Skip to content

Commit

Permalink
fuzz: Fix mini_miner_selection running out of coin
Browse files Browse the repository at this point in the history
Fixes a bug in the mini_miner_selection fuzz test found by fuzzing:
It was possible for the mini_miner_selection fuzz test to generated
transactions that created fewer new outputs than the two inputs they
each spent. If the fuzz seed did so consistently, eventually it would
cause a `pop_front()` on an empty available_coins.
Fixed per belt-suspender approach:
- assert that available_coins is not empty before generating tx
- generate at least two coins per new tx
- allow building tx with a single coin if only one is available
  • Loading branch information
murchandamus committed Jun 2, 2023
1 parent b22408d commit bbb9277
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions src/test/fuzz/mini_miner.cpp
Expand Up @@ -118,9 +118,10 @@ FUZZ_TARGET_INIT(mini_miner_selection, initialize_miner)
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 100)
{
CMutableTransaction mtx = CMutableTransaction();
const size_t num_inputs = 2;
const size_t num_outputs = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(2, 5);
const size_t num_inputs = std::min(size_t{2}, available_coins.size());
const size_t num_outputs = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(3, 5);
for (size_t n{0}; n < num_inputs; ++n) {
assert(available_coins.size() > 0);
auto prevout = available_coins.front();
mtx.vin.push_back(CTxIn(prevout, CScript()));
available_coins.pop_front();
Expand Down

0 comments on commit bbb9277

Please sign in to comment.