[WIP] Create POC for fuzzing payjoin

Cargo-minimal.lock

@@ -161,6 +161,12 @@ version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
 
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+
 [[package]]
 name = "arraydeque"
 version = "0.5.1"
@@ -2020,6 +2026,16 @@ version = "0.2.174"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
 
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5037190e1f70cbeef565bd267599242926f724d3b8a9f510fd7e0b540cfa4404"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
 [[package]]
 name = "libredox"
 version = "0.1.3"
@@ -2482,6 +2498,19 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "payjoin-fuzz"
+version = "0.0.0"
+dependencies = [
+ "bitcoin 0.32.7",
+ "bitcoin-ohttp",
+ "bitcoin_uri",
+ "libfuzzer-sys",
+ "payjoin",
+ "payjoin-test-utils",
+ "url",
+]
+
 [[package]]
 name = "payjoin-test-utils"
 version = "0.0.1"

Cargo-recent.lock

@@ -161,6 +161,12 @@ version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
 
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+
 [[package]]
 name = "arraydeque"
 version = "0.5.1"
@@ -2020,6 +2026,16 @@ version = "0.2.174"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
 
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5037190e1f70cbeef565bd267599242926f724d3b8a9f510fd7e0b540cfa4404"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
 [[package]]
 name = "libredox"
 version = "0.1.3"
@@ -2482,6 +2498,19 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "payjoin-fuzz"
+version = "0.0.0"
+dependencies = [
+ "bitcoin 0.32.7",
+ "bitcoin-ohttp",
+ "bitcoin_uri",
+ "libfuzzer-sys",
+ "payjoin",
+ "payjoin-test-utils",
+ "url",
+]
+
 [[package]]
 name = "payjoin-test-utils"
 version = "0.0.1"

Cargo.toml

@@ -1,5 +1,5 @@
 [workspace]
-members = ["payjoin", "payjoin-cli", "payjoin-directory", "payjoin-test-utils", "payjoin-ffi"]
+members = ["payjoin", "payjoin-cli", "payjoin-directory", "payjoin-test-utils", "payjoin-ffi", "fuzz"]
 resolver = "2"
 
 [patch.crates-io]

fuzz/.gitignore

@@ -0,0 +1,4 @@
+target
+corpus
+artifacts
+coverage

fuzz/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "payjoin-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[features]
+default = ["fuzzing"]
+fuzzing = []
+
+[dependencies]
+bitcoin = { version = "0.32.7", features = ["base64"] }
+bitcoin_uri = { version = "0.1.0" }
+payjoin = { version = "1.0.0-rc.0", default-features = false, features = ["_core", "v1", "v2"] }
+payjoin-test-utils = { path = "../payjoin-test-utils" }
+libfuzzer-sys = { version = "0.4.0" }
+ohttp = { package = "bitcoin-ohttp", version = "0.6.0" }
+url = { version = "2.5.4", default-features=false, features = ["serde"] }
+
+[[bin]]
+name = "uri_deserialize_pjuri"
+path = "fuzz_targets/uri/deserialize_pjuri.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "bitcoin_deserialize_psbt"
+path = "fuzz_targets/bitcoin/deserialize_psbt.rs"
+test = false
+doc = false
+bench = false

fuzz/cycle.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+# Continuously cycle over fuzz targets running each for 1 hour.
+# It uses chrt SCHED_IDLE so that other process takes priority.
+#
+# For cargo-fuzz usage see https://github.com/rust-fuzz/cargo-fuzz?tab=readme-ov-file#usage
+
+set -euo pipefail
+
+REPO_DIR=$(git rev-parse --show-toplevel)
+# can't find the file because of the ENV var
+# shellcheck source=/dev/null
+source "$REPO_DIR/fuzz/fuzz-util.sh"
+
+while :
+do
+  for targetFile in $(listTargetFiles); do
+    targetName=$(targetFileToName "$targetFile")
+    echo "Fuzzing target $targetName ($targetFile)"
+
+    # fuzz for one hour
+#    chrt -i 0 cargo +nightly fuzz run target_name -- -max_total_time=10
+    cargo +nightly fuzz run "$targetName" -- -max_total_time=10
+    # minimize the corpus
+#    chrt -i 0 cargo +nightly fuzz cmin "$targetName"
+    cargo +nightly fuzz cmin "$targetName"
+  done
+done

fuzz/fuzz-util.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# Sort order is affected by locale. See `man sort`.
+# > Set LC_ALL=C to get the traditional sort order that uses native byte values.
+export LC_ALL=C
+
+REPO_DIR=$(git rev-parse --show-toplevel)
+
+listTargetFiles() {
+  pushd "$REPO_DIR/fuzz" > /dev/null || exit 1
+  find fuzz_targets/ -type f -name "*.rs" | sort
+  popd > /dev/null || exit 1
+}
+
+targetFileToName() {
+  echo "$1" \
+    | sed 's/^fuzz_targets\///' \
+    | sed 's/\.rs$//' \
+    | sed 's/\//_/g' \
+    | sed 's/^_//g'
+}
+
+# Utility function to avoid CI failures on Windows
+checkWindowsFiles() {
+  incorrectFilenames=$(find . -type f -name "*,*" -o -name "*:*" -o -name "*<*" -o -name "*>*" -o -name "*|*" -o -name "*\?*" -o -name "*\**" -o -name "*\"*" | wc -l)
+  if [ "$incorrectFilenames" -gt 0 ]; then
+    echo "Bailing early because there is a Windows-incompatible filename in the tree."
+    exit 2
+  fi
+}
+
+# Checks whether a fuzz case has artifacts, and dumps them in hex
+checkReport() {
+  artifactDir="fuzz/artifacts/$1"
+  if [ -d "$artifactDir" ] && [ -n "$(ls -A "$artifactDir" 2>/dev/null)" ]; then
+    echo "Artifacts found for target: $1"
+    for artifact in "$artifactDir"/*; do
+      if [ -f "$artifact" ]; then
+        echo "Artifact: $(basename "$artifact")"
+        xxd -p -c10000 < "$artifact"
+      fi
+    done
+    exit 1
+  fi
+}

fuzz/fuzz.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euox pipefail
+
+REPO_DIR=$(git rev-parse --show-toplevel)
+
+# can't find the file because of the ENV var
+# shellcheck source=/dev/null
+source "$REPO_DIR/fuzz/fuzz-util.sh"
+
+# Check that input files are correct Windows file names
+checkWindowsFiles
+
+if [ -z "${1:-}" ]; then
+  targetFiles="$(listTargetFiles)"
+else
+  targetFiles=fuzz_targets/"$1".rs
+fi
+
+cargo --version
+rustc --version
+
+export HFUZZ_BUILD_ARGS="--features honggfuzz_fuzz"
+
+# Testing
+cargo install --force honggfuzz --no-default-features
+for targetFile in $targetFiles; do
+  targetName=$(targetFileToName "$targetFile")
+  echo "Fuzzing target $targetName ($targetFile)"
+  if [ -d "hfuzz_input/$targetName" ]; then
+    HFUZZ_INPUT_ARGS="-f hfuzz_input/$targetName/input"
+  else
+    HFUZZ_INPUT_ARGS=""
+  fi
+  HFUZZ_RUN_ARGS="--run_time 3600 --exit_upon_crash -v $HFUZZ_INPUT_ARGS" cargo hfuzz run "$targetName"
+
+  checkReport "$targetName"
+done

fuzz/fuzz_targets/bitcoin/deserialize_psbt.rs

@@ -0,0 +1,7 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|_data: &[u8]| {
+    // fuzzed code goes here
+});

fuzz/fuzz_targets/uri/deserialize_pjuri.rs

@@ -0,0 +1,71 @@
+#![no_main]
+
+use std::any::{Any, TypeId};
+
+use bitcoin::Amount;
+use bitcoin_uri::Param;
+use libfuzzer_sys::fuzz_target;
+use payjoin::{Uri, UriExt};
+
+fn do_test(data: &[u8]) {
+    if let Ok(uri_str) = std::str::from_utf8(data) {
+        let pj_uri = match uri_str.parse::<Uri<_>>() {
+            Ok(pj_uri) => pj_uri.assume_checked(),
+            Err(_) => return,
+        };
+        let address = pj_uri.address.is_spend_standard();
+        if !address {
+            return;
+        }
+        let amount = pj_uri.amount;
+
+        if let Some(label) = pj_uri.clone().label {
+            if TypeId::of::<Param>() != label.type_id() {
+                return;
+            }
+        };
+        if let Some(message) = pj_uri.clone().message {
+            if TypeId::of::<Param>() != message.type_id() {
+                return;
+            }
+        };
+        let extras = pj_uri.clone().check_pj_supported().unwrap().extras;
+        assert_eq!(pj_uri.to_string(), uri_str);
+        assert!(amount.is_none_or(|btc| btc < Amount::MAX_MONEY));
+        assert!(
+            TypeId::of::<payjoin::OutputSubstitution>() == extras.output_substitution().type_id()
+        );
+        assert!(TypeId::of::<String>() == extras.endpoint().type_id())
+    }
+}
+
+fuzz_target!(|data| {
+    do_test(data);
+});
+
+#[cfg(test)]
+mod tests {
+    fn extend_vec_from_hex(hex: &str, out: &mut Vec<u8>) {
+        let mut b = 0;
+        for (idx, c) in hex.as_bytes().iter().enumerate() {
+            b <<= 4;
+            match *c {
+                b'A'..=b'F' => b |= c - b'A' + 10,
+                b'a'..=b'f' => b |= c - b'a' + 10,
+                b'0'..=b'9' => b |= c - b'0',
+                _ => panic!("Bad hex"),
+            }
+            if (idx & 1) == 1 {
+                out.push(b);
+                b = 0;
+            }
+        }
+    }
+
+    #[test]
+    fn duplicate_crash() {
+        let mut a = Vec::new();
+        extend_vec_from_hex("00000000", &mut a);
+        super::do_test(&a);
+    }
+}