Line data    Source code

       1             : // Copyright (c) 2020-2021 The Bitcoin Core developers
       2             : // Distributed under the MIT software license, see the accompanying
       3             : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
       4             : 
       5             : #include <chainparams.h>
       6             : #include <key.h>
       7             : #include <psbt.h>
       8             : #include <pubkey.h>
       9             : #include <script/keyorigin.h>
      10             : #include <script/sign.h>
      11             : #include <script/signingprovider.h>
      12             : #include <streams.h>
      13             : #include <test/fuzz/FuzzedDataProvider.h>
      14             : #include <test/fuzz/fuzz.h>
      15             : #include <test/fuzz/util.h>
      16             : #include <util/chaintype.h>
      17           2 : #include <util/translation.h>
      18           2 : 
      19             : #include <cassert>
      20             : #include <cstdint>
      21             : #include <iostream>
      22             : #include <map>
      23             : #include <optional>
      24             : #include <string>
      25             : #include <vector>
      26             : 
      27           2 : void initialize_script_sign()
      28             : {
      29           0 :     ECC_Start();
      30           0 :     SelectParams(ChainType::REGTEST);
      31           0 : }
      32             : 
      33           4 : FUZZ_TARGET(script_sign, .init = initialize_script_sign)
      34             : {
      35           0 :     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
      36           0 :     const std::vector<uint8_t> key = ConsumeRandomLengthByteVector(fuzzed_data_provider, 128);
      37             : 
      38             :     {
      39           0 :         DataStream stream{ConsumeDataStream(fuzzed_data_provider)};
      40           0 :         CDataStream random_data_stream{stream, SER_NETWORK, INIT_PROTO_VERSION}; // temporary copy, to be removed along with the version flag SERIALIZE_TRANSACTION_NO_WITNESS
      41           0 :         std::map<CPubKey, KeyOriginInfo> hd_keypaths;
      42             :         try {
      43           0 :             DeserializeHDKeypaths(random_data_stream, key, hd_keypaths);
      44           0 :         } catch (const std::ios_base::failure&) {
      45           0 :         }
      46           0 :         CDataStream serialized{SER_NETWORK, PROTOCOL_VERSION};
      47           0 :         SerializeHDKeypaths(serialized, hd_keypaths, CompactSizeWriter(fuzzed_data_provider.ConsumeIntegral<uint8_t>()));
      48           0 :     }
      49             : 
      50             :     {
      51           0 :         std::map<CPubKey, KeyOriginInfo> hd_keypaths;
      52           0 :         LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
      53           0 :             const std::optional<CPubKey> pub_key = ConsumeDeserializable<CPubKey>(fuzzed_data_provider);
      54           0 :             if (!pub_key) {
      55           0 :                 break;
      56             :             }
      57           0 :             const std::optional<KeyOriginInfo> key_origin_info = ConsumeDeserializable<KeyOriginInfo>(fuzzed_data_provider);
      58           0 :             if (!key_origin_info) {
      59           0 :                 break;
      60             :             }
      61           0 :             hd_keypaths[*pub_key] = *key_origin_info;
      62           0 :         }
      63           0 :         CDataStream serialized{SER_NETWORK, PROTOCOL_VERSION};
      64             :         try {
      65           0 :             SerializeHDKeypaths(serialized, hd_keypaths, CompactSizeWriter(fuzzed_data_provider.ConsumeIntegral<uint8_t>()));
      66           0 :         } catch (const std::ios_base::failure&) {
      67           0 :         }
      68           0 :         std::map<CPubKey, KeyOriginInfo> deserialized_hd_keypaths;
      69             :         try {
      70           0 :             DeserializeHDKeypaths(serialized, key, hd_keypaths);
      71           0 :         } catch (const std::ios_base::failure&) {
      72           0 :         }
      73           0 :         assert(hd_keypaths.size() >= deserialized_hd_keypaths.size());
      74           2 :     }
      75             : 
      76             :     {
      77           0 :         SignatureData signature_data_1{ConsumeScript(fuzzed_data_provider)};
      78           0 :         SignatureData signature_data_2{ConsumeScript(fuzzed_data_provider)};
      79           0 :         signature_data_1.MergeSignatureData(signature_data_2);
      80           0 :     }
      81             : 
      82           0 :     FillableSigningProvider provider;
      83           0 :     CKey k = ConsumePrivateKey(fuzzed_data_provider);
      84           0 :     if (k.IsValid()) {
      85           0 :         provider.AddKey(k);
      86           0 :     }
      87             : 
      88             :     {
      89           0 :         const std::optional<CMutableTransaction> mutable_transaction = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
      90           0 :         const std::optional<CTxOut> tx_out = ConsumeDeserializable<CTxOut>(fuzzed_data_provider);
      91           0 :         const unsigned int n_in = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
      92           0 :         if (mutable_transaction && tx_out && mutable_transaction->vin.size() > n_in) {
      93           0 :             SignatureData signature_data_1 = DataFromTransaction(*mutable_transaction, n_in, *tx_out);
      94           0 :             CTxIn input;
      95           0 :             UpdateInput(input, signature_data_1);
      96           0 :             const CScript script = ConsumeScript(fuzzed_data_provider);
      97           0 :             SignatureData signature_data_2{script};
      98           0 :             signature_data_1.MergeSignatureData(signature_data_2);
      99           0 :         }
     100           0 :         if (mutable_transaction) {
     101           0 :             CTransaction tx_from{*mutable_transaction};
     102           0 :             CMutableTransaction tx_to;
     103           0 :             const std::optional<CMutableTransaction> opt_tx_to = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
     104           0 :             if (opt_tx_to) {
     105           0 :                 tx_to = *opt_tx_to;
     106           0 :             }
     107           0 :             CMutableTransaction script_tx_to = tx_to;
     108           0 :             CMutableTransaction sign_transaction_tx_to = tx_to;
     109           0 :             if (n_in < tx_to.vin.size() && tx_to.vin[n_in].prevout.n < tx_from.vout.size()) {
     110           0 :                 SignatureData empty;
     111           0 :                 (void)SignSignature(provider, tx_from, tx_to, n_in, fuzzed_data_provider.ConsumeIntegral<int>(), empty);
     112           0 :             }
     113           0 :             if (n_in < script_tx_to.vin.size()) {
     114           0 :                 SignatureData empty;
     115           0 :                 (void)SignSignature(provider, ConsumeScript(fuzzed_data_provider), script_tx_to, n_in, ConsumeMoney(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<int>(), empty);
     116           0 :                 MutableTransactionSignatureCreator signature_creator{tx_to, n_in, ConsumeMoney(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<int>()};
     117           0 :                 std::vector<unsigned char> vch_sig;
     118           0 :                 CKeyID address;
     119           0 :                 if (fuzzed_data_provider.ConsumeBool()) {
     120           0 :                     if (k.IsValid()) {
     121           0 :                         address = k.GetPubKey().GetID();
     122           0 :                     }
     123           0 :                 } else {
     124           0 :                     address = CKeyID{ConsumeUInt160(fuzzed_data_provider)};
     125             :                 }
     126           0 :                 (void)signature_creator.CreateSig(provider, vch_sig, address, ConsumeScript(fuzzed_data_provider), fuzzed_data_provider.PickValueInArray({SigVersion::BASE, SigVersion::WITNESS_V0}));
     127           0 :             }
     128           0 :             std::map<COutPoint, Coin> coins;
     129           0 :             LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
     130           0 :                 const std::optional<COutPoint> outpoint = ConsumeDeserializable<COutPoint>(fuzzed_data_provider);
     131           0 :                 if (!outpoint) {
     132           0 :                     break;
     133             :                 }
     134           0 :                 const std::optional<Coin> coin = ConsumeDeserializable<Coin>(fuzzed_data_provider);
     135           0 :                 if (!coin) {
     136           0 :                     break;
     137             :                 }
     138           0 :                 coins[*outpoint] = *coin;
     139           0 :             }
     140           0 :             std::map<int, bilingual_str> input_errors;
     141           0 :             (void)SignTransaction(sign_transaction_tx_to, &provider, coins, fuzzed_data_provider.ConsumeIntegral<int>(), input_errors);
     142           0 :         }
     143           0 :     }
     144             : 
     145             :     {
     146           0 :         SignatureData signature_data_1;
     147           0 :         (void)ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_1);
     148           0 :         SignatureData signature_data_2;
     149           0 :         (void)ProduceSignature(provider, DUMMY_MAXIMUM_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_2);
     150           0 :     }
     151           0 : }