fuzz: BIP152 compact block deserializer harness (stacked on #351, #379)

CMakeLists.txt

@@ -382,6 +382,7 @@ TARGET_SOURCES(${LIBDOGECOIN_NAME} PRIVATE
     src/buffer.c
     src/chacha20.c
     src/context.c
+    src/compact_block.c
     src/cstr.c
     src/ctaes.c
     src/ecc.c
@@ -553,6 +554,7 @@ IF(USE_TESTS)
         test/block_tests.c
         test/buffer_tests.c
         test/chacha20_tests.c
+        test/compact_block_tests.c
         test/context_tests.c
         test/cstr_tests.c
         test/ecc_tests.c

Makefile.am

@@ -104,6 +104,7 @@ libdogecoin_la_SOURCES = \
     src/bip39.c \
     src/bip44.c \
     src/block.c \
+    src/compact_block.c \
     src/buffer.c \
     src/chacha20.c \
     src/context.c \
@@ -278,6 +279,7 @@ tests_SOURCES = \
     test/bip39_tests.c \
     test/bip44_tests.c \
     test/block_tests.c \
+    test/compact_block_tests.c \
     test/buffer_tests.c \
     test/chacha20_tests.c \
     test/context_tests.c \
@@ -369,6 +371,7 @@ tests_SOURCES += \
     test/raccoong_hash_vec_tests.c \
     test/raccoong_buff_mu_tests.c \
     test/raccoong_sign_tests.c \
+    test/data/auxpow_block_371338.h \
     test/data/raccoong_polyr_vectors.h \
     test/data/raccoong_ntt_vectors.h \
     test/data/raccoong_gaussian_vectors.h \
@@ -503,6 +506,13 @@ fuzz_fuzz_tx_LDADD = libdogecoin.la $(ASM_LIB_FILES)
 fuzz_fuzz_tx_CFLAGS = $(AM_CFLAGS) -fsanitize=fuzzer,address,undefined
 fuzz_fuzz_tx_LDFLAGS = -fsanitize=fuzzer,address,undefined -static
 
+noinst_PROGRAMS += fuzz/fuzz_compact_block
+fuzz_fuzz_compact_block_SOURCES = fuzz/fuzz_compact_block.c
+fuzz_fuzz_compact_block_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/include
+fuzz_fuzz_compact_block_LDADD = libdogecoin.la $(ASM_LIB_FILES)
+fuzz_fuzz_compact_block_CFLAGS = $(AM_CFLAGS) -fsanitize=fuzzer,address,undefined
+fuzz_fuzz_compact_block_LDFLAGS = -fsanitize=fuzzer,address,undefined -static
+
 noinst_PROGRAMS += fuzz/fuzz_block
 fuzz_fuzz_block_SOURCES = fuzz/fuzz_block.c
 fuzz_fuzz_block_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/include
@@ -559,7 +569,7 @@ fuzz-corpus: fuzz/seed_logdb_corpus
 	./fuzz/seed_logdb_corpus $(CORPUS)
 
 
-FUZZ_TARGETS = fuzz/fuzz_tx fuzz/fuzz_block fuzz/fuzz_wtx fuzz/fuzz_logdb fuzz/fuzz_psbt
+FUZZ_TARGETS = fuzz/fuzz_tx fuzz/fuzz_block fuzz/fuzz_wtx fuzz/fuzz_logdb fuzz/fuzz_psbt fuzz/fuzz_compact_block
 if WITH_NET
 FUZZ_TARGETS += fuzz/fuzz_protocol
 endif

fuzz/fuzz_compact_block.c

@@ -0,0 +1,109 @@
+/*
+
+ The MIT License (MIT)
+
+ Copyright (c) 2026 bluezr
+ Copyright (c) 2026 The Dogecoin Foundation
+
+ Permission is hereby granted, free of charge, to any person obtaining
+ a copy of this software and associated documentation files (the "Software"),
+ to deal in the Software without restriction, including without limitation
+ the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ and/or sell copies of the Software, and to permit persons to whom the
+ Software is furnished to do so, subject to the following conditions:
+
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+ OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ OTHER DEALINGS IN THE SOFTWARE.
+
+*/
+
+/*
+ * libFuzzer harness for the BIP152 compact block deserializers.
+ *
+ * All four parse peer-supplied bytes before any validation:
+ *
+ *   cmpctblock   header | nonce | vec<shortid[6]> | vec<prefilled txn>
+ *   getblocktxn  block_hash | vec<differentially-encoded index>
+ *   blocktxn     block_hash | vec<transaction>
+ *   sendcmpct    announce (1) | version (8)
+ *
+ * cmpctblock and getblocktxn are the interesting pair. Both carry indices that
+ * are differentially encoded, so the parser accumulates a running total from
+ * attacker-controlled deltas -- the place an overflow or an out-of-range index
+ * would come from. cmpctblock additionally interleaves prefilled transactions
+ * with short IDs, so the two vectors have to stay consistent with each other.
+ *
+ * The first input byte selects the target so one corpus covers all four.
+ *
+ * Build:  ./configure CC=clang CFLAGS="-fsanitize=fuzzer-no-link" --enable-fuzz && make fuzz
+ * Run:    ./fuzz/fuzz_compact_block CORPUS_DIR -max_len=100000
+ */
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+
+#include <dogecoin/dogecoin.h>
+#include <dogecoin/buffer.h>
+#include <dogecoin/chainparams.h>
+#include <dogecoin/compact_block.h>
+#include <dogecoin/cstr.h>
+#include <dogecoin/mem.h>
+#include <dogecoin/vector.h>
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    if (size < 1) return 0;
+
+    uint8_t selector = data[0];
+    struct const_buffer buf = { data + 1, size - 1 };
+
+    switch (selector & 0x03) {
+    /* These _free functions release the container as well as its members, so
+       the structs have to come from their paired _new rather than the stack.
+       A stack struct here is an immediate ASAN bad-free -- which is how the
+       first version of this harness failed, two executions in. */
+    case 0: {
+        dogecoin_compact_block *cmpctblk = dogecoin_compact_block_new();
+        if (cmpctblk) {
+            dogecoin_compact_block_deserialize(cmpctblk, &buf,
+                                               &dogecoin_chainparams_main);
+            dogecoin_compact_block_free(cmpctblk);
+        }
+        break;
+    }
+    case 1: {
+        dogecoin_getblocktxn *req = dogecoin_getblocktxn_new();
+        if (req) {
+            dogecoin_getblocktxn_deserialize(req, &buf);
+            dogecoin_getblocktxn_free(req);
+        }
+        break;
+    }
+    case 2: {
+        dogecoin_blocktxn *resp = dogecoin_blocktxn_new();
+        if (resp) {
+            dogecoin_blocktxn_deserialize(resp, &buf);
+            dogecoin_blocktxn_free(resp);
+        }
+        break;
+    }
+    case 3: {
+        /* Cheap by comparison, but it is the message that decides whether
+           compact blocks are enabled at all and which version is negotiated,
+           so it is worth covering rather than assuming a 9-byte parser is
+           uninteresting. */
+        dogecoin_bool high_bandwidth = false;
+        uint64_t version = 0;
+        dogecoin_p2p_msg_sendcmpct_deser(&high_bandwidth, &version, &buf);
+        break;
+    }
+    }
+    return 0;
+}