fuzz: BIP157 wire and on-disk parser harnesses (stacked on #351, #387)

CMakeLists.txt

@@ -382,10 +382,12 @@ TARGET_SOURCES(${LIBDOGECOIN_NAME} PRIVATE
     src/buffer.c
     src/chacha20.c
     src/context.c
+    src/compact_filter.c
     src/cstr.c
     src/ctaes.c
     src/ecc.c
     src/eckey.c
+    src/golomb.c
     src/key.c
     src/koinu.c
     src/map.c
@@ -458,6 +460,12 @@ ENDIF()
 ENDIF()
 TARGET_SOURCES(${LIBDOGECOIN_NAME} PUBLIC
     src/chainparams.c
+    # PUBLIC for the same reason as chainparams: these are const data
+    # referenced from the CLI targets, and a PRIVATE source is compiled only
+    # into the library. On a Windows DLL build the executables then cannot
+    # reach the arrays -- data symbols do not resolve across the DLL boundary
+    # without dllimport, and LIBDOGECOIN_API expands to nothing for consumers.
+    src/cf_checkpoints.c
 )
 
 IF(WIN32 AND USE_TPM2)
@@ -555,6 +563,8 @@ IF(USE_TESTS)
         test/chacha20_tests.c
         test/context_tests.c
         test/cstr_tests.c
+        test/compact_filter_tests.c
+        test/golomb_tests.c
         test/ecc_tests.c
         test/hash_tests.c
         test/key_tests.c
@@ -685,6 +695,7 @@ IF(WITH_NET)
     )
     TARGET_SOURCES(${LIBDOGECOIN_NAME} ${visibility}
         src/bip37.c
+        src/cfheadersdb_file.c
         src/headersdb_file.c
         src/net.c
         src/protocol.c
@@ -701,6 +712,7 @@ IF(WITH_NET)
     ENDIF()
     IF(USE_TESTS)
         TARGET_SOURCES(tests ${visibility}
+            test/cfheadersdb_tests.c
             test/net_tests.c
             test/protocol_tests.c
             test/spv_tests.c

Makefile.am

@@ -46,11 +46,14 @@ noinst_HEADERS = \
     include/dogecoin/byteswap.h \
     include/dogecoin/chacha20.h \
     include/dogecoin/chainparams.h \
+    include/dogecoin/cf_checkpoints.h \
+    include/dogecoin/compact_filter.h \
     include/dogecoin/common.h \
     include/dogecoin/cstr.h \
     include/dogecoin/ctaes.h \
     include/dogecoin/ecc.h \
     include/dogecoin/eckey.h \
+    include/dogecoin/golomb.h \
     include/dogecoin/hash.h \
     include/dogecoin/key.h \
     include/dogecoin/koinu.h \
@@ -108,10 +111,13 @@ libdogecoin_la_SOURCES = \
     src/chacha20.c \
     src/context.c \
     src/chainparams.c \
+    src/cf_checkpoints.c \
+    src/compact_filter.c \
     src/cstr.c \
     src/ctaes.c \
     src/ecc.c \
     src/eckey.c \
+    src/golomb.c \
     src/key.c \
     src/koinu.c \
     src/map.c \
@@ -282,6 +288,8 @@ tests_SOURCES = \
     test/chacha20_tests.c \
     test/context_tests.c \
     test/cstr_tests.c \
+    test/compact_filter_tests.c \
+    test/golomb_tests.c \
     test/ecc_tests.c \
     test/hash_tests.c \
     test/key_tests.c \
@@ -410,6 +418,7 @@ endif
 
 if WITH_NET
 noinst_HEADERS += \
+    include/dogecoin/cfheadersdb_file.h \
     include/dogecoin/headersdb.h \
     include/dogecoin/headersdb_file.h \
     include/dogecoin/protocol.h \
@@ -418,6 +427,7 @@ noinst_HEADERS += \
     include/dogecoin/spv.h
 
 libdogecoin_la_SOURCES += \
+    src/cfheadersdb_file.c \
     src/headersdb_file.c \
     src/bip37.c \
     src/net.c \
@@ -430,6 +440,7 @@ libdogecoin_la_CFLAGS += $(EVENT_CFLAGS) $(EVENT_PTHREADS_CFLAGS)
 
 if USE_TESTS
 tests_SOURCES += \
+    test/cfheadersdb_tests.c \
     test/net_tests.c \
     test/protocol_tests.c \
     test/spv_tests.c
@@ -503,6 +514,13 @@ fuzz_fuzz_tx_LDADD = libdogecoin.la $(ASM_LIB_FILES)
 fuzz_fuzz_tx_CFLAGS = $(AM_CFLAGS) -fsanitize=fuzzer,address,undefined
 fuzz_fuzz_tx_LDFLAGS = -fsanitize=fuzzer,address,undefined -static
 
+noinst_PROGRAMS += fuzz/fuzz_compact_filter
+fuzz_fuzz_compact_filter_SOURCES = fuzz/fuzz_compact_filter.c
+fuzz_fuzz_compact_filter_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/include
+fuzz_fuzz_compact_filter_LDADD = libdogecoin.la $(ASM_LIB_FILES)
+fuzz_fuzz_compact_filter_CFLAGS = $(AM_CFLAGS) -fsanitize=fuzzer,address,undefined
+fuzz_fuzz_compact_filter_LDFLAGS = -fsanitize=fuzzer,address,undefined -static
+
 noinst_PROGRAMS += fuzz/fuzz_block
 fuzz_fuzz_block_SOURCES = fuzz/fuzz_block.c
 fuzz_fuzz_block_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/include
@@ -515,6 +533,13 @@ fuzz_fuzz_block_LDFLAGS = -fsanitize=fuzzer,address,undefined -static
 # Gate the harness on the same condition so `make fuzz` still builds the
 # net-independent targets when networking is disabled.
 if WITH_NET
+noinst_PROGRAMS += fuzz/fuzz_cfdb
+fuzz_fuzz_cfdb_SOURCES = fuzz/fuzz_cfdb.c
+fuzz_fuzz_cfdb_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/include
+fuzz_fuzz_cfdb_LDADD = libdogecoin.la $(ASM_LIB_FILES)
+fuzz_fuzz_cfdb_CFLAGS = $(AM_CFLAGS) -fsanitize=fuzzer,address,undefined
+fuzz_fuzz_cfdb_LDFLAGS = -fsanitize=fuzzer,address,undefined -static
+
 noinst_PROGRAMS += fuzz/fuzz_protocol
 fuzz_fuzz_protocol_SOURCES = fuzz/fuzz_protocol.c
 fuzz_fuzz_protocol_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/include
@@ -559,9 +584,9 @@ fuzz-corpus: fuzz/seed_logdb_corpus
 	./fuzz/seed_logdb_corpus $(CORPUS)
 
 
-FUZZ_TARGETS = fuzz/fuzz_tx fuzz/fuzz_block fuzz/fuzz_wtx fuzz/fuzz_logdb fuzz/fuzz_psbt
+FUZZ_TARGETS = fuzz/fuzz_tx fuzz/fuzz_block fuzz/fuzz_wtx fuzz/fuzz_logdb fuzz/fuzz_psbt fuzz/fuzz_compact_filter
 if WITH_NET
-FUZZ_TARGETS += fuzz/fuzz_protocol
+FUZZ_TARGETS += fuzz/fuzz_protocol fuzz/fuzz_cfdb
 endif
 
 fuzz: $(FUZZ_TARGETS)

fuzz/fuzz_cfdb.c

@@ -0,0 +1,123 @@
+/*
+
+ The MIT License (MIT)
+
+ Copyright (c) 2026 bluezr
+ Copyright (c) 2026 The Dogecoin Foundation
+
+ Permission is hereby granted, free of charge, to any person obtaining
+ a copy of this software and associated documentation files (the "Software"),
+ to deal in the Software without restriction, including without limitation
+ the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ and/or sell copies of the Software, and to permit persons to whom the
+ Software is furnished to do so, subject to the following conditions:
+
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+ OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ OTHER DEALINGS IN THE SOFTWARE.
+
+*/
+
+/*
+ * libFuzzer harness for the on-disk compact filter stores.
+ *
+ * The wire deserializers have their own harness (fuzz_compact_filter). This
+ * one covers the other parser: cfheaders.dat and cfilters.dat, which are read
+ * back at startup. Their contents are not attacker-supplied over the network,
+ * but they are attacker-influenced -- every record was written from data a peer
+ * sent -- and a corrupt or tampered file is exactly the case the readers have
+ * to survive rather than trust.
+ *
+ * cfilters.dat is the more interesting of the two. Each record carries its own
+ * length field, and iterate() sizes an allocation directly from it:
+ *
+ *   height (4) | block_hash (32) | data_len (4) | data[data_len]
+ *
+ * The harness is file-shaped because the readers take a path, not a buffer.
+ * That caps throughput far below a buffer harness -- every execution writes and
+ * reopens a file -- which is inherent to the target rather than a defect in the
+ * harness.
+ *
+ * Build:  ./configure CC=clang CFLAGS="-fsanitize=fuzzer-no-link" --enable-fuzz && make fuzz
+ * Run:    ./fuzz/fuzz_cfdb CORPUS_DIR -max_len=65536
+ */
+#include <stdint.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <dogecoin/dogecoin.h>
+#include <dogecoin/cfheadersdb_file.h>
+#include <dogecoin/chainparams.h>
+#include <dogecoin/compact_filter.h>
+#include <dogecoin/mem.h>
+#include <dogecoin/vector.h>
+
+/* Reused across executions: creating a fresh temp name per run would leave the
+   fuzzer's working directory full of files and slow the loop further. */
+static const char *CFDB_FUZZ_PATH = "fuzz_cfdb_input.dat";
+
+static dogecoin_bool iter_cb(uint32_t height, const uint256_t block_hash,
+                             const uint8_t *filter_data, uint32_t data_len,
+                             void *ctx)
+{
+    /* Touch the record so a bad length or pointer is dereferenced rather than
+       merely returned: a callback that ignores its arguments would let an
+       out-of-bounds buffer pass through unnoticed. */
+    volatile uint8_t sink = 0;
+    unsigned int *count = (unsigned int *)ctx;
+    (void)height;
+    sink ^= block_hash[0];
+    if (filter_data && data_len > 0) {
+        sink ^= filter_data[0];
+        sink ^= filter_data[data_len - 1];
+    }
+    (void)sink;
+    if (++(*count) > 4096) return false;   /* bound the loop, not the parser */
+    return true;
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    if (size < 1) return 0;
+
+    uint8_t selector = data[0];
+    FILE *f = fopen(CFDB_FUZZ_PATH, "wb");
+    if (!f) return 0;
+    if (size > 1) fwrite(data + 1, 1, size - 1, f);
+    fclose(f);
+
+    if (selector & 0x01) {
+        /* cfilters.dat: record headers plus length-prefixed payloads. */
+        dogecoin_cfilters_db *db =
+            dogecoin_cfilters_db_new(&dogecoin_chainparams_main, false);
+        if (db) {
+            if (dogecoin_cfilters_db_load(db, CFDB_FUZZ_PATH)) {
+                unsigned int count = 0;
+                dogecoin_cfilters_db_iterate(db, iter_cb, &count);
+            }
+            dogecoin_cfilters_db_free(db);
+        }
+    } else {
+        /* cfheaders.dat: file header, version gate, then fixed-size records
+           loaded into the filter state. */
+        dogecoin_cfheaders_db *db =
+            dogecoin_cfheaders_db_new(&dogecoin_chainparams_main, false);
+        dogecoin_compact_filter_state *state = dogecoin_compact_filter_state_new();
+        if (db && state)
+            dogecoin_cfheaders_db_load(db, CFDB_FUZZ_PATH, state);
+        if (state) dogecoin_compact_filter_state_free(state);
+        if (db) dogecoin_cfheaders_db_free(db);
+    }
+
+    unlink(CFDB_FUZZ_PATH);
+    return 0;
+}

fuzz/fuzz_compact_filter.c

@@ -0,0 +1,110 @@
+/*
+
+ The MIT License (MIT)
+
+ Copyright (c) 2026 bluezr
+ Copyright (c) 2026 The Dogecoin Foundation
+
+ Permission is hereby granted, free of charge, to any person obtaining
+ a copy of this software and associated documentation files (the "Software"),
+ to deal in the Software without restriction, including without limitation
+ the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ and/or sell copies of the Software, and to permit persons to whom the
+ Software is furnished to do so, subject to the following conditions:
+
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+ OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ OTHER DEALINGS IN THE SOFTWARE.
+
+*/
+
+/*
+ * libFuzzer harness for the BIP157/158 deserializers.
+ *
+ * These parse messages a peer sends us before anything has been verified,
+ * so they are the whole attacker-reachable surface of compact filter sync:
+ *
+ *   cfilter    filter_type | block_hash | var_bytes(filter)
+ *   cfheaders  filter_type | stop_hash | prev_header | vec<filter_hash>
+ *   cfcheckpt  filter_type | stop_hash | vec<filter_header>
+ *
+ * and the GCS decoder underneath them, which is the one that actually walks
+ * attacker-supplied bits: Golomb-Rice decoding accumulates deltas in a loop
+ * driven by the encoded data, so a truncated or hostile stream is the
+ * interesting case rather than a well-formed one.
+ *
+ * The first input byte selects the target so one corpus covers all four.
+ *
+ * Build:  ./configure CC=clang CFLAGS="-fsanitize=fuzzer-no-link" --enable-fuzz && make fuzz
+ * Run:    ./fuzz/fuzz_compact_filter CORPUS_DIR -max_len=100000
+ */
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+
+#include <dogecoin/dogecoin.h>
+#include <dogecoin/buffer.h>
+#include <dogecoin/compact_filter.h>
+#include <dogecoin/cstr.h>
+#include <dogecoin/golomb.h>
+#include <dogecoin/mem.h>
+#include <dogecoin/vector.h>
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    if (size < 2) return 0;
+
+    uint8_t selector = data[0];
+    /* Byte 1 feeds filter_type for the GCS case, where the value selects the
+       parameter set (M, P) and so changes how the payload is decoded. Leaving
+       it fixed would pin the fuzzer to one parameterisation. */
+    uint8_t filter_type = data[1];
+    struct const_buffer buf = { data + 2, size - 2 };
+
+    switch (selector & 0x03) {
+    case 0: {
+        dogecoin_cfilter_msg msg;
+        dogecoin_cfilter_msg_init(&msg);
+        dogecoin_p2p_msg_cfilter_deser(&msg, &buf);
+        dogecoin_cfilter_msg_free(&msg);
+        break;
+    }
+    case 1: {
+        dogecoin_cfheaders_msg msg;
+        dogecoin_cfheaders_msg_init(&msg);
+        dogecoin_p2p_msg_cfheaders_deser(&msg, &buf);
+        dogecoin_cfheaders_msg_free(&msg);
+        break;
+    }
+    case 2: {
+        dogecoin_cfcheckpt_msg msg;
+        dogecoin_cfcheckpt_msg_init(&msg);
+        dogecoin_p2p_msg_cfcheckpt_deser(&msg, &buf);
+        dogecoin_cfcheckpt_msg_free(&msg);
+        break;
+    }
+    case 3: {
+        /* GCS decode. The block hash keys the SipHash used to map elements
+           into the filter's range, so it is derived from the input rather
+           than fixed: a constant key would exercise one hash schedule only. */
+        uint256_t blockhash;
+        unsigned int i;
+        for (i = 0; i < 32; i++)
+            blockhash[i] = (uint8_t)(data[(i + 2) % size]);
+
+        gcs_filter *filter = gcs_filter_new();
+        if (filter) {
+            gcs_filter_deserialize(filter, filter_type, blockhash, &buf);
+            gcs_filter_free(filter);
+        }
+        break;
+    }
+    }
+    return 0;
+}