Inside Bitcoin

1// Copyright (c) 2026-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#include <primitives/transaction.h>
6#include <capnp/capability.h>
7#include <capnp/rpc.h>
8#include <ipc/util.h>
9#include <kj/memory.h>
10#include <mp/proxy-io.h>
11#include <mp/proxy.h>
12#include <test/fuzz/FuzzedDataProvider.h>
13#include <test/fuzz/fuzz.h>
14#include <ipc/test/fuzz/ipc_fuzz.capnp.h>
15#include <ipc/test/fuzz/ipc_fuzz.capnp.proxy.h>
16#include <ipc/test/fuzz/ipc_fuzz.h>
17#include <test/fuzz/util.h>
18#include <test/util/setup_common.h>
19
20#include <future>
21#include <memory>
22#include <stdexcept>
23#include <thread>
24
25namespace {
26class IpcFuzzSetup
27{
28public:
29    IpcFuzzSetup()
30    {
31        std::promise<std::unique_ptr<mp::ProxyClient<test::fuzz::messages::IpcFuzzInterface>>> client_promise;
32        auto client_future{client_promise.get_future()};
33        m_loop_thread = std::thread([&client_promise] {
34            mp::EventLoop loop("ipc-fuzz", [](mp::LogMessage message) {
35                if (message.level == mp::Log::Raise) throw std::runtime_error(message.message);
36            });
37            auto pipe = loop.m_io_context.provider->newTwoWayPipe();
38
39            auto server_connection = std::make_unique<mp::Connection>(
40                loop,
41                kj::mv(pipe.ends[0]),
42                [&](mp::Connection& connection) {
43                    auto server_proxy = kj::heap<mp::ProxyServer<test::fuzz::messages::IpcFuzzInterface>>(
44                        std::make_shared<IpcFuzzImplementation>(), connection);
45                    return capnp::Capability::Client(kj::mv(server_proxy));
46                });
47            server_connection->onDisconnect([&] { server_connection.reset(); });
48
49            auto client_connection = std::make_unique<mp::Connection>(loop, kj::mv(pipe.ends[1]));
50            auto client_proxy = std::make_unique<mp::ProxyClient<test::fuzz::messages::IpcFuzzInterface>>(
51                client_connection->m_rpc_system->bootstrap(mp::ServerVatId().vat_id)
52                    .castAs<test::fuzz::messages::IpcFuzzInterface>(),
53                client_connection.get(),
54                /* destroy_connection= */ true);
55            (void)client_connection.release();
56
57            client_promise.set_value(std::move(client_proxy));
58            loop.loop();
59        });
60        m_client = client_future.get();
61    }
62
63    ~IpcFuzzSetup()
64    {
65        m_client.reset();
66        if (m_loop_thread.joinable()) m_loop_thread.join();
67    }
68
69    std::unique_ptr<mp::ProxyClient<test::fuzz::messages::IpcFuzzInterface>> m_client;
70
71private:
72    std::thread m_loop_thread;
73};
74
75static IpcFuzzSetup* g_ipc;
76
77static void initialize_ipc()
78{
79    static const auto testing_setup = MakeNoLogFileContext<>();
80    (void)testing_setup;
81
82    // Ensure the thread's ThreadContext is created before the IPC setup, so
83    // it is destroyed after it, since C++ destroys thread_local objects in
84    // reverse construction order.
85    mp::CurrentThread();
86
87    thread_local static IpcFuzzSetup ipc; // NOLINT(bitcoin-nontrivial-threadlocal)
88    g_ipc = &ipc;
89}
90
91FUZZ_TARGET(ipc, .init = initialize_ipc)
92{
93    auto& ipc = *g_ipc;
94    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
95    LIMITED_WHILE (fuzzed_data_provider.ConsumeBool(), 64) {
96        CallOneOf(
97            fuzzed_data_provider,
98            [&] {
99                static constexpr int MIN_ADD{-1'000'000};
100                static constexpr int MAX_ADD{1'000'000};
101                const int a = fuzzed_data_provider.ConsumeIntegralInRange<int>(MIN_ADD, MAX_ADD);
102                const int b = fuzzed_data_provider.ConsumeIntegralInRange<int>(MIN_ADD, MAX_ADD);
103                assert(ipc.m_client->add(a, b) == a + b);
104            },
105            [&] {
106                COutPoint outpoint{Txid::FromUint256(ConsumeUInt256(fuzzed_data_provider)),
107                                   fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
108                COutPoint expected{outpoint.hash, outpoint.n ^ 0xFFFFFFFFu};
109                assert(ipc.m_client->passOutPoint(outpoint) == expected);
110            },
111            [&] {
112                std::vector<uint8_t> value = ConsumeRandomLengthByteVector<uint8_t>(fuzzed_data_provider, 512);
113                std::vector<uint8_t> expected{value.rbegin(), value.rend()};
114                assert(ipc.m_client->passVectorUint8(value) == expected);
115            },
116            [&] {
117                CScript script{ConsumeScript(fuzzed_data_provider)};
118                CScript expected{script};
119                expected << OP_NOP;
120                assert(ipc.m_client->passScript(script) == expected);
121            },
122            [&] {
123                UniValue value;
124                if (!value.read(fuzzed_data_provider.ConsumeRandomLengthString(512))) return;
125                assert(ipc.m_client->passUniValue(value).write() == value.write());
126            },
127            [&] {
128                const CMutableTransaction mutable_tx = ConsumeTransaction(fuzzed_data_provider, std::nullopt);
129                if (mutable_tx.vin.empty()) return;
130                const CTransactionRef tx = MakeTransactionRef(mutable_tx);
131                assert(ipc.m_client->passTransaction(tx)->Equals(*tx));
132            });
133    }
134}
135} // namespace
136