Add http_request inputs covering the chunked body branch - #293
Open
jeanpablojp wants to merge 1 commit into
Open
Add http_request inputs covering the chunked body branch#293jeanpablojp wants to merge 1 commit into
jeanpablojp wants to merge 1 commit into
Conversation
LoadBody()'s Transfer-Encoding: chunked branch has been in master since bitcoin/bitcoin#35182, and bitcoin/bitcoin#35759 added an assertion in the http_request target for the body that branch produces. Neither one runs against the corpus here: of the 146 http_request inputs in main, none enters the chunked branch and none reaches that assertion. Getting there needs the header name and the value together inside an otherwise valid request, and the fuzzer does not find that on its own. Against master's target, seeded from the current corpus, neither 1.66M executions with fuzz_dicts/http_request.dict nor 1.79M with "chunked" added to it entered the branch, both with -use_value_profile=1 and -max_len=32768. Seeded with the current corpus plus one hand-written chunked request and run for the 100 minutes generate_corpus uses, 15.7M executions, then merged back with the flags merge_inputs uses. Of the 120 inputs, 52 enter the chunked branch and 3 reach the assertion from #35759; the rest are what that run turned up along the way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
Transfer-Encoding: chunkedbranch ofLoadBody()has been in master since bitcoin/bitcoin#35182, and bitcoin/bitcoin#35759 added an assertion in thehttp_requesttarget for the body it produces. Neither runs today: none of the 146 inputs in this target's corpus enters the branch, so the assertion never fires.The fuzzer does not get there on its own. Against master's target, seeded from the current corpus, 1.66M executions with
fuzz_dicts/http_request.dictstayed out of the branch, and so did 1.79M with"chunked"added to that dictionary.These inputs come from the current corpus plus one chunked request I wrote by hand, run for the 100 minutes
generate_corpususes and merged back with the flagsmerge_inputsuses. 52 of the 120 enter the branch and 3 reach the assertion. Merging them into the corpus keeps all 120, so none is redundant.