return tx;
    };

    auto create_block = [&]() {
        uint256 prev;
        uint32_t height;

        if (info.size() == 0 || fuzzed_data_provider.ConsumeBool()) {
            LOCK(cs_main);
            prev = chainman.ActiveChain().Tip()->GetBlockHash();
            height = chainman.ActiveChain().Height() + 1;
        } else {
            size_t index = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, info.size() - 1);
            prev = info[index].hash;
            height = info[index].height + 1;
        }

        const auto new_time = WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()->GetMedianTimePast() + 1);

        CBlockHeader header;
        header.nNonce = 0;
        header.hashPrevBlock = prev;
        header.nBits = g_nBits;
        header.nTime = new_time;
        header.nVersion = fuzzed_data_provider.ConsumeIntegral<int32_t>();

        std::shared_ptr<CBlock> block = std::make_shared<CBlock>();
        *block = header;

        CMutableTransaction coinbase_tx;
        coinbase_tx.vin.resize(1);
        coinbase_tx.vin[0].prevout.SetNull();
        coinbase_tx.vin[0].scriptSig = CScript() << height << OP_0;
        coinbase_tx.vout.resize(1);
        coinbase_tx.vout[0].scriptPubKey = CScript() << OP_TRUE;
        coinbase_tx.vout[0].nValue = COIN;
        block->vtx.push_back(MakeTransactionRef(coinbase_tx));

        const auto mempool_size = mempool.size();
        if (fuzzed_data_provider.ConsumeBool() && mempool_size != 0) {
            // Add txns from the mempool. Since we do not include parents, it may be an invalid block.
            size_t num_txns = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, mempool_size);
            size_t random_idx = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, mempool_size - 1);

            LOCK(mempool.cs);
            for (size_t i = random_idx; i < random_idx + num_txns; ++i) {
                CTransactionRef mempool_tx = mempool.txns_randomized[i % mempool_size].second->GetSharedTx();
                block->vtx.push_back(mempool_tx);
            }
        }

        // Create and add (possibly invalid) txns that are not in the mempool.
        if (fuzzed_data_provider.ConsumeBool()) {
            size_t new_txns = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 10);
            for (size_t i = 0; i < new_txns; ++i) {
                CTransactionRef non_mempool_tx = create_tx();
                block->vtx.push_back(non_mempool_tx);
            }
        }

        CBlockIndex* pindexPrev{WITH_LOCK(::cs_main, return chainman.m_blockman.LookupBlockIndex(prev))};
        chainman.GenerateCoinbaseCommitment(*block, pindexPrev);

        bool mutated;
        block->hashMerkleRoot = BlockMerkleRoot(*block, &mutated);
        FinalizeHeader(*block, chainman);

        BlockInfo block_info;
        block_info.block = block;
        block_info.hash = block->GetHash();
        block_info.height = height;

        return block_info;
    };

    LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 1000)
    {
        CSerializedNetMsg net_msg;
        bool sent_net_msg = true;
        bool requested_hb = false;
        bool sent_sendcmpct = false;
        bool valid_sendcmpct = false;

        CallOneOf(
            fuzzed_data_provider,
            [&]() {
                // Send a compact block.
                std::shared_ptr<CBlock> cblock;

                // Pick an existing block or create a new block.
                if (fuzzed_data_provider.ConsumeBool() && info.size() != 0) {
                    size_t index = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, info.size() - 1);
                    cblock = info[index].block;
                } else {
                    BlockInfo block_info = create_block();
                    cblock = block_info.block;
                    info.push_back(block_info);
                }

                uint64_t nonce = fuzzed_data_provider.ConsumeIntegral<uint64_t>();
                FuzzedCBlockHeaderAndShortTxIDs cmpctblock(*cblock, nonce);

                if (fuzzed_data_provider.ConsumeBool()) {
                    CBlockHeaderAndShortTxIDs base_cmpctblock = cmpctblock;
                    net_msg = NetMsg::Make(NetMsgType::CMPCTBLOCK, base_cmpctblock);
                    return;
                }

                int prev_idx = 0;
                size_t num_erased = 1;
                size_t num_txs = cblock->vtx.size();

                for (size_t i = 0; i < num_txs; ++i) {
                    if (i == 0) {
                        // Handle the coinbase specially. We either keep it prefilled or remove it.
                        if (fuzzed_data_provider.ConsumeBool()) continue;

                        // Remove the prefilled coinbase.
                        num_erased = 0;
                        uint64_t coinbase_shortid = cmpctblock.GetShortID(cblock->vtx[0]->GetWitnessHash());
                        cmpctblock.RemoveCoinbasePrefill();
                        cmpctblock.InsertCoinbaseShortTxID(coinbase_shortid);
                        continue;
                    }

                    if (fuzzed_data_provider.ConsumeBool()) continue;

                    uint16_t prefill_idx = num_erased == 0 ? i : i - prev_idx - 1;
                    prev_idx = i;
                    CTransactionRef txref = cblock->vtx[i];
                    PrefilledTransaction prefilledtx = {/*index=*/prefill_idx, txref};
                    cmpctblock.AddPrefilledTx(std::move(prefilledtx));

                    // Remove from shorttxids since we've prefilled. Subtract however many txs have been prefilled.
                    cmpctblock.EraseShortTxIDs(i - num_erased);
                    ++num_erased;
                }

                assert(cmpctblock.PrefilledTxCount() + cmpctblock.ShortTxIDCount() == num_txs);

                CBlockHeaderAndShortTxIDs base_cmpctblock = cmpctblock;
                net_msg = NetMsg::Make(NetMsgType::CMPCTBLOCK, base_cmpctblock);
            },
            [&]() {
                // Send a blocktxn message for an existing block (if one exists).
                size_t num_blocks = info.size();
                if (num_blocks == 0) {
                    sent_net_msg = false;
                    return;
                }

                // Fetch an existing block and randomly choose transactions to send over.
                size_t index = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, num_blocks - 1);
                const BlockInfo& block_info = info[index];
                BlockTransactions block_txn;
                block_txn.blockhash = block_info.hash;
                std::shared_ptr<CBlock> cblock = block_info.block;

                for (size_t i = 0; i < cblock->vtx.size(); i++) {
                    if (fuzzed_data_provider.ConsumeBool()) continue;

                    block_txn.txn.push_back(cblock->vtx[i]);
                }

                net_msg = NetMsg::Make(NetMsgType::BLOCKTXN, block_txn);
            },
            [&]() {
                // Send a headers message for an existing block (if one exists).
                size_t num_blocks = info.size();
                if (num_blocks == 0) {
                    sent_net_msg = false;
                    return;
                }

                // Choose an existing block and send a HEADERS message for it.
                size_t index = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, num_blocks - 1);
                CBlock block = *info[index].block;
                block.vtx.clear(); // No tx in HEADERS.
                std::vector<CBlock> headers;
                headers.emplace_back(block);

                net_msg = NetMsg::Make(NetMsgType::HEADERS, TX_WITH_WITNESS(headers));
            },
            [&]() {
                // Send a sendcmpct message, optionally setting hb mode.
                bool hb = fuzzed_data_provider.ConsumeBool();
                uint64_t version{fuzzed_data_provider.ConsumeBool() ? CMPCTBLOCKS_VERSION : fuzzed_data_provider.ConsumeIntegral<uint64_t>()};
                net_msg = NetMsg::Make(NetMsgType::SENDCMPCT, /*high_bandwidth=*/hb, /*version=*/version);
                requested_hb = hb;
                sent_sendcmpct = true;
                valid_sendcmpct = version == CMPCTBLOCKS_VERSION;
            },
            [&]() {
                // Mine a block, but don't send it.
                BlockInfo block_info = create_block();
                info.push_back(block_info);
                sent_net_msg = false;
            },
            [&]() {
                // Send a transaction.
                CTransactionRef tx = create_tx();
                net_msg = NetMsg::Make(NetMsgType::TX, TX_WITH_WITNESS(*tx));
            },
            [&]() {
                // Set mock time randomly or to tip's time.
                if (fuzzed_data_provider.ConsumeBool()) {
                    clock.set(ConsumeTime(fuzzed_data_provider));
                } else {
                    const NodeSeconds tip_time = WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()->Time());
                    clock.set(tip_time);
                }

                sent_net_msg = false;
            });

        if (!sent_net_msg) {
            continue;
        }

        CNode& random_node = *PickValue(fuzzed_data_provider, peers);
        connman.FlushSendBuffer(random_node);
        (void)connman.ReceiveMsgFrom(random_node, std::move(net_msg));

        bool more_work{true};
        while (more_work) {
            random_node.fPauseSend = false;

            more_work = connman.ProcessMessagesOnce(random_node);
            peerman->SendMessages(random_node);
        }

        std::vector<CNodeStats> stats;
        connman.GetNodeStats(stats);

        // We should have at maximum 3 HB peers.
        int num_hb = 0;
        for (const CNodeStats& stat : stats) {
            if (stat.m_bip152_highbandwidth_to) {
                // HB peers cannot be feelers or other "special" connections (besides addr-fetch).
                CNode* hb_peer = peers[stat.nodeid];
                if (!hb_peer->fDisconnect) num_hb += 1;
                assert(hb_peer->IsInboundConn() || hb_peer->IsOutboundOrBlockRelayConn() || hb_peer->IsManualConn() || hb_peer->IsAddrFetchConn());
            }
        }
        assert(num_hb <= 3);

        if (sent_sendcmpct && !random_node.fDisconnect) {
            // If the fuzzer sent SENDCMPCT with proper version, check the node's state matches what it sent.
            const CNodeStats& random_node_stats = stats[random_node.GetId()];
            if (valid_sendcmpct) assert(random_node_stats.m_bip152_highbandwidth_from == requested_hb);
        }
    }

    setup->m_node.validation_signals->SyncWithValidationInterfaceQueue();
    setup->m_node.validation_signals->UnregisterAllValidationInterfaces();
    connman.StopNodes();

    const size_t end_index_size{WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())};
    const uint64_t end_sequence{WITH_LOCK(mempool.cs, return mempool.GetSequence())};

    if (initial_index_size != end_index_size || initial_sequence != end_sequence) {
        MakeRandDeterministicDANGEROUS(uint256::ZERO);
        ResetChainmanAndMempool(*g_setup);
    }
}

Coverage Report

Created: 2026-06-12 16:53

Line	Count	Source
1		// Copyright (c) 2026 The Bitcoin Core developers
2		// Distributed under the MIT software license, see the accompanying
3		// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5		#include <addrman.h>
6		#include <blockencodings.h>
7		#include <chain.h>
8		#include <chainparams.h>
9		#include <coins.h>
10		#include <consensus/amount.h>
11		#include <consensus/consensus.h>
12		#include <consensus/merkle.h>
13		#include <net.h>
14		#include <net_processing.h>
15		#include <netmessagemaker.h>
16		#include <node/blockstorage.h>
17		#include <node/mining_types.h>
18		#include <policy/truc_policy.h>
19		#include <primitives/block.h>
20		#include <primitives/transaction.h>
21		#include <protocol.h>
22		#include <script/script.h>
23		#include <serialize.h>
24		#include <sync.h>
25		#include <test/fuzz/FuzzedDataProvider.h>
26		#include <test/fuzz/fuzz.h>
27		#include <test/fuzz/util.h>
28		#include <test/fuzz/util/net.h>
29		#include <test/util/mining.h>
30		#include <test/util/net.h>
31		#include <test/util/random.h>
32		#include <test/util/script.h>
33		#include <test/util/setup_common.h>
34		#include <test/util/time.h>
35		#include <test/util/txmempool.h>
36		#include <test/util/validation.h>
37		#include <txmempool.h>
38		#include <uint256.h>
39		#include <util/check.h>
40		#include <util/task_runner.h>
41		#include <util/time.h>
42		#include <util/translation.h>
43		#include <validation.h>
44		#include <validationinterface.h>
45
46		#include <boost/multi_index/detail/hash_index_iterator.hpp>
47
48		#include <cstddef>
49		#include <cstdint>
50		#include <functional>
51		#include <iterator>
52		#include <memory>
53		#include <optional>
54		#include <string>
55		#include <thread>
56		#include <utility>
57		#include <vector>
58
59		namespace {
60
61		TestingSetup* g_setup;
62
63		//! Fee each created tx will pay.
64		const CAmount AMOUNT_FEE{1000};
65		//! Cached coinbases that each iteration can copy and use.
66		std::vector<std::pair<COutPoint, CAmount>> g_mature_coinbase;
67		//! Constant value used to create valid headers.
68		uint32_t g_nBits;
69		//! One for each block the fuzzer generates.
70		struct BlockInfo {
71		std::shared_ptr<CBlock> block;
72		uint256 hash;
73		uint32_t height;
74		};
75		//! Used to access prefilledtxn and shorttxids.
76		class FuzzedCBlockHeaderAndShortTxIDs : public CBlockHeaderAndShortTxIDs
77		{
78		using CBlockHeaderAndShortTxIDs::CBlockHeaderAndShortTxIDs;
79
80		public:
81		void AddPrefilledTx(PrefilledTransaction&& prefilledtx)
82	0	{
83	0	prefilledtxn.push_back(std::move(prefilledtx));
84	0	}
85
86		void RemoveCoinbasePrefill()
87	0	{
88	0	prefilledtxn.erase(prefilledtxn.begin());
89	0	}
90
91		void InsertCoinbaseShortTxID(uint64_t shorttxid)
92	0	{
93	0	shorttxids.insert(shorttxids.begin(), shorttxid);
94	0	}
95
96		void EraseShortTxIDs(size_t index)
97	0	{
98	0	shorttxids.erase(shorttxids.begin() + index);
99	0	}
100
101	0	size_t PrefilledTxCount() {
102	0	return prefilledtxn.size();
103	0	}
104
105	0	size_t ShortTxIDCount() {
106	0	return shorttxids.size();
107	0	}
108		};
109
110		void ResetChainmanAndMempool(TestingSetup& setup)
111	0	{
112	0	SetMockTime(Params().GenesisBlock().Time());
113
114	0	bilingual_str error{};
115	0	setup.m_node.mempool.reset();
116	0	setup.m_node.mempool = std::make_unique<CTxMemPool>(MemPoolOptionsForTest(setup.m_node), error);
117	0	Assert(error.empty());
118
119	0	setup.m_node.chainman.reset();
120	0	setup.m_make_chainman();
121	0	setup.LoadVerifyActivateChainstate();
122
123	0	node::BlockCreateOptions options;
124	0	options.coinbase_output_script = P2WSH_OP_TRUE;
125
126	0	g_mature_coinbase.clear();
127
128	0	for (int i = 0; i < 2 * COINBASE_MATURITY; ++i) { Branch (128:21): [True: 0, False: 0]
129	0	COutPoint prevout{MineBlock(setup.m_node, options)};
130	0	if (i < COINBASE_MATURITY) { Branch (130:13): [True: 0, False: 0]
131	0	LOCK(cs_main);
132	0	CAmount subsidy{setup.m_node.chainman->ActiveChainstate().CoinsTip().GetCoin(prevout)->out.nValue};
133	0	g_mature_coinbase.emplace_back(prevout, subsidy);
134	0	}
135	0	}
136	0	}
137
138		//! Used to run tasks in a std::thread to avoid DEBUG_LOCKORDER false positives.
139		class ImmediateBackgroundTaskRunner : public util::TaskRunnerInterface
140		{
141		public:
142	0	void insert(std::function<void()> func) override { std::thread(std::move(func)).join(); }
143	0	void flush() override {}
144	0	size_t size() override { return 0; }
145		};
146
147		} // namespace
148
149		extern void MakeRandDeterministicDANGEROUS(const uint256& seed) noexcept;
150
151		void initialize_cmpctblock()
152	0	{
153	0	static const auto testing_setup = MakeNoLogFileContext<TestingSetup>();
154	0	g_setup = testing_setup.get();
155	0	g_nBits = Params().GenesisBlock().nBits;
156		// Replace validation_signals before creating chainman and mempool so they use it.
157	0	testing_setup->m_node.validation_signals = std::make_unique<ValidationSignals>(std::make_unique<ImmediateBackgroundTaskRunner>());
158	0	ResetChainmanAndMempool(*g_setup);
159	0	}
160
161		FUZZ_TARGET(cmpctblock, .init = initialize_cmpctblock)
162	0	{
163	0	SeedRandomStateForTest(SeedRand::ZEROS);
164	0	FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
165
166	0	FakeNodeClock clock{1610000000s};
167
168	0	auto setup = g_setup;
169	0	auto& mempool = *setup->m_node.mempool;
170	0	auto& chainman = static_cast<TestChainstateManager&>(*setup->m_node.chainman);
171	0	chainman.ResetIbd();
172	0	chainman.DisableNextWrite();
173	0	const size_t initial_index_size{WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())};
174
175	0	AddrMan addrman{setup->m_node.netgroupman, /deterministic=/true, /consistency_check_ratio=*/0};
176	0	auto& connman = static_cast<ConnmanTestMsg>(setup->m_node.connman.get());
177	0	auto peerman = PeerManager::make(connman, addrman,
178	0	/banman=/nullptr, chainman,
179	0	mempool, *setup->m_node.warnings,
180	0	PeerManager::Options{
181	0	.deterministic_rng = true,
182	0	});
183	0	connman.SetMsgProc(peerman.get());
184
185	0	setup->m_node.validation_signals->RegisterValidationInterface(peerman.get());
186	0	setup->m_node.validation_signals->SyncWithValidationInterfaceQueue();
187
188	0	LOCK(NetEventsInterface::g_msgproc_mutex);
189
190	0	std::vector<CNode*> peers;
191	0	for (int i = 0; i < 4; ++i) { Branch (191:21): [True: 0, False: 0]
192	0	peers.push_back(ConsumeNodeAsUniquePtr(fuzzed_data_provider, i).release());
193	0	CNode& p2p_node = *peers.back();
194	0	FillNode(fuzzed_data_provider, connman, p2p_node);
195	0	connman.AddTestNode(p2p_node);
196	0	}
197
198		// Stores blocks generated this iteration.
199	0	std::vector<BlockInfo> info;
200
201		// Coinbase UTXOs for this iteration.
202	0	std::vector<std::pair<COutPoint, CAmount>> mature_coinbase = g_mature_coinbase;
203
204	0	const uint64_t initial_sequence{WITH_LOCK(mempool.cs, return mempool.GetSequence())};
205
206	0	auto create_tx = [&]() -> CTransactionRef {
207	0	CMutableTransaction tx_mut;
208	0	tx_mut.version = fuzzed_data_provider.ConsumeBool() ? CTransaction::CURRENT_VERSION : TRUC_VERSION; Branch (208:26): [True: 0, False: 0]
209	0	tx_mut.nLockTime = fuzzed_data_provider.ConsumeBool() ? 0 : fuzzed_data_provider.ConsumeIntegral<uint32_t>(); Branch (209:28): [True: 0, False: 0]
210
211		// Choose an outpoint from the mempool, created blocks, or coinbases.
212	0	CAmount amount_in;
213	0	COutPoint outpoint;
214	0	unsigned long mempool_size = mempool.size();
215	0	if (mempool_size != 0 && fuzzed_data_provider.ConsumeBool()) { Branch (215:13): [True: 0, False: 0] Branch (215:34): [True: 0, False: 0]
216	0	size_t random_idx = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, mempool_size - 1);
217	0	CTransactionRef tx = WITH_LOCK(mempool.cs, return mempool.txns_randomized[random_idx].second->GetSharedTx(););
218	0	outpoint = COutPoint(tx->GetHash(), 0);
219	0	amount_in = tx->vout[0].nValue;
220	0	} else if (info.size() != 0 && fuzzed_data_provider.ConsumeBool()) { Branch (220:20): [True: 0, False: 0] Branch (220:40): [True: 0, False: 0]
221		// These blocks (and txs) may be invalid, use a spent output, or not be in the main chain.
222	0	auto info_it = info.begin();
223	0	std::advance(info_it, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, info.size() - 1));
224	0	auto tx_it = info_it->block->vtx.begin();
225	0	std::advance(tx_it, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, info_it->block->vtx.size() - 1));
226	0	outpoint = COutPoint(tx_it->get()->GetHash(), 0);
227	0	amount_in = tx_it->get()->vout[0].nValue;
228	0	} else {
229	0	auto coinbase_it = mature_coinbase.begin();
230	0	std::advance(coinbase_it, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, mature_coinbase.size() - 1));
231	0	outpoint = coinbase_it->first;
232	0	amount_in = coinbase_it->second;
233	0	}
234
235	0	const auto sequence = ConsumeSequence(fuzzed_data_provider);
236	0	const auto script_sig = CScript{};
237	0	const auto script_wit_stack = std::vector<std::vector<uint8_t>>{WITNESS_STACK_ELEM_OP_TRUE};
238
239	0	CTxIn in;
240	0	in.prevout = outpoint;
241	0	in.nSequence = sequence;
242	0	in.scriptSig = script_sig;
243	0	in.scriptWitness.stack = script_wit_stack;
244	0	tx_mut.vin.push_back(in);
245
246	0	const CAmount amount_out = amount_in - AMOUNT_FEE;
247	0	tx_mut.vout.emplace_back(amount_out, P2WSH_OP_TRUE);
248
249	0	auto tx = MakeTransactionRef(tx_mut);
250	0	return tx;
251	0	};
252
253	0	auto create_block = [&]() {
254	0	uint256 prev;
255	0	uint32_t height;
256
257	0	if (info.size() == 0 \|\| fuzzed_data_provider.ConsumeBool()) { Branch (257:13): [True: 0, False: 0] Branch (257:33): [True: 0, False: 0]
258	0	LOCK(cs_main);
259	0	prev = chainman.ActiveChain().Tip()->GetBlockHash();
260	0	height = chainman.ActiveChain().Height() + 1;
261	0	} else {
262	0	size_t index = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, info.size() - 1);
263	0	prev = info[index].hash;
264	0	height = info[index].height + 1;
265	0	}
266
267	0	const auto new_time = WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()->GetMedianTimePast() + 1);
268
269	0	CBlockHeader header;
270	0	header.nNonce = 0;
271	0	header.hashPrevBlock = prev;
272	0	header.nBits = g_nBits;
273	0	header.nTime = new_time;
274	0	header.nVersion = fuzzed_data_provider.ConsumeIntegral<int32_t>();
275
276	0	std::shared_ptr<CBlock> block = std::make_shared<CBlock>();
277	0	*block = header;
278
279	0	CMutableTransaction coinbase_tx;
280	0	coinbase_tx.vin.resize(1);
281	0	coinbase_tx.vin[0].prevout.SetNull();
282	0	coinbase_tx.vin[0].scriptSig = CScript() << height << OP_0;
283	0	coinbase_tx.vout.resize(1);
284	0	coinbase_tx.vout[0].scriptPubKey = CScript() << OP_TRUE;
285	0	coinbase_tx.vout[0].nValue = COIN;
286	0	block->vtx.push_back(MakeTransactionRef(coinbase_tx));
287
288	0	const auto mempool_size = mempool.size();
289	0	if (fuzzed_data_provider.ConsumeBool() && mempool_size != 0) { Branch (289:13): [True: 0, False: 0] Branch (289:51): [True: 0, False: 0]
290		// Add txns from the mempool. Since we do not include parents, it may be an invalid block.
291	0	size_t num_txns = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, mempool_size);
292	0	size_t random_idx = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, mempool_size - 1);
293
294	0	LOCK(mempool.cs);
295	0	for (size_t i = random_idx; i < random_idx + num_txns; ++i) { Branch (295:41): [True: 0, False: 0]
296	0	CTransactionRef mempool_tx = mempool.txns_randomized[i % mempool_size].second->GetSharedTx();
297	0	block->vtx.push_back(mempool_tx);
298	0	}
299	0	}
300
301		// Create and add (possibly invalid) txns that are not in the mempool.
302	0	if (fuzzed_data_provider.ConsumeBool()) { Branch (302:13): [True: 0, False: 0]
303	0	size_t new_txns = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 10);
304	0	for (size_t i = 0; i < new_txns; ++i) { Branch (304:32): [True: 0, False: 0]
305	0	CTransactionRef non_mempool_tx = create_tx();
306	0	block->vtx.push_back(non_mempool_tx);
307	0	}
308	0	}
309
310	0	CBlockIndex* pindexPrev{WITH_LOCK(::cs_main, return chainman.m_blockman.LookupBlockIndex(prev))};
311	0	chainman.GenerateCoinbaseCommitment(*block, pindexPrev);
312
313	0	bool mutated;
314	0	block->hashMerkleRoot = BlockMerkleRoot(*block, &mutated);
315	0	FinalizeHeader(*block, chainman);
316
317	0	BlockInfo block_info;
318	0	block_info.block = block;
319	0	block_info.hash = block->GetHash();
320	0	block_info.height = height;
321
322	0	return block_info;
323	0	};
324
325	0	LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 1000)
326	0	{
327	0	CSerializedNetMsg net_msg;
328	0	bool sent_net_msg = true;
329	0	bool requested_hb = false;
330	0	bool sent_sendcmpct = false;
331	0	bool valid_sendcmpct = false;
332
333	0	CallOneOf(
334	0	fuzzed_data_provider,
335	0	[&]() {
336		// Send a compact block.
337	0	std::shared_ptr<CBlock> cblock;
338
339		// Pick an existing block or create a new block.
340	0	if (fuzzed_data_provider.ConsumeBool() && info.size() != 0) { Branch (340:21): [True: 0, False: 0] Branch (340:59): [True: 0, False: 0]
341	0	size_t index = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, info.size() - 1);
342	0	cblock = info[index].block;
343	0	} else {
344	0	BlockInfo block_info = create_block();
345	0	cblock = block_info.block;
346	0	info.push_back(block_info);
347	0	}
348
349	0	uint64_t nonce = fuzzed_data_provider.ConsumeIntegral<uint64_t>();
350	0	FuzzedCBlockHeaderAndShortTxIDs cmpctblock(*cblock, nonce);
351
352	0	if (fuzzed_data_provider.ConsumeBool()) { Branch (352:21): [True: 0, False: 0]
353	0	CBlockHeaderAndShortTxIDs base_cmpctblock = cmpctblock;
354	0	net_msg = NetMsg::Make(NetMsgType::CMPCTBLOCK, base_cmpctblock);
355	0	return;
356	0	}
357
358	0	int prev_idx = 0;
359	0	size_t num_erased = 1;
360	0	size_t num_txs = cblock->vtx.size();
361
362	0	for (size_t i = 0; i < num_txs; ++i) { Branch (362:36): [True: 0, False: 0]
363	0	if (i == 0) { Branch (363:25): [True: 0, False: 0]
364		// Handle the coinbase specially. We either keep it prefilled or remove it.
365	0	if (fuzzed_data_provider.ConsumeBool()) continue; Branch (365:29): [True: 0, False: 0]
366
367		// Remove the prefilled coinbase.
368	0	num_erased = 0;
369	0	uint64_t coinbase_shortid = cmpctblock.GetShortID(cblock->vtx[0]->GetWitnessHash());
370	0	cmpctblock.RemoveCoinbasePrefill();
371	0	cmpctblock.InsertCoinbaseShortTxID(coinbase_shortid);
372	0	continue;
373	0	}
374
375	0	if (fuzzed_data_provider.ConsumeBool()) continue; Branch (375:25): [True: 0, False: 0]
376
377	0	uint16_t prefill_idx = num_erased == 0 ? i : i - prev_idx - 1; Branch (377:44): [True: 0, False: 0]
378	0	prev_idx = i;
379	0	CTransactionRef txref = cblock->vtx[i];
380	0	PrefilledTransaction prefilledtx = {/index=/prefill_idx, txref};
381	0	cmpctblock.AddPrefilledTx(std::move(prefilledtx));
382
383		// Remove from shorttxids since we've prefilled. Subtract however many txs have been prefilled.
384	0	cmpctblock.EraseShortTxIDs(i - num_erased);
385	0	++num_erased;
386	0	}
387
388	0	assert(cmpctblock.PrefilledTxCount() + cmpctblock.ShortTxIDCount() == num_txs); Branch (388:17): [True: 0, False: 0]
389
390	0	CBlockHeaderAndShortTxIDs base_cmpctblock = cmpctblock;
391	0	net_msg = NetMsg::Make(NetMsgType::CMPCTBLOCK, base_cmpctblock);
392	0	},
393	0	[&]() {
394		// Send a blocktxn message for an existing block (if one exists).
395	0	size_t num_blocks = info.size();
396	0	if (num_blocks == 0) { Branch (396:21): [True: 0, False: 0]
397	0	sent_net_msg = false;
398	0	return;
399	0	}
400
401		// Fetch an existing block and randomly choose transactions to send over.
402	0	size_t index = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, num_blocks - 1);
403	0	const BlockInfo& block_info = info[index];
404	0	BlockTransactions block_txn;
405	0	block_txn.blockhash = block_info.hash;
406	0	std::shared_ptr<CBlock> cblock = block_info.block;
407
408	0	for (size_t i = 0; i < cblock->vtx.size(); i++) { Branch (408:36): [True: 0, False: 0]
409	0	if (fuzzed_data_provider.ConsumeBool()) continue; Branch (409:25): [True: 0, False: 0]
410
411	0	block_txn.txn.push_back(cblock->vtx[i]);
412	0	}
413
414	0	net_msg = NetMsg::Make(NetMsgType::BLOCKTXN, block_txn);
415	0	},
416	0	[&]() {
417		// Send a headers message for an existing block (if one exists).
418	0	size_t num_blocks = info.size();
419	0	if (num_blocks == 0) { Branch (419:21): [True: 0, False: 0]
420	0	sent_net_msg = false;
421	0	return;
422	0	}
423
424		// Choose an existing block and send a HEADERS message for it.
425	0	size_t index = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, num_blocks - 1);
426	0	CBlock block = *info[index].block;
427	0	block.vtx.clear(); // No tx in HEADERS.
428	0	std::vector<CBlock> headers;
429	0	headers.emplace_back(block);
430
431	0	net_msg = NetMsg::Make(NetMsgType::HEADERS, TX_WITH_WITNESS(headers));
432	0	},
433	0	[&]() {
434		// Send a sendcmpct message, optionally setting hb mode.
435	0	bool hb = fuzzed_data_provider.ConsumeBool();
436	0	uint64_t version{fuzzed_data_provider.ConsumeBool() ? CMPCTBLOCKS_VERSION : fuzzed_data_provider.ConsumeIntegral<uint64_t>()}; Branch (436:34): [True: 0, False: 0]
437	0	net_msg = NetMsg::Make(NetMsgType::SENDCMPCT, /high_bandwidth=/hb, /version=/version);
438	0	requested_hb = hb;
439	0	sent_sendcmpct = true;
440	0	valid_sendcmpct = version == CMPCTBLOCKS_VERSION;
441	0	},
442	0	[&]() {
443		// Mine a block, but don't send it.
444	0	BlockInfo block_info = create_block();
445	0	info.push_back(block_info);
446	0	sent_net_msg = false;
447	0	},
448	0	[&]() {
449		// Send a transaction.
450	0	CTransactionRef tx = create_tx();
451	0	net_msg = NetMsg::Make(NetMsgType::TX, TX_WITH_WITNESS(*tx));
452	0	},
453	0	[&]() {
454		// Set mock time randomly or to tip's time.
455	0	if (fuzzed_data_provider.ConsumeBool()) { Branch (455:21): [True: 0, False: 0]
456	0	clock.set(ConsumeTime(fuzzed_data_provider));
457	0	} else {
458	0	const NodeSeconds tip_time = WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()->Time());
459	0	clock.set(tip_time);
460	0	}
461
462	0	sent_net_msg = false;
463	0	});
464
465	0	if (!sent_net_msg) { Branch (465:13): [True: 0, False: 0]
466	0	continue;
467	0	}
468
469	0	CNode& random_node = *PickValue(fuzzed_data_provider, peers);
470	0	connman.FlushSendBuffer(random_node);
471	0	(void)connman.ReceiveMsgFrom(random_node, std::move(net_msg));
472
473	0	bool more_work{true};
474	0	while (more_work) { Branch (474:16): [True: 0, False: 0]
475	0	random_node.fPauseSend = false;
476
477	0	more_work = connman.ProcessMessagesOnce(random_node);
478	0	peerman->SendMessages(random_node);
479	0	}
480
481	0	std::vector<CNodeStats> stats;
482	0	connman.GetNodeStats(stats);
483
484		// We should have at maximum 3 HB peers.
485	0	int num_hb = 0;
486	0	for (const CNodeStats& stat : stats) { Branch (486:37): [True: 0, False: 0]
487	0	if (stat.m_bip152_highbandwidth_to) { Branch (487:17): [True: 0, False: 0]
488		// HB peers cannot be feelers or other "special" connections (besides addr-fetch).
489	0	CNode* hb_peer = peers[stat.nodeid];
490	0	if (!hb_peer->fDisconnect) num_hb += 1; Branch (490:21): [True: 0, False: 0]
491	0	assert(hb_peer->IsInboundConn() \|\| hb_peer->IsOutboundOrBlockRelayConn() \|\| hb_peer->IsManualConn() \|\| hb_peer->IsAddrFetchConn()); Branch (491:17): [True: 0, False: 0] Branch (491:17): [True: 0, False: 0] Branch (491:17): [True: 0, False: 0] Branch (491:17): [True: 0, False: 0] Branch (491:17): [True: 0, False: 0]
492	0	}
493	0	}
494	0	assert(num_hb <= 3); Branch (494:9): [True: 0, False: 0]
495
496	0	if (sent_sendcmpct && !random_node.fDisconnect) { Branch (496:13): [True: 0, False: 0] Branch (496:31): [True: 0, False: 0]
497		// If the fuzzer sent SENDCMPCT with proper version, check the node's state matches what it sent.
498	0	const CNodeStats& random_node_stats = stats[random_node.GetId()];
499	0	if (valid_sendcmpct) assert(random_node_stats.m_bip152_highbandwidth_from == requested_hb); Branch (499:17): [True: 0, False: 0] Branch (499:34): [True: 0, False: 0]
500	0	}
501	0	}
502
503	0	setup->m_node.validation_signals->SyncWithValidationInterfaceQueue();
504	0	setup->m_node.validation_signals->UnregisterAllValidationInterfaces();
505	0	connman.StopNodes();
506
507	0	const size_t end_index_size{WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())};
508	0	const uint64_t end_sequence{WITH_LOCK(mempool.cs, return mempool.GetSequence())};
509
510	0	if (initial_index_size != end_index_size \|\| initial_sequence != end_sequence) { Branch (510:9): [True: 0, False: 0] Branch (510:49): [True: 0, False: 0]
511	0	MakeRandDeterministicDANGEROUS(uint256::ZERO);
512	0	ResetChainmanAndMempool(*g_setup);
513	0	}
514	0	}