Inside Bitcoin
Opening the selected file…
Inside Bitcoin
Opening the selected file…
The code behind the network, with room to understand it.
Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.
1// Copyright (c) 2020-present The Bitcoin Core developers2// Distributed under the MIT software license, see the accompanying3// file COPYING or http://www.opensource.org/licenses/mit-license.php.5#include <chainparams.h>6#include <key.h>7#include <psbt.h>8#include <pubkey.h>9#include <script/keyorigin.h>10#include <script/sign.h>11#include <script/signingprovider.h>12#include <streams.h>13#include <test/fuzz/FuzzedDataProvider.h>14#include <test/fuzz/fuzz.h>15#include <test/fuzz/util.h>16#include <test/util/transaction_utils.h>17#include <util/chaintype.h>18#include <util/translation.h>20#include <cassert>21#include <cstdint>22#include <iostream>23#include <map>24#include <optional>25#include <string>26#include <vector>28void initialize_script_sign()29{30static ECC_Context ecc_context{};31SelectParams(ChainType::REGTEST);32}34FUZZ_TARGET(script_sign, .init = initialize_script_sign)35{36FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());37const std::vector<uint8_t> key = ConsumeRandomLengthByteVector(fuzzed_data_provider, 128);39{40DataStream random_data_stream{ConsumeDataStream(fuzzed_data_provider)};41std::map<CPubKey, KeyOriginInfo> hd_keypaths;42try {43DeserializeHDKeypaths(random_data_stream, key, hd_keypaths);44} catch (const std::ios_base::failure&) {45}46DataStream serialized{};47SerializeHDKeypaths(serialized, hd_keypaths, CompactSizeWriter(fuzzed_data_provider.ConsumeIntegral<uint8_t>()));48}50{51std::map<CPubKey, KeyOriginInfo> hd_keypaths;52LIMITED_WHILE (fuzzed_data_provider.ConsumeBool(), 10000) {53const std::optional<CPubKey> pub_key = ConsumeDeserializable<CPubKey>(fuzzed_data_provider);54if (!pub_key) {55break;56}57const std::optional<KeyOriginInfo> key_origin_info = ConsumeDeserializable<KeyOriginInfo>(fuzzed_data_provider);58if (!key_origin_info) {59break;60}61hd_keypaths[*pub_key] = *key_origin_info;62}63DataStream serialized{};64try {65SerializeHDKeypaths(serialized, hd_keypaths, CompactSizeWriter(fuzzed_data_provider.ConsumeIntegral<uint8_t>()));66} catch (const std::ios_base::failure&) {67}68std::map<CPubKey, KeyOriginInfo> deserialized_hd_keypaths;69try {70DeserializeHDKeypaths(serialized, key, deserialized_hd_keypaths);71} catch (const std::ios_base::failure&) {72}73assert(hd_keypaths.size() >= deserialized_hd_keypaths.size());74}76{77SignatureData signature_data_1{ConsumeScript(fuzzed_data_provider)};78SignatureData signature_data_2{ConsumeScript(fuzzed_data_provider)};79signature_data_1.MergeSignatureData(signature_data_2);80}82FillableSigningProvider provider;83CKey k = ConsumePrivateKey(fuzzed_data_provider);84if (k.IsValid()) {85provider.AddKey(k);86}88{89const std::optional<CMutableTransaction> mutable_transaction = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider, TX_WITH_WITNESS);90const std::optional<CTxOut> tx_out = ConsumeDeserializable<CTxOut>(fuzzed_data_provider);91const unsigned int n_in = fuzzed_data_provider.ConsumeIntegral<unsigned int>();92if (mutable_transaction && tx_out && mutable_transaction->vin.size() > n_in) {93SignatureData signature_data_1 = DataFromTransaction(*mutable_transaction, n_in, *tx_out);94CTxIn input;95UpdateInput(input, signature_data_1);96const CScript script = ConsumeScript(fuzzed_data_provider);97SignatureData signature_data_2{script};98signature_data_1.MergeSignatureData(signature_data_2);99}100if (mutable_transaction) {101CTransaction tx_from{*mutable_transaction};102CMutableTransaction tx_to;103const std::optional<CMutableTransaction> opt_tx_to = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider, TX_WITH_WITNESS);104if (opt_tx_to) {105tx_to = *opt_tx_to;106}107CMutableTransaction script_tx_to = tx_to;108CMutableTransaction sign_transaction_tx_to = tx_to;109if (n_in < tx_to.vin.size() && tx_to.vin[n_in].prevout.n < tx_from.vout.size()) {110SignatureData empty;111(void)SignSignature(provider, tx_from, tx_to, n_in, fuzzed_data_provider.ConsumeIntegral<int>(), empty);112}113if (n_in < script_tx_to.vin.size()) {114SignatureData empty;115auto from_pub_key = ConsumeScript(fuzzed_data_provider);116auto amount = ConsumeMoney(fuzzed_data_provider);117auto n_hash_type = fuzzed_data_provider.ConsumeIntegral<int>();118(void)SignSignature(provider, from_pub_key, script_tx_to, n_in, amount, n_hash_type, empty);119MutableTransactionSignatureCreator signature_creator{tx_to, n_in, ConsumeMoney(fuzzed_data_provider), {.sighash_type = fuzzed_data_provider.ConsumeIntegral<int>()}};120std::vector<unsigned char> vch_sig;121CKeyID address;122if (fuzzed_data_provider.ConsumeBool()) {123if (k.IsValid()) {124address = k.GetPubKey().GetID();125}126} else {127address = CKeyID{ConsumeUInt160(fuzzed_data_provider)};128}129auto script_code = ConsumeScript(fuzzed_data_provider);130auto sigversion = fuzzed_data_provider.PickValueInArray({SigVersion::BASE, SigVersion::WITNESS_V0});131(void)signature_creator.CreateSig(provider, vch_sig, address, script_code, sigversion);132}133std::map<COutPoint, Coin> coins{ConsumeCoins(fuzzed_data_provider)};134std::map<int, bilingual_str> input_errors;135(void)SignTransaction(sign_transaction_tx_to, &provider, coins, {.sighash_type = fuzzed_data_provider.ConsumeIntegral<int>()}, input_errors);136}137}139{140SignatureData signature_data_1;141(void)ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_1);142SignatureData signature_data_2;143(void)ProduceSignature(provider, DUMMY_MAXIMUM_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_2);144}145}
Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.
Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.