ci: run fuzz regression tests #1

morehouse · 2023-03-17T20:49:03Z

Temporary PR to test CI integration.

The issue is that common_setup() wasn't called by the fuzz target, leaving secp256k1_ctx as NULL. UBSan error: $ UBSAN_OPTIONS="print_stacktrace=1:halt_on_error=1" \ ./fuzz-channel_id crash-1575b41ef09e62e4c09c165e6dc037a110b113f2 INFO: Running with entropic power schedule (0xFF, 100). INFO: Seed: 1153355603 INFO: Loaded 1 modules (25915 inline 8-bit counters): 25915 [0x563bae7ac3a8, 0x563bae7b28e3), INFO: Loaded 1 PC tables (25915 PCs): 25915 [0x563bae7b28e8,0x563bae817c98), ./fuzz-channel_id: Running 1 inputs 1 time(s) each. Running: crash-1575b41ef09e62e4c09c165e6dc037a110b113f2 bitcoin/pubkey.c:22:33: runtime error: null pointer passed as argument 1, which is declared to never be null external/libwally-core/src/secp256k1/include/secp256k1.h:373:3: note: nonnull attribute specified here #0 0x563bae41e3db in pubkey_from_der bitcoin/pubkey.c:19:7 #1 0x563bae4205e0 in fromwire_pubkey bitcoin/pubkey.c:111:7 #2 0x563bae46437c in run tests/fuzz/fuzz-channel_id.c:42:3 #3 0x563bae2f6016 in LLVMFuzzerTestOneInput tests/fuzz/libfuzz.c:23:2 #4 0x563bae20a450 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) ElementsProject#5 0x563bae1f4c3f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) ElementsProject#6 0x563bae1fa6e6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) ElementsProject#7 0x563bae223052 in main (tests/fuzz/fuzz-channel_id+0x181052) (BuildId: f7f56e14ffc06df54ab732d79ea922e773de1f25) ElementsProject#8 0x7fa7fa113082 in __libc_start_main ElementsProject#9 0x563bae1efbdd in _start SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior bitcoin/pubkey.c:22:33 in

There are several benefits of doing this: - prevent fuzz target bit rot - more test coverage in CI - greater visibility of fuzz tests, encouraging contributions to the seed corpus and tests themselves

Detected by UBSan: $ UBSAN_OPTIONS=print_stacktrace=1 ./wallet/test/run-psbt_fixup bitcoin/psbt.c:733:2: runtime error: applying zero offset to null pointer #0 0x53c829 in psbt_from_bytes lightning/bitcoin/psbt.c:733:2 #1 0x5adcb0 in main lightning/wallet/test/run-psbt_fixup.c:174:10 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior bitcoin/psbt.c:733:2

The function is tiny and was only used in one location. And that one location was leaking memory. Detected by ASan: ==2637667==ERROR: LeakSanitizer: detected memory leaks Direct leak of 7 byte(s) in 1 object(s) allocated from: #0 0x4cd758 in __interceptor_strdup #1 0x64c70c in json_stream_log_suppress_for_cmd lightning/lightningd/jsonrpc.c:597:31 #2 0x68a630 in json_getlog lightning/lightningd/log.c:974:2 ... SUMMARY: AddressSanitizer: 7 byte(s) leaked in 1 allocation(s).

It is possible for db_column_bytes() to return 0 and for db_column_blob() to return NULL even when db_column_is_null() returns false. We need to short circuit in this case. Detected by UBSan: db/bindings.c:479:12: runtime error: null pointer passed as argument 2, which is declared to never be null /usr/include/string.h:44:28: note: nonnull attribute specified here #0 0x95f117 in db_col_arr_ db/bindings.c:479:2 #1 0x95ef85 in db_col_channel_type db/bindings.c:459:32 #2 0x852c03 in wallet_stmt2channel wallet/wallet.c:1483:9 #3 0x81f396 in wallet_channels_load_active wallet/wallet.c:1749:23 #4 0x81f03d in wallet_init_channels wallet/wallet.c:1765:9 ElementsProject#5 0x72f1f9 in load_channels_from_wallet lightningd/peer_control.c:2257:7 ElementsProject#6 0x672856 in main lightningd/lightningd.c:1121:25

Fixes nullability errors detected by UBSan: wire/fromwire.c:173:46: runtime error: null pointer passed as argument 1, which is declared to never be null external/libwally-core/src/secp256k1/include/secp256k1.h:432:3: note: nonnull attribute specified here #0 0x65214a in fromwire_secp256k1_ecdsa_signature wire/fromwire.c:173:6 #1 0x659500 in printwire_secp256k1_ecdsa_signature devtools/print_wire.c:331:1 #2 0x646ba2 in printwire_channel_update wire/peer_printgen.c:1900:7 #3 0x637182 in printpeer_wire_message wire/peer_printgen.c:128:11 #4 0x65a097 in main devtools/decodemsg.c:85:10

Memory leak detected by ASan: ==880002==ERROR: LeakSanitizer: detected memory leaks Direct leak of 32816 byte(s) in 1 object(s) allocated from: #0 0x5039e7 in malloc (lightningd/lightningd+0x5039e7) #1 0x7f2e8c203884 in __alloc_dir (/lib64/libc.so.6+0xd2884)