From fa98f3f66ecb0a0c6805dcdcf828f12a1a11c3e6 Mon Sep 17 00:00:00 2001
From: MarcoFalke <falke.marco@gmail.com>
Date: Tue, 30 Mar 2021 09:06:23 +0200
Subject: [PATCH 1/3] fuzz: [refactor] Use ConsumeScript in signature_checker
 fuzz target

---
 src/test/fuzz/signature_checker.cpp | 11 +++++------
 src/test/fuzz/util.cpp              |  2 +-
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/src/test/fuzz/signature_checker.cpp b/src/test/fuzz/signature_checker.cpp
index 7b57c5dfd8..17a5ae6e87 100644
--- a/src/test/fuzz/signature_checker.cpp
+++ b/src/test/fuzz/signature_checker.cpp
@@ -6,6 +6,7 @@
 #include <script/interpreter.h>
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
 
 #include <cstdint>
 #include <limits>
@@ -56,17 +57,15 @@ FUZZ_TARGET_INIT(signature_checker, initialize_signature_checker)
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
     const unsigned int flags = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
     const SigVersion sig_version = fuzzed_data_provider.PickValueInArray({SigVersion::BASE, SigVersion::WITNESS_V0});
-    const std::string script_string_1 = fuzzed_data_provider.ConsumeRandomLengthString(65536);
-    const std::vector<uint8_t> script_bytes_1{script_string_1.begin(), script_string_1.end()};
-    const std::string script_string_2 = fuzzed_data_provider.ConsumeRandomLengthString(65536);
-    const std::vector<uint8_t> script_bytes_2{script_string_2.begin(), script_string_2.end()};
+    const auto script_1 = ConsumeScript(fuzzed_data_provider, 65536);
+    const auto script_2 = ConsumeScript(fuzzed_data_provider, 65536);
     std::vector<std::vector<unsigned char>> stack;
-    (void)EvalScript(stack, {script_bytes_1.begin(), script_bytes_1.end()}, flags, FuzzedSignatureChecker(fuzzed_data_provider), sig_version, nullptr);
+    (void)EvalScript(stack, script_1, flags, FuzzedSignatureChecker(fuzzed_data_provider), sig_version, nullptr);
     if ((flags & SCRIPT_VERIFY_CLEANSTACK) != 0 && ((flags & SCRIPT_VERIFY_P2SH) == 0 || (flags & SCRIPT_VERIFY_WITNESS) == 0)) {
         return;
     }
     if ((flags & SCRIPT_VERIFY_WITNESS) != 0 && (flags & SCRIPT_VERIFY_P2SH) == 0) {
         return;
     }
-    (void)VerifyScript({script_bytes_1.begin(), script_bytes_1.end()}, {script_bytes_2.begin(), script_bytes_2.end()}, nullptr, flags, FuzzedSignatureChecker(fuzzed_data_provider), nullptr);
+    (void)VerifyScript(script_1, script_2, nullptr, flags, FuzzedSignatureChecker(fuzzed_data_provider), nullptr);
 }
diff --git a/src/test/fuzz/util.cpp b/src/test/fuzz/util.cpp
index 93418ab1ff..d786ac1db1 100644
--- a/src/test/fuzz/util.cpp
+++ b/src/test/fuzz/util.cpp
@@ -80,7 +80,7 @@ CScriptWitness ConsumeScriptWitness(FuzzedDataProvider& fuzzed_data_provider, co
 
 CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, const size_t max_length, const bool maybe_p2wsh) noexcept
 {
-    const std::vector<uint8_t> b = ConsumeRandomLengthByteVector(fuzzed_data_provider);
+    const std::vector<uint8_t> b = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
     CScript r_script{b.begin(), b.end()};
     if (maybe_p2wsh && fuzzed_data_provider.ConsumeBool()) {
         uint256 script_hash;

From eeee8f5be1d4ccfb7e237248be5c6bef45b0fbb8 Mon Sep 17 00:00:00 2001
From: MarcoFalke <falke.marco@gmail.com>
Date: Tue, 30 Mar 2021 10:28:34 +0200
Subject: [PATCH 2/3] fuzz: Removed unused try-catch in coins_view

---
 src/test/fuzz/coins_view.cpp | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/test/fuzz/coins_view.cpp b/src/test/fuzz/coins_view.cpp
index d951bda20f..b21d2eae79 100644
--- a/src/test/fuzz/coins_view.cpp
+++ b/src/test/fuzz/coins_view.cpp
@@ -230,11 +230,8 @@ FUZZ_TARGET_INIT(coins_view, initialize_coins_view)
                     // consensus/tx_verify.cpp:171: bool Consensus::CheckTxInputs(const CTransaction &, TxValidationState &, const CCoinsViewCache &, int, CAmount &): Assertion `!coin.IsSpent()' failed.
                     return;
                 }
-                try {
-                    (void)Consensus::CheckTxInputs(transaction, state, coins_view_cache, fuzzed_data_provider.ConsumeIntegralInRange<int>(0, std::numeric_limits<int>::max()), tx_fee_out);
-                    assert(MoneyRange(tx_fee_out));
-                } catch (const std::runtime_error&) {
-                }
+                (void)Consensus::CheckTxInputs(transaction, state, coins_view_cache, fuzzed_data_provider.ConsumeIntegralInRange<int>(0, std::numeric_limits<int>::max()), tx_fee_out);
+                assert(MoneyRange(tx_fee_out));
             },
             [&] {
                 const CTransaction transaction{random_mutable_transaction};

From fa4926cca68db2433e579d9b4a642248a9314673 Mon Sep 17 00:00:00 2001
From: MarcoFalke <falke.marco@gmail.com>
Date: Tue, 30 Mar 2021 09:32:35 +0200
Subject: [PATCH 3/3] fuzz: [refactor] Use IsValidFlagCombination in
 signature_checker fuzz target

Can be reviewed with --color-moved=dimmed-zebra
---
 src/Makefile.test_util.include      |  1 +
 src/test/fuzz/script_flags.cpp      | 11 +----------
 src/test/fuzz/signature_checker.cpp |  6 ++----
 src/test/util/script.cpp            | 13 +++++++++++++
 src/test/util/script.h              |  3 +++
 5 files changed, 20 insertions(+), 14 deletions(-)
 create mode 100644 src/test/util/script.cpp

diff --git a/src/Makefile.test_util.include b/src/Makefile.test_util.include
index f7f393ccac..85e50ebf70 100644
--- a/src/Makefile.test_util.include
+++ b/src/Makefile.test_util.include
@@ -26,6 +26,7 @@ libtest_util_a_SOURCES = \
   test/util/logging.cpp \
   test/util/mining.cpp \
   test/util/net.cpp \
+  test/util/script.cpp \
   test/util/setup_common.cpp \
   test/util/str.cpp \
   test/util/transaction_utils.cpp \
diff --git a/src/test/fuzz/script_flags.cpp b/src/test/fuzz/script_flags.cpp
index 561230707c..387f9c069c 100644
--- a/src/test/fuzz/script_flags.cpp
+++ b/src/test/fuzz/script_flags.cpp
@@ -5,13 +5,11 @@
 #include <pubkey.h>
 #include <script/interpreter.h>
 #include <streams.h>
+#include <test/util/script.h>
 #include <version.h>
 
 #include <test/fuzz/fuzz.h>
 
-/** Flags that are not forbidden by an assert */
-static bool IsValidFlagCombination(unsigned flags);
-
 void initialize_script_flags()
 {
     static const ECCVerifyHandle verify_handle;
@@ -74,10 +72,3 @@ FUZZ_TARGET_INIT(script_flags, initialize_script_flags)
         return;
     }
 }
-
-static bool IsValidFlagCombination(unsigned flags)
-{
-    if (flags & SCRIPT_VERIFY_CLEANSTACK && ~flags & (SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_WITNESS)) return false;
-    if (flags & SCRIPT_VERIFY_WITNESS && ~flags & SCRIPT_VERIFY_P2SH) return false;
-    return true;
-}
diff --git a/src/test/fuzz/signature_checker.cpp b/src/test/fuzz/signature_checker.cpp
index 17a5ae6e87..6b86c8889d 100644
--- a/src/test/fuzz/signature_checker.cpp
+++ b/src/test/fuzz/signature_checker.cpp
@@ -7,6 +7,7 @@
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
 #include <test/fuzz/util.h>
+#include <test/util/script.h>
 
 #include <cstdint>
 #include <limits>
@@ -61,10 +62,7 @@ FUZZ_TARGET_INIT(signature_checker, initialize_signature_checker)
     const auto script_2 = ConsumeScript(fuzzed_data_provider, 65536);
     std::vector<std::vector<unsigned char>> stack;
     (void)EvalScript(stack, script_1, flags, FuzzedSignatureChecker(fuzzed_data_provider), sig_version, nullptr);
-    if ((flags & SCRIPT_VERIFY_CLEANSTACK) != 0 && ((flags & SCRIPT_VERIFY_P2SH) == 0 || (flags & SCRIPT_VERIFY_WITNESS) == 0)) {
-        return;
-    }
-    if ((flags & SCRIPT_VERIFY_WITNESS) != 0 && (flags & SCRIPT_VERIFY_P2SH) == 0) {
+    if (!IsValidFlagCombination(flags)) {
         return;
     }
     (void)VerifyScript(script_1, script_2, nullptr, flags, FuzzedSignatureChecker(fuzzed_data_provider), nullptr);
diff --git a/src/test/util/script.cpp b/src/test/util/script.cpp
new file mode 100644
index 0000000000..a5852daa60
--- /dev/null
+++ b/src/test/util/script.cpp
@@ -0,0 +1,13 @@
+// Copyright (c) 2021 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/interpreter.h>
+#include <test/util/script.h>
+
+bool IsValidFlagCombination(unsigned flags)
+{
+    if (flags & SCRIPT_VERIFY_CLEANSTACK && ~flags & (SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_WITNESS)) return false;
+    if (flags & SCRIPT_VERIFY_WITNESS && ~flags & SCRIPT_VERIFY_P2SH) return false;
+    return true;
+}
diff --git a/src/test/util/script.h b/src/test/util/script.h
index abd14c2067..428b3e10b3 100644
--- a/src/test/util/script.h
+++ b/src/test/util/script.h
@@ -18,4 +18,7 @@ static const CScript P2WSH_OP_TRUE{
            return hash;
        }())};
 
+/** Flags that are not forbidden by an assert in script validation */
+bool IsValidFlagCombination(unsigned flags);
+
 #endif // BITCOIN_TEST_UTIL_SCRIPT_H