Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add: FuzzVerifyReply seed #68

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

pkillarjun
Copy link
Contributor

Adding seed corpus for FuzzVerifyReply

@pkillarjun
Copy link
Contributor Author

How did i get it?

diff --git a/protocol/protocol_test.go b/protocol/protocol_test.go
index eda8453..2b4aa2c 100644
--- a/protocol/protocol_test.go
+++ b/protocol/protocol_test.go
@@ -207,6 +207,10 @@ func TestRunTestVectors(t *testing.T) {
                                if !bytes.Equal(replies[i], expectedReply) {
                                        t.Error("unexpected reply")
                                }
+                               // Print out the bytes before verification
+                               t.Logf("replyBytes=%x", replies[i])
+                               t.Logf("publicKey=%x", rootPublicKey)
+                               t.Logf("nonce=%x", requests[i].Nonce)
 
                                // Make sure the responses verify properly.
                                _, _, err = VerifyReply([]Version{responseVer}, replies[i], rootPublicKey, requests[i].Nonce)

Why is this important?

For these FP(false positive) crash, I guess.

https://oss-fuzz.com/testcase-detail/6652266200760320
https://oss-fuzz.com/testcase-detail/5822721788805120

for _, ver := range allVersions {
_, _, _ = VerifyReply([]Version{ver}, replyBytes, publicKey, nonce)
_, _, _ = VerifyReply([]Version{ver}, parts[0], parts[1], parts[2])
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does the error returned by VerifyReply should be catched and reported as t.Fatal(err)?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NO.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically, this patch isn't even needed in the first place, but it is required for OSS-Fuzz.
So, it's not an actual bug but a bug in the OSS-Fuzz infrastructure.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants