Function FUZZ_TARGET_INIT

src/test/fuzz/simplicity.cpp:76–226

#define MAX_LEN (1024 * 1024)

FUZZ_TARGET_INIT(simplicity, initialize_simplicity)
{
    const unsigned char *buf = buffer.data();

    uint32_t budget;
    uint32_t tx_data_len;
    uint32_t prog_data_len;
    uint32_t wit_data_len;

    // 1. Sanitize and parse the buffer
    if (buffer.size() < 8) {
        return;
    }
    budget = read_u32(&buf);

    tx_data_len = read_u32(&buf);
    if (tx_data_len > MAX_LEN || buffer.size() < tx_data_len + 12) {
        return;
    }
    const unsigned char *tx_data = buf;
    buf += tx_data_len;

    prog_data_len = read_u32(&buf);
    if (prog_data_len > MAX_LEN || buffer.size() < tx_data_len + prog_data_len + 16) {
        return;
    }
    const unsigned char *prog_data = buf;
    buf += prog_data_len;

    wit_data_len = read_u32(&buf);
    if (wit_data_len > MAX_LEN || buffer.size() != tx_data_len + prog_data_len + wit_data_len + 16) {
        return;
    }
    const unsigned char *wit_data = buf;

    //printf("OK going\n");

    // 2. Parse the transaction (the program and witness are just raw bytes)
    CMutableTransaction mtx;
    CDataStream txds{Span{tx_data, tx_data_len}, SER_NETWORK, INIT_PROTO_VERSION};
    try {
        txds >> mtx;
        mtx.witness.vtxinwit.resize(mtx.vin.size());
        mtx.witness.vtxoutwit.resize(mtx.vout.size());

        // We use the first vin as a "random oracle" rather than reading more from
        // the fuzzer, because we want our fuzz seeds to have as simple a structure
        // as possible. This means we must reject 0-input transactions, which are
        // invalid on-chain anyway.
        if (mtx.vin.size() == 0) {
            return;
        }

        // This is an assertion in the Simplicity interpreter. It is guaranteed
        // to hold for anything on the network since (even if validatepegin is off)
        // pegins are validated for well-formedness long before the script interpreter
        // is invoked. But in this code we just call the interpreter directly without
        // these checks.