From 09825e4678dee7a8527ce71bbb6b6cd169ddc892 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Tue, 14 Jun 2022 11:58:32 +0530
Subject: [PATCH 01/13] merge bitcoin#18867: Add fuzzing harness for
 CCoinsViewCache

---
 src/Makefile.test.include    |   7 +
 src/test/fuzz/coins_view.cpp | 291 +++++++++++++++++++++++++++++++++++
 src/test/fuzz/util.h         |  12 ++
 3 files changed, 310 insertions(+)
 create mode 100644 src/test/fuzz/coins_view.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index a76e31de2e..9c22e5d5c8 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -32,6 +32,7 @@ FUZZ_TARGETS = \
   test/fuzz/bloomfilter_deserialize \
   test/fuzz/checkqueue \
   test/fuzz/coins_deserialize \
+  test/fuzz/coins_view \
   test/fuzz/cuckoocache \
   test/fuzz/decode_tx \
   test/fuzz/descriptor_parse \
@@ -454,6 +455,12 @@ test_fuzz_coins_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_coins_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_coins_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
 
+test_fuzz_coins_view_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_coins_view_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_coins_view_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_coins_view_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_coins_view_SOURCES = $(FUZZ_SUITE) test/fuzz/coins_view.cpp
+
 test_fuzz_cuckoocache_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
 test_fuzz_cuckoocache_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_cuckoocache_LDADD = $(FUZZ_SUITE_LD_COMMON)
diff --git a/src/test/fuzz/coins_view.cpp b/src/test/fuzz/coins_view.cpp
new file mode 100644
index 0000000000..c62767f0e1
--- /dev/null
+++ b/src/test/fuzz/coins_view.cpp
@@ -0,0 +1,291 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <amount.h>
+#include <chainparams.h>
+#include <chainparamsbase.h>
+#include <coins.h>
+#include <consensus/tx_verify.h>
+#include <consensus/validation.h>
+#include <key.h>
+#include <node/coinstats.h>
+#include <policy/policy.h>
+#include <primitives/transaction.h>
+#include <pubkey.h>
+#include <sync.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+#include <validation.h>
+
+#include <cstdint>
+#include <limits>
+#include <optional>
+#include <string>
+#include <vector>
+
+namespace {
+const Coin EMPTY_COIN{};
+
+bool operator==(const Coin& a, const Coin& b)
+{
+    if (a.IsSpent() && b.IsSpent()) return true;
+    return a.fCoinBase == b.fCoinBase && a.nHeight == b.nHeight && a.out == b.out;
+}
+} // namespace
+
+void initialize()
+{
+    static const ECCVerifyHandle ecc_verify_handle;
+    ECC_Start();
+    SelectParams(CBaseChainParams::REGTEST);
+}
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
+    CCoinsView backend_coins_view;
+    CCoinsViewCache coins_view_cache{&backend_coins_view};
+    COutPoint random_out_point;
+    Coin random_coin;
+    CMutableTransaction random_mutable_transaction;
+    while (fuzzed_data_provider.ConsumeBool()) {
+        switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 9)) {
+        case 0: {
+            if (random_coin.IsSpent()) {
+                break;
+            }
+            Coin coin = random_coin;
+            bool expected_code_path = false;
+            const bool possible_overwrite = fuzzed_data_provider.ConsumeBool();
+            try {
+                coins_view_cache.AddCoin(random_out_point, std::move(coin), possible_overwrite);
+                expected_code_path = true;
+            } catch (const std::logic_error& e) {
+                if (e.what() == std::string{"Attempted to overwrite an unspent coin (when possible_overwrite is false)"}) {
+                    assert(!possible_overwrite);
+                    expected_code_path = true;
+                }
+            }
+            assert(expected_code_path);
+            break;
+        }
+        case 1: {
+            (void)coins_view_cache.Flush();
+            break;
+        }
+        case 2: {
+            coins_view_cache.SetBestBlock(ConsumeUInt256(fuzzed_data_provider));
+            break;
+        }
+        case 3: {
+            Coin move_to;
+            (void)coins_view_cache.SpendCoin(random_out_point, fuzzed_data_provider.ConsumeBool() ? &move_to : nullptr);
+            break;
+        }
+        case 4: {
+            coins_view_cache.Uncache(random_out_point);
+            break;
+        }
+        case 5: {
+            if (fuzzed_data_provider.ConsumeBool()) {
+                backend_coins_view = CCoinsView{};
+            }
+            coins_view_cache.SetBackend(backend_coins_view);
+            break;
+        }
+        case 6: {
+            const std::optional<COutPoint> opt_out_point = ConsumeDeserializable<COutPoint>(fuzzed_data_provider);
+            if (!opt_out_point) {
+                break;
+            }
+            random_out_point = *opt_out_point;
+            break;
+        }
+        case 7: {
+            const std::optional<Coin> opt_coin = ConsumeDeserializable<Coin>(fuzzed_data_provider);
+            if (!opt_coin) {
+                break;
+            }
+            random_coin = *opt_coin;
+            break;
+        }
+        case 8: {
+            const std::optional<CMutableTransaction> opt_mutable_transaction = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
+            if (!opt_mutable_transaction) {
+                break;
+            }
+            random_mutable_transaction = *opt_mutable_transaction;
+            break;
+        }
+        case 9: {
+            CCoinsMap coins_map;
+            while (fuzzed_data_provider.ConsumeBool()) {
+                CCoinsCacheEntry coins_cache_entry;
+                coins_cache_entry.flags = fuzzed_data_provider.ConsumeIntegral<unsigned char>();
+                if (fuzzed_data_provider.ConsumeBool()) {
+                    coins_cache_entry.coin = random_coin;
+                } else {
+                    const std::optional<Coin> opt_coin = ConsumeDeserializable<Coin>(fuzzed_data_provider);
+                    if (!opt_coin) {
+                        break;
+                    }
+                    coins_cache_entry.coin = *opt_coin;
+                }
+                coins_map.emplace(random_out_point, std::move(coins_cache_entry));
+            }
+            bool expected_code_path = false;
+            try {
+                coins_view_cache.BatchWrite(coins_map, fuzzed_data_provider.ConsumeBool() ? ConsumeUInt256(fuzzed_data_provider) : coins_view_cache.GetBestBlock());
+                expected_code_path = true;
+            } catch (const std::logic_error& e) {
+                if (e.what() == std::string{"FRESH flag misapplied to coin that exists in parent cache"}) {
+                    expected_code_path = true;
+                }
+            }
+            assert(expected_code_path);
+            break;
+        }
+        }
+    }
+
+    {
+        const Coin& coin_using_access_coin = coins_view_cache.AccessCoin(random_out_point);
+        const bool exists_using_access_coin = !(coin_using_access_coin == EMPTY_COIN);
+        const bool exists_using_have_coin = coins_view_cache.HaveCoin(random_out_point);
+        const bool exists_using_have_coin_in_cache = coins_view_cache.HaveCoinInCache(random_out_point);
+        Coin coin_using_get_coin;
+        const bool exists_using_get_coin = coins_view_cache.GetCoin(random_out_point, coin_using_get_coin);
+        if (exists_using_get_coin) {
+            assert(coin_using_get_coin == coin_using_access_coin);
+        }
+        assert((exists_using_access_coin && exists_using_have_coin_in_cache && exists_using_have_coin && exists_using_get_coin) ||
+               (!exists_using_access_coin && !exists_using_have_coin_in_cache && !exists_using_have_coin && !exists_using_get_coin));
+        const bool exists_using_have_coin_in_backend = backend_coins_view.HaveCoin(random_out_point);
+        if (exists_using_have_coin_in_backend) {
+            assert(exists_using_have_coin);
+        }
+        Coin coin_using_backend_get_coin;
+        if (backend_coins_view.GetCoin(random_out_point, coin_using_backend_get_coin)) {
+            assert(exists_using_have_coin_in_backend);
+            assert(coin_using_get_coin == coin_using_backend_get_coin);
+        } else {
+            assert(!exists_using_have_coin_in_backend);
+        }
+    }
+
+    {
+        bool expected_code_path = false;
+        try {
+            (void)coins_view_cache.Cursor();
+        } catch (const std::logic_error&) {
+            expected_code_path = true;
+        }
+        assert(expected_code_path);
+        (void)coins_view_cache.DynamicMemoryUsage();
+        (void)coins_view_cache.EstimateSize();
+        (void)coins_view_cache.GetBestBlock();
+        (void)coins_view_cache.GetCacheSize();
+        (void)coins_view_cache.GetHeadBlocks();
+        (void)coins_view_cache.HaveInputs(CTransaction{random_mutable_transaction});
+    }
+
+    {
+        const CCoinsViewCursor* coins_view_cursor = backend_coins_view.Cursor();
+        assert(coins_view_cursor == nullptr);
+        (void)backend_coins_view.EstimateSize();
+        (void)backend_coins_view.GetBestBlock();
+        (void)backend_coins_view.GetHeadBlocks();
+    }
+
+    if (fuzzed_data_provider.ConsumeBool()) {
+        switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 5)) {
+        case 0: {
+            const CTransaction transaction{random_mutable_transaction};
+            bool is_spent = false;
+            for (const CTxOut& tx_out : transaction.vout) {
+                if (Coin{tx_out, 0, transaction.IsCoinBase()}.IsSpent()) {
+                    is_spent = true;
+                }
+            }
+            if (is_spent) {
+                // Avoid:
+                // coins.cpp:69: void CCoinsViewCache::AddCoin(const COutPoint &, Coin &&, bool): Assertion `!coin.IsSpent()' failed.
+                break;
+            }
+            bool expected_code_path = false;
+            const int height = fuzzed_data_provider.ConsumeIntegral<int>();
+            const bool possible_overwrite = fuzzed_data_provider.ConsumeBool();
+            try {
+                AddCoins(coins_view_cache, transaction, height, possible_overwrite);
+                expected_code_path = true;
+            } catch (const std::logic_error& e) {
+                if (e.what() == std::string{"Attempted to overwrite an unspent coin (when possible_overwrite is false)"}) {
+                    assert(!possible_overwrite);
+                    expected_code_path = true;
+                }
+            }
+            assert(expected_code_path);
+            break;
+        }
+        case 1: {
+            (void)AreInputsStandard(CTransaction{random_mutable_transaction}, coins_view_cache);
+            break;
+        }
+        case 2: {
+            CValidationState state;
+            CAmount tx_fee_out;
+            const CTransaction transaction{random_mutable_transaction};
+            if (ContainsSpentInput(transaction, coins_view_cache)) {
+                // Avoid:
+                // consensus/tx_verify.cpp:171: bool Consensus::CheckTxInputs(const CTransaction &, CValidationState &, const CCoinsViewCache &, int, CAmount &): Assertion `!coin.IsSpent()' failed.
+                break;
+            }
+            try {
+                (void)Consensus::CheckTxInputs(transaction, state, coins_view_cache, fuzzed_data_provider.ConsumeIntegralInRange<int>(0, std::numeric_limits<int>::max()), tx_fee_out);
+                assert(MoneyRange(tx_fee_out));
+            } catch (const std::runtime_error&) {
+            }
+            break;
+        }
+        case 3: {
+            const CTransaction transaction{random_mutable_transaction};
+            if (ContainsSpentInput(transaction, coins_view_cache)) {
+                // Avoid:
+                // consensus/tx_verify.cpp:130: unsigned int GetP2SHSigOpCount(const CTransaction &, const CCoinsViewCache &): Assertion `!coin.IsSpent()' failed.
+                break;
+            }
+            (void)GetP2SHSigOpCount(transaction, coins_view_cache);
+            break;
+        }
+        case 4: {
+            const CTransaction transaction{random_mutable_transaction};
+            if (ContainsSpentInput(transaction, coins_view_cache)) {
+                // Avoid:
+                // consensus/tx_verify.cpp:130: unsigned int GetP2SHSigOpCount(const CTransaction &, const CCoinsViewCache &): Assertion `!coin.IsSpent()' failed.
+                break;
+            }
+            const int flags = fuzzed_data_provider.ConsumeIntegral<int>();
+            if (!transaction.vin.empty() && (flags & SCRIPT_VERIFY_P2SH) == 0) {
+                // Avoid:
+                // script/interpreter.cpp:1705: size_t CountWitnessSigOps(const CScript &, const CScript &, const CScriptWitness *, unsigned int): Assertion `(flags & SCRIPT_VERIFY_P2SH) != 0' failed.
+                break;
+            }
+            (void)GetTransactionSigOpCount(transaction, coins_view_cache, flags);
+            break;
+        }
+        case 5: {
+            CCoinsStats stats;
+            bool expected_code_path = false;
+            try {
+                (void)GetUTXOStats(&coins_view_cache, stats, CoinStatsHashType::HASH_SERIALIZED);
+            } catch (const std::logic_error&) {
+                expected_code_path = true;
+            }
+            assert(expected_code_path);
+            break;
+        }
+        }
+    }
+}
diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h
index a18b91eb5d..699c999534 100644
--- a/src/test/fuzz/util.h
+++ b/src/test/fuzz/util.h
@@ -8,6 +8,7 @@
 #include <amount.h>
 #include <arith_uint256.h>
 #include <attributes.h>
+#include <coins.h>
 #include <optional.h>
 #include <script/script.h>
 #include <serialize.h>
@@ -132,4 +133,15 @@ template <class T>
     return std::numeric_limits<T>::max() - i < j;
 }
 
+[[ nodiscard ]] inline bool ContainsSpentInput(const CTransaction& tx, const CCoinsViewCache& inputs) noexcept
+{
+    for (const CTxIn& tx_in : tx.vin) {
+        const Coin& coin = inputs.AccessCoin(tx_in.prevout);
+        if (coin.IsSpent()) {
+            return true;
+        }
+    }
+    return false;
+}
+
 #endif // BITCOIN_TEST_FUZZ_UTIL_H

From 0d5a7929acf5920399ce54055209e22032c91498 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Sat, 7 May 2022 13:39:56 +0530
Subject: [PATCH 02/13] partial bitcoin#18047: Add basic fuzzing harness for
 CNetAddr/CService/CSubNet related functions (netaddress.h)

---
 src/Makefile.test.include    |   7 ++
 src/test/fuzz/netaddress.cpp | 120 +++++++++++++++++++++++++++++++++++
 test/fuzz/test_runner.py     |   1 +
 3 files changed, 128 insertions(+)
 create mode 100644 src/test/fuzz/netaddress.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 9c22e5d5c8..be14d86ea9 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -56,6 +56,7 @@ FUZZ_TARGETS = \
   test/fuzz/multiplication_overflow \
   test/fuzz/net_permissions \
   test/fuzz/netaddr_deserialize \
+  test/fuzz/netaddress \
   test/fuzz/out_point_deserialize \
   test/fuzz/p2p_transport_deserializer \
   test/fuzz/parse_hd_keypath \
@@ -599,6 +600,12 @@ test_fuzz_netaddr_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_netaddr_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_netaddr_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
 
+test_fuzz_netaddress_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_netaddress_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_netaddress_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_netaddress_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_netaddress_SOURCES = $(FUZZ_SUITE) test/fuzz/netaddress.cpp
+
 test_fuzz_out_point_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DOUT_POINT_DESERIALIZE=1
 test_fuzz_out_point_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_out_point_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
diff --git a/src/test/fuzz/netaddress.cpp b/src/test/fuzz/netaddress.cpp
new file mode 100644
index 0000000000..919987e80e
--- /dev/null
+++ b/src/test/fuzz/netaddress.cpp
@@ -0,0 +1,120 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <netaddress.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+
+#include <cassert>
+#include <cstdint>
+#include <netinet/in.h>
+#include <vector>
+
+namespace {
+CNetAddr ConsumeNetAddr(FuzzedDataProvider& fuzzed_data_provider) noexcept
+{
+    const Network network = fuzzed_data_provider.PickValueInArray({Network::NET_IPV4, Network::NET_IPV6, Network::NET_INTERNAL, Network::NET_ONION});
+    if (network == Network::NET_IPV4) {
+        const in_addr v4_addr = {
+            .s_addr = fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
+        return CNetAddr{v4_addr};
+    } else if (network == Network::NET_IPV6) {
+        if (fuzzed_data_provider.remaining_bytes() < 16) {
+            return CNetAddr{};
+        }
+        in6_addr v6_addr = {};
+        memcpy(v6_addr.s6_addr, fuzzed_data_provider.ConsumeBytes<uint8_t>(16).data(), 16);
+        return CNetAddr{v6_addr, fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
+    } else if (network == Network::NET_INTERNAL) {
+        CNetAddr net_addr;
+        net_addr.SetInternal(fuzzed_data_provider.ConsumeBytesAsString(32));
+        return net_addr;
+    } else if (network == Network::NET_ONION) {
+        CNetAddr net_addr;
+        net_addr.SetSpecial(fuzzed_data_provider.ConsumeBytesAsString(32));
+        return net_addr;
+    } else {
+        assert(false);
+    }
+}
+}; // namespace
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+
+    const CNetAddr net_addr = ConsumeNetAddr(fuzzed_data_provider);
+    (void)net_addr.GetHash();
+    (void)net_addr.GetNetClass();
+    if (net_addr.GetNetwork() == Network::NET_IPV4) {
+        assert(net_addr.IsIPv4());
+    }
+    if (net_addr.GetNetwork() == Network::NET_IPV6) {
+        assert(net_addr.IsIPv6());
+    }
+    if (net_addr.GetNetwork() == Network::NET_ONION) {
+        assert(net_addr.IsTor());
+    }
+    if (net_addr.GetNetwork() == Network::NET_INTERNAL) {
+        assert(net_addr.IsInternal());
+    }
+    if (net_addr.GetNetwork() == Network::NET_UNROUTABLE) {
+        assert(!net_addr.IsRoutable());
+    }
+    (void)net_addr.IsBindAny();
+    if (net_addr.IsInternal()) {
+        assert(net_addr.GetNetwork() == Network::NET_INTERNAL);
+    }
+    if (net_addr.IsIPv4()) {
+        assert(net_addr.GetNetwork() == Network::NET_IPV4 || net_addr.GetNetwork() == Network::NET_UNROUTABLE);
+    }
+    if (net_addr.IsIPv6()) {
+        assert(net_addr.GetNetwork() == Network::NET_IPV6 || net_addr.GetNetwork() == Network::NET_UNROUTABLE);
+    }
+    (void)net_addr.IsLocal();
+    if (net_addr.IsRFC1918() || net_addr.IsRFC2544() || net_addr.IsRFC6598() || net_addr.IsRFC5737() || net_addr.IsRFC3927()) {
+        assert(net_addr.IsIPv4());
+    }
+    (void)net_addr.IsRFC2544();
+    if (net_addr.IsRFC3849() || net_addr.IsRFC3964() || net_addr.IsRFC4380() || net_addr.IsRFC4843() || net_addr.IsRFC7343() || net_addr.IsRFC4862() || net_addr.IsRFC6052() || net_addr.IsRFC6145()) {
+        assert(net_addr.IsIPv6());
+    }
+    (void)net_addr.IsRFC3927();
+    (void)net_addr.IsRFC3964();
+    if (net_addr.IsRFC4193()) {
+        assert(net_addr.GetNetwork() == Network::NET_ONION || net_addr.GetNetwork() == Network::NET_INTERNAL || net_addr.GetNetwork() == Network::NET_UNROUTABLE);
+    }
+    (void)net_addr.IsRFC4380();
+    (void)net_addr.IsRFC4843();
+    (void)net_addr.IsRFC4862();
+    (void)net_addr.IsRFC5737();
+    (void)net_addr.IsRFC6052();
+    (void)net_addr.IsRFC6145();
+    (void)net_addr.IsRFC6598();
+    (void)net_addr.IsRFC7343();
+    if (!net_addr.IsRoutable()) {
+        assert(net_addr.GetNetwork() == Network::NET_UNROUTABLE || net_addr.GetNetwork() == Network::NET_INTERNAL);
+    }
+    if (net_addr.IsTor()) {
+        assert(net_addr.GetNetwork() == Network::NET_ONION);
+    }
+    (void)net_addr.IsValid();
+    (void)net_addr.ToString();
+    (void)net_addr.ToStringIP();
+
+    const CSubNet sub_net{net_addr, fuzzed_data_provider.ConsumeIntegral<uint8_t>()};
+    (void)sub_net.IsValid();
+    (void)sub_net.ToString();
+
+    const CService service{net_addr, fuzzed_data_provider.ConsumeIntegral<uint16_t>()};
+    (void)service.GetKey();
+    (void)service.GetPort();
+    (void)service.ToString();
+    (void)service.ToStringIPPort();
+    (void)service.ToStringPort();
+
+    const CNetAddr other_net_addr = ConsumeNetAddr(fuzzed_data_provider);
+    (void)net_addr.GetReachabilityFrom(&other_net_addr);
+    (void)sub_net.Match(other_net_addr);
+}
diff --git a/test/fuzz/test_runner.py b/test/fuzz/test_runner.py
index f156bf50d3..f05f732ebd 100755
--- a/test/fuzz/test_runner.py
+++ b/test/fuzz/test_runner.py
@@ -33,6 +33,7 @@ FUZZERS_MISSING_CORPORA = [
     "key_origin_info_deserialize",
     "locale",
     "merkle_block_deserialize",
+    "netaddress",
     "out_point_deserialize",
     "p2p_transport_deserializer",
     "parse_hd_keypath",

From a7109d8724e798840ea398f5e09be5e83ecbcaf9 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Wed, 13 Jul 2022 19:42:55 +0530
Subject: [PATCH 03/13] partial bitcoin#18314: Add deserialization fuzzing of
 SnapshotMetadata (utxo_snapshot). Increase fuzzing coverage

---
 src/Makefile.test.include            | 16 +++++++++++++++-
 src/test/fuzz/base_encode_decode.cpp |  6 ++++++
 src/test/fuzz/block.cpp              |  6 ++++--
 src/test/fuzz/descriptor_parse.cpp   |  2 +-
 src/test/fuzz/deserialize.cpp        | 14 +++++++++++++-
 src/test/fuzz/eval_script.cpp        |  2 +-
 src/test/fuzz/hex.cpp                |  7 +++++++
 src/test/fuzz/integer.cpp            |  7 +++++++
 src/test/fuzz/netaddress.cpp         | 11 +++++++++++
 src/test/fuzz/parse_univalue.cpp     | 18 ++++++++++++++++--
 src/test/fuzz/script.cpp             | 21 +++++++++++++--------
 src/test/fuzz/script_flags.cpp       |  2 +-
 src/test/fuzz/transaction.cpp        |  2 ++
 13 files changed, 97 insertions(+), 17 deletions(-)

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index be14d86ea9..9342ecddee 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -93,7 +93,9 @@ FUZZ_TARGETS = \
   test/fuzz/tx_in_deserialize \
   test/fuzz/tx_out \
   test/fuzz/txoutcompressor_deserialize \
-  test/fuzz/txundo_deserialize
+  test/fuzz/txundo_deserialize \
+  test/fuzz/uint160_deserialize \
+  test/fuzz/uint256_deserialize
 
 if ENABLE_FUZZ
 noinst_PROGRAMS += $(FUZZ_TARGETS:=)
@@ -827,6 +829,18 @@ test_fuzz_txundo_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_txundo_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_txundo_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_txundo_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
+
+test_fuzz_uint160_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DUINT160_DESERIALIZE=1
+test_fuzz_uint160_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_uint160_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_uint160_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_uint160_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
+
+test_fuzz_uint256_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DUINT256_DESERIALIZE=1
+test_fuzz_uint256_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_uint256_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_uint256_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_uint256_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
 endif # ENABLE_FUZZ
 
 nodist_test_test_dash_SOURCES = $(GENERATED_TEST_FILES)
diff --git a/src/test/fuzz/base_encode_decode.cpp b/src/test/fuzz/base_encode_decode.cpp
index 555865c1b6..b35bc2f8a5 100644
--- a/src/test/fuzz/base_encode_decode.cpp
+++ b/src/test/fuzz/base_encode_decode.cpp
@@ -5,6 +5,8 @@
 #include <test/fuzz/fuzz.h>
 
 #include <base58.h>
+#include <core_io.h>
+#include <psbt.h>
 #include <util/string.h>
 #include <util/strencodings.h>
 
@@ -44,4 +46,8 @@ void test_one_input(const std::vector<uint8_t>& buffer)
         assert(encoded_string == TrimString(encoded_string));
         assert(ToLower(encoded_string) == ToLower(TrimString(random_encoded_string)));
     }
+
+    PartiallySignedTransaction psbt;
+    std::string error;
+    (void)DecodeBase64PSBT(psbt, random_encoded_string, error);
 }
diff --git a/src/test/fuzz/block.cpp b/src/test/fuzz/block.cpp
index 3a93837548..0aeb0243cf 100644
--- a/src/test/fuzz/block.cpp
+++ b/src/test/fuzz/block.cpp
@@ -19,7 +19,7 @@
 
 void initialize()
 {
-    const static auto verify_handle = MakeUnique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
     SelectParams(CBaseChainParams::REGTEST);
 }
 
@@ -52,5 +52,7 @@ void test_one_input(const std::vector<uint8_t>& buffer)
     (void)block.GetHash();
     (void)block.ToString();
     (void)BlockMerkleRoot(block);
-    (void)RecursiveDynamicUsage(block);
+    const size_t raw_memory_size = RecursiveDynamicUsage(block);
+    const size_t raw_memory_size_as_shared_ptr = RecursiveDynamicUsage(std::make_shared<CBlock>(block));
+    assert(raw_memory_size_as_shared_ptr > raw_memory_size);
 }
diff --git a/src/test/fuzz/descriptor_parse.cpp b/src/test/fuzz/descriptor_parse.cpp
index 83b41d5a32..34c428a87e 100644
--- a/src/test/fuzz/descriptor_parse.cpp
+++ b/src/test/fuzz/descriptor_parse.cpp
@@ -12,7 +12,7 @@
 
 void initialize()
 {
-    static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
     SelectParams(CBaseChainParams::REGTEST);
 }
 
diff --git a/src/test/fuzz/deserialize.cpp b/src/test/fuzz/deserialize.cpp
index 91c227d0aa..d287ff21b5 100644
--- a/src/test/fuzz/deserialize.cpp
+++ b/src/test/fuzz/deserialize.cpp
@@ -34,7 +34,7 @@
 void initialize()
 {
     // Fuzzers using pubkey must hold an ECCVerifyHandle.
-    static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
 }
 
 namespace {
@@ -220,9 +220,21 @@ void test_one_input(const std::vector<uint8_t>& buffer)
 #elif BLOCKTRANSACTIONSREQUEST_DESERIALIZE
         BlockTransactionsRequest btr;
         DeserializeFromFuzzingInput(buffer, btr);
+#elif UINT160_DESERIALIZE
+        uint160 u160;
+        DeserializeFromFuzzingInput(buffer, u160);
+        AssertEqualAfterSerializeDeserialize(u160);
+#elif UINT256_DESERIALIZE
+        uint256 u256;
+        DeserializeFromFuzzingInput(buffer, u256);
+        AssertEqualAfterSerializeDeserialize(u256);
 #else
 #error Need at least one fuzz target to compile
 #endif
+        // Classes intentionally not covered in this file since their deserialization code is
+        // fuzzed elsewhere:
+        // * Deserialization of CTxOut is fuzzed in test/fuzz/tx_out.cpp
+        // * Deserialization of CMutableTransaction is fuzzed in src/test/fuzz/transaction.cpp
     } catch (const invalid_fuzzing_input_exception&) {
     }
 }
diff --git a/src/test/fuzz/eval_script.cpp b/src/test/fuzz/eval_script.cpp
index f129ba4e28..45d72f7ac6 100644
--- a/src/test/fuzz/eval_script.cpp
+++ b/src/test/fuzz/eval_script.cpp
@@ -12,7 +12,7 @@
 
 void initialize()
 {
-    static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
 }
 
 void test_one_input(const std::vector<uint8_t>& buffer)
diff --git a/src/test/fuzz/hex.cpp b/src/test/fuzz/hex.cpp
index 2de6100d7b..3bbf0084c2 100644
--- a/src/test/fuzz/hex.cpp
+++ b/src/test/fuzz/hex.cpp
@@ -3,6 +3,7 @@
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <core_io.h>
+#include <pubkey.h>
 #include <primitives/block.h>
 #include <rpc/util.h>
 #include <test/fuzz/fuzz.h>
@@ -15,6 +16,10 @@
 #include <string>
 #include <vector>
 
+void initialize() {
+    static const ECCVerifyHandle verify_handle;
+}
+
 void test_one_input(const std::vector<uint8_t>& buffer)
 {
     const std::string random_hex_string(buffer.begin(), buffer.end());
@@ -33,4 +38,6 @@ void test_one_input(const std::vector<uint8_t>& buffer)
     }
     CBlockHeader block_header;
     (void)DecodeHexBlockHeader(block_header, random_hex_string);
+    CBlock block;
+    (void)DecodeHexBlk(block, random_hex_string);
 }
diff --git a/src/test/fuzz/integer.cpp b/src/test/fuzz/integer.cpp
index 21061e08ac..45148ffdb5 100644
--- a/src/test/fuzz/integer.cpp
+++ b/src/test/fuzz/integer.cpp
@@ -14,6 +14,7 @@
 #include <netbase.h>
 #include <policy/settings.h>
 #include <pow.h>
+#include <protocol.h>
 #include <pubkey.h>
 #include <rpc/util.h>
 #include <script/sign.h>
@@ -220,6 +221,12 @@ void test_one_input(const std::vector<uint8_t>& buffer)
         assert(b == deserialized_b && stream.empty());
     }
 
+    {
+        const ServiceFlags service_flags = (ServiceFlags)u64;
+        (void)HasAllDesirableServiceFlags(service_flags);
+        (void)MayHaveUsefulAddressDB(service_flags);
+    }
+
     {
         CDataStream stream(SER_NETWORK, INIT_PROTO_VERSION);
 
diff --git a/src/test/fuzz/netaddress.cpp b/src/test/fuzz/netaddress.cpp
index 919987e80e..9da42b59f8 100644
--- a/src/test/fuzz/netaddress.cpp
+++ b/src/test/fuzz/netaddress.cpp
@@ -117,4 +117,15 @@ void test_one_input(const std::vector<uint8_t>& buffer)
     const CNetAddr other_net_addr = ConsumeNetAddr(fuzzed_data_provider);
     (void)net_addr.GetReachabilityFrom(&other_net_addr);
     (void)sub_net.Match(other_net_addr);
+
+    const CService other_service{net_addr, fuzzed_data_provider.ConsumeIntegral<uint16_t>()};
+    assert((service == other_service) != (service != other_service));
+    (void)(service < other_service);
+
+    const CSubNet sub_net_copy_1{net_addr, other_net_addr};
+    const CSubNet sub_net_copy_2{net_addr};
+
+    CNetAddr mutable_net_addr;
+    mutable_net_addr.SetIP(net_addr);
+    assert(net_addr == mutable_net_addr);
 }
diff --git a/src/test/fuzz/parse_univalue.cpp b/src/test/fuzz/parse_univalue.cpp
index 4f10995494..bfbddd4b71 100644
--- a/src/test/fuzz/parse_univalue.cpp
+++ b/src/test/fuzz/parse_univalue.cpp
@@ -16,7 +16,7 @@
 
 void initialize()
 {
-    static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
     SelectParams(CBaseChainParams::REGTEST);
 }
 
@@ -37,21 +37,31 @@ void test_one_input(const std::vector<uint8_t>& buffer)
     }
     try {
         (void)ParseHashO(univalue, "A");
+    } catch (const UniValue&) {
+    } catch (const std::runtime_error&) {
+    }
+    try {
         (void)ParseHashO(univalue, random_string);
     } catch (const UniValue&) {
     } catch (const std::runtime_error&) {
     }
     try {
         (void)ParseHashV(univalue, "A");
+    } catch (const UniValue&) {
+    } catch (const std::runtime_error&) {
+    }
+    try {
         (void)ParseHashV(univalue, random_string);
     } catch (const UniValue&) {
     } catch (const std::runtime_error&) {
     }
     try {
         (void)ParseHexO(univalue, "A");
+    } catch (const UniValue&) {
+    }
+    try {
         (void)ParseHexO(univalue, random_string);
     } catch (const UniValue&) {
-    } catch (const std::runtime_error&) {
     }
     try {
         (void)ParseHexUV(univalue, "A");
@@ -61,6 +71,10 @@ void test_one_input(const std::vector<uint8_t>& buffer)
     }
     try {
         (void)ParseHexV(univalue, "A");
+    } catch (const UniValue&) {
+    } catch (const std::runtime_error&) {
+    }
+    try {
         (void)ParseHexV(univalue, random_string);
     } catch (const UniValue&) {
     } catch (const std::runtime_error&) {
diff --git a/src/test/fuzz/script.cpp b/src/test/fuzz/script.cpp
index 139e7b5b77..533e3bb92d 100644
--- a/src/test/fuzz/script.cpp
+++ b/src/test/fuzz/script.cpp
@@ -14,14 +14,16 @@
 #include <script/sign.h>
 #include <script/standard.h>
 #include <streams.h>
+#include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
 #include <univalue.h>
 #include <util/memory.h>
 
 void initialize()
 {
     // Fuzzers using pubkey must hold an ECCVerifyHandle.
-    static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
 
     SelectParams(CBaseChainParams::REGTEST);
 }
@@ -39,13 +41,6 @@ void test_one_input(const std::vector<uint8_t>& buffer)
         assert(ok);
     }
 
-    for (unsigned int size = 0; size < 6; ++size) {
-        std::vector<unsigned char> vch(GetSpecialScriptSize(size), 0x00);
-        vch.insert(vch.end(), buffer.begin(), buffer.end());
-        CScript decompressed_script;
-        (void)DecompressScript(decompressed_script, size, vch);
-    }
-
     CTxDestination address;
     (void)ExtractDestination(script, address);
 
@@ -84,4 +79,14 @@ void test_one_input(const std::vector<uint8_t>& buffer)
     ScriptToUniv(script, o3, true);
     UniValue o4(UniValue::VOBJ);
     ScriptToUniv(script, o4, false);
+
+    {
+        FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+        const std::vector<uint8_t> bytes = ConsumeRandomLengthByteVector(fuzzed_data_provider);
+        // DecompressScript(..., ..., bytes) is not guaranteed to be defined if bytes.size() <= 23.
+        if (bytes.size() >= 24) {
+            CScript decompressed_script;
+            DecompressScript(decompressed_script, fuzzed_data_provider.ConsumeIntegral<unsigned int>(), bytes);
+        }
+    }
 }
diff --git a/src/test/fuzz/script_flags.cpp b/src/test/fuzz/script_flags.cpp
index f246630a91..90ad1e0a3d 100644
--- a/src/test/fuzz/script_flags.cpp
+++ b/src/test/fuzz/script_flags.cpp
@@ -15,7 +15,7 @@ static bool IsValidFlagCombination(unsigned flags);
 
 void initialize()
 {
-    static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
 }
 
 void test_one_input(const std::vector<uint8_t>& buffer)
diff --git a/src/test/fuzz/transaction.cpp b/src/test/fuzz/transaction.cpp
index 60068ac8d9..5f80f22a63 100644
--- a/src/test/fuzz/transaction.cpp
+++ b/src/test/fuzz/transaction.cpp
@@ -100,5 +100,7 @@ void test_one_input(const std::vector<uint8_t>& buffer)
     }
     if (!skip_tx_to_univ) {
         TxToUniv(tx, /* hashBlock */ {}, u);
+        static const uint256 u256_max(uint256S("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"));
+        TxToUniv(tx, u256_max, u);
     }
 }

From cd9b83c15e5ae0b56a6f8dd442c5c1dc1e9ac4a5 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Tue, 14 Jun 2022 11:59:06 +0530
Subject: [PATCH 04/13] merge bitcoin#19247: Add fuzzing harness for
 {Read,Write}{LE,BE}{16,32,64}

---
 src/Makefile.test.include       |  7 ++++
 src/test/fuzz/crypto_common.cpp | 70 +++++++++++++++++++++++++++++++++
 src/test/fuzz/util.h            | 14 +++++++
 3 files changed, 91 insertions(+)
 create mode 100644 src/test/fuzz/crypto_common.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 9342ecddee..e3d4eab944 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -33,6 +33,7 @@ FUZZ_TARGETS = \
   test/fuzz/checkqueue \
   test/fuzz/coins_deserialize \
   test/fuzz/coins_view \
+  test/fuzz/crypto_common \
   test/fuzz/cuckoocache \
   test/fuzz/decode_tx \
   test/fuzz/descriptor_parse \
@@ -464,6 +465,12 @@ test_fuzz_coins_view_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_coins_view_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_coins_view_SOURCES = $(FUZZ_SUITE) test/fuzz/coins_view.cpp
 
+test_fuzz_crypto_common_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_crypto_common_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_crypto_common_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_crypto_common_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_crypto_common_SOURCES = $(FUZZ_SUITE) test/fuzz/crypto_common.cpp
+
 test_fuzz_cuckoocache_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
 test_fuzz_cuckoocache_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_cuckoocache_LDADD = $(FUZZ_SUITE_LD_COMMON)
diff --git a/src/test/fuzz/crypto_common.cpp b/src/test/fuzz/crypto_common.cpp
new file mode 100644
index 0000000000..7ccb125216
--- /dev/null
+++ b/src/test/fuzz/crypto_common.cpp
@@ -0,0 +1,70 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <crypto/common.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <array>
+#include <cassert>
+#include <cstdint>
+#include <cstring>
+#include <vector>
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
+    const uint16_t random_u16 = fuzzed_data_provider.ConsumeIntegral<uint16_t>();
+    const uint32_t random_u32 = fuzzed_data_provider.ConsumeIntegral<uint32_t>();
+    const uint64_t random_u64 = fuzzed_data_provider.ConsumeIntegral<uint64_t>();
+    const std::vector<uint8_t> random_bytes_2 = ConsumeFixedLengthByteVector(fuzzed_data_provider, 2);
+    const std::vector<uint8_t> random_bytes_4 = ConsumeFixedLengthByteVector(fuzzed_data_provider, 4);
+    const std::vector<uint8_t> random_bytes_8 = ConsumeFixedLengthByteVector(fuzzed_data_provider, 8);
+
+    std::array<uint8_t, 2> writele16_arr;
+    WriteLE16(writele16_arr.data(), random_u16);
+    assert(ReadLE16(writele16_arr.data()) == random_u16);
+
+    std::array<uint8_t, 4> writele32_arr;
+    WriteLE32(writele32_arr.data(), random_u32);
+    assert(ReadLE32(writele32_arr.data()) == random_u32);
+
+    std::array<uint8_t, 8> writele64_arr;
+    WriteLE64(writele64_arr.data(), random_u64);
+    assert(ReadLE64(writele64_arr.data()) == random_u64);
+
+    std::array<uint8_t, 4> writebe32_arr;
+    WriteBE32(writebe32_arr.data(), random_u32);
+    assert(ReadBE32(writebe32_arr.data()) == random_u32);
+
+    std::array<uint8_t, 8> writebe64_arr;
+    WriteBE64(writebe64_arr.data(), random_u64);
+    assert(ReadBE64(writebe64_arr.data()) == random_u64);
+
+    const uint16_t readle16_result = ReadLE16(random_bytes_2.data());
+    std::array<uint8_t, 2> readle16_arr;
+    WriteLE16(readle16_arr.data(), readle16_result);
+    assert(std::memcmp(random_bytes_2.data(), readle16_arr.data(), 2) == 0);
+
+    const uint32_t readle32_result = ReadLE32(random_bytes_4.data());
+    std::array<uint8_t, 4> readle32_arr;
+    WriteLE32(readle32_arr.data(), readle32_result);
+    assert(std::memcmp(random_bytes_4.data(), readle32_arr.data(), 4) == 0);
+
+    const uint64_t readle64_result = ReadLE64(random_bytes_8.data());
+    std::array<uint8_t, 8> readle64_arr;
+    WriteLE64(readle64_arr.data(), readle64_result);
+    assert(std::memcmp(random_bytes_8.data(), readle64_arr.data(), 8) == 0);
+
+    const uint32_t readbe32_result = ReadBE32(random_bytes_4.data());
+    std::array<uint8_t, 4> readbe32_arr;
+    WriteBE32(readbe32_arr.data(), readbe32_result);
+    assert(std::memcmp(random_bytes_4.data(), readbe32_arr.data(), 4) == 0);
+
+    const uint64_t readbe64_result = ReadBE64(random_bytes_8.data());
+    std::array<uint8_t, 8> readbe64_arr;
+    WriteBE64(readbe64_arr.data(), readbe64_result);
+    assert(std::memcmp(random_bytes_8.data(), readbe64_arr.data(), 8) == 0);
+}
diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h
index 699c999534..fee23ba09e 100644
--- a/src/test/fuzz/util.h
+++ b/src/test/fuzz/util.h
@@ -144,4 +144,18 @@ template <class T>
     return false;
 }
 
+/**
+ * Returns a byte vector of specified size regardless of the number of remaining bytes available
+ * from the fuzzer. Pads with zero value bytes if needed to achieve the specified size.
+ */
+[[ nodiscard ]] inline std::vector<uint8_t> ConsumeFixedLengthByteVector(FuzzedDataProvider& fuzzed_data_provider, const size_t length) noexcept
+{
+    std::vector<uint8_t> result(length);
+    const std::vector<uint8_t> random_bytes = fuzzed_data_provider.ConsumeBytes<uint8_t>(length);
+    if (!random_bytes.empty()) {
+        std::memcpy(result.data(), random_bytes.data(), random_bytes.size());
+    }
+    return result;
+}
+
 #endif // BITCOIN_TEST_FUZZ_UTIL_H

From da690542f470f1eca33b5fa6e15ea7380fdea0de Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Tue, 14 Jun 2022 11:59:21 +0530
Subject: [PATCH 05/13] merge bitcoin#19222: Add fuzzing harness for BanMan

---
 src/Makefile.test.include    |  7 +++
 src/test/fuzz/banman.cpp     | 88 ++++++++++++++++++++++++++++++++++++
 src/test/fuzz/netaddress.cpp | 30 +-----------
 src/test/fuzz/util.h         | 36 +++++++++++++++
 4 files changed, 132 insertions(+), 29 deletions(-)
 create mode 100644 src/test/fuzz/banman.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index e3d4eab944..547d703e7b 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -13,6 +13,7 @@ FUZZ_TARGETS = \
   test/fuzz/asmap \
   test/fuzz/asmap_direct \
   test/fuzz/banentry_deserialize \
+  test/fuzz/banman \
   test/fuzz/base_encode_decode \
   test/fuzz/bech32 \
   test/fuzz/block \
@@ -345,6 +346,12 @@ test_fuzz_banentry_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_banentry_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_banentry_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
 
+test_fuzz_banman_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_banman_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_banman_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_banman_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_banman_SOURCES = $(FUZZ_SUITE) test/fuzz/banman.cpp
+
 test_fuzz_base_encode_decode_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
 test_fuzz_base_encode_decode_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_base_encode_decode_LDADD = $(FUZZ_SUITE_LD_COMMON)
diff --git a/src/test/fuzz/banman.cpp b/src/test/fuzz/banman.cpp
new file mode 100644
index 0000000000..fc4a1d9261
--- /dev/null
+++ b/src/test/fuzz/banman.cpp
@@ -0,0 +1,88 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <banman.h>
+#include <fs.h>
+#include <netaddress.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+#include <util/system.h>
+
+#include <cstdint>
+#include <limits>
+#include <string>
+#include <vector>
+
+namespace {
+int64_t ConsumeBanTimeOffset(FuzzedDataProvider& fuzzed_data_provider) noexcept
+{
+    // Avoid signed integer overflow by capping to int32_t max:
+    // banman.cpp:137:73: runtime error: signed integer overflow: 1591700817 + 9223372036854775807 cannot be represented in type 'long'
+    return fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(std::numeric_limits<int64_t>::min(), std::numeric_limits<int32_t>::max());
+}
+} // namespace
+
+void initialize()
+{
+    InitializeFuzzingContext();
+}
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
+    const fs::path banlist_file = GetDataDir() / "fuzzed_banlist.dat";
+    fs::remove(banlist_file);
+    {
+        BanMan ban_man{banlist_file, nullptr, ConsumeBanTimeOffset(fuzzed_data_provider)};
+        while (fuzzed_data_provider.ConsumeBool()) {
+            switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 11)) {
+            case 0: {
+                ban_man.Ban(ConsumeNetAddr(fuzzed_data_provider),
+                    ConsumeBanTimeOffset(fuzzed_data_provider), fuzzed_data_provider.ConsumeBool());
+                break;
+            }
+            case 1: {
+                ban_man.Ban(ConsumeSubNet(fuzzed_data_provider),
+                    ConsumeBanTimeOffset(fuzzed_data_provider), fuzzed_data_provider.ConsumeBool());
+                break;
+            }
+            case 2: {
+                ban_man.ClearBanned();
+                break;
+            }
+            case 4: {
+                ban_man.IsBanned(ConsumeNetAddr(fuzzed_data_provider));
+                break;
+            }
+            case 5: {
+                ban_man.IsBanned(ConsumeSubNet(fuzzed_data_provider));
+                break;
+            }
+            case 6: {
+                ban_man.Unban(ConsumeNetAddr(fuzzed_data_provider));
+                break;
+            }
+            case 7: {
+                ban_man.Unban(ConsumeSubNet(fuzzed_data_provider));
+                break;
+            }
+            case 8: {
+                banmap_t banmap;
+                ban_man.GetBanned(banmap);
+                break;
+            }
+            case 9: {
+                ban_man.DumpBanlist();
+                break;
+            }
+            case 11: {
+                ban_man.Discourage(ConsumeNetAddr(fuzzed_data_provider));
+                break;
+            }
+            }
+        }
+    }
+    fs::remove(banlist_file);
+}
diff --git a/src/test/fuzz/netaddress.cpp b/src/test/fuzz/netaddress.cpp
index 9da42b59f8..8252f38726 100644
--- a/src/test/fuzz/netaddress.cpp
+++ b/src/test/fuzz/netaddress.cpp
@@ -5,41 +5,13 @@
 #include <netaddress.h>
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
 
 #include <cassert>
 #include <cstdint>
 #include <netinet/in.h>
 #include <vector>
 
-namespace {
-CNetAddr ConsumeNetAddr(FuzzedDataProvider& fuzzed_data_provider) noexcept
-{
-    const Network network = fuzzed_data_provider.PickValueInArray({Network::NET_IPV4, Network::NET_IPV6, Network::NET_INTERNAL, Network::NET_ONION});
-    if (network == Network::NET_IPV4) {
-        const in_addr v4_addr = {
-            .s_addr = fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
-        return CNetAddr{v4_addr};
-    } else if (network == Network::NET_IPV6) {
-        if (fuzzed_data_provider.remaining_bytes() < 16) {
-            return CNetAddr{};
-        }
-        in6_addr v6_addr = {};
-        memcpy(v6_addr.s6_addr, fuzzed_data_provider.ConsumeBytes<uint8_t>(16).data(), 16);
-        return CNetAddr{v6_addr, fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
-    } else if (network == Network::NET_INTERNAL) {
-        CNetAddr net_addr;
-        net_addr.SetInternal(fuzzed_data_provider.ConsumeBytesAsString(32));
-        return net_addr;
-    } else if (network == Network::NET_ONION) {
-        CNetAddr net_addr;
-        net_addr.SetSpecial(fuzzed_data_provider.ConsumeBytesAsString(32));
-        return net_addr;
-    } else {
-        assert(false);
-    }
-}
-}; // namespace
-
 void test_one_input(const std::vector<uint8_t>& buffer)
 {
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h
index fee23ba09e..9a997a6ce8 100644
--- a/src/test/fuzz/util.h
+++ b/src/test/fuzz/util.h
@@ -8,13 +8,17 @@
 #include <amount.h>
 #include <arith_uint256.h>
 #include <attributes.h>
+#include <chainparamsbase.h>
 #include <coins.h>
+#include <netaddress.h>
+#include <netbase.h>
 #include <optional.h>
 #include <script/script.h>
 #include <serialize.h>
 #include <streams.h>
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
+#include <test/util/setup_common.h>
 #include <uint256.h>
 #include <version.h>
 
@@ -158,4 +162,36 @@ template <class T>
     return result;
 }
 
+CNetAddr ConsumeNetAddr(FuzzedDataProvider& fuzzed_data_provider) noexcept
+{
+    const Network network = fuzzed_data_provider.PickValueInArray({Network::NET_IPV4, Network::NET_IPV6, Network::NET_INTERNAL, Network::NET_ONION});
+    CNetAddr net_addr;
+    if (network == Network::NET_IPV4) {
+        const in_addr v4_addr = {
+            .s_addr = fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
+        net_addr = CNetAddr{v4_addr};
+    } else if (network == Network::NET_IPV6) {
+        if (fuzzed_data_provider.remaining_bytes() >= 16) {
+            in6_addr v6_addr = {};
+            memcpy(v6_addr.s6_addr, fuzzed_data_provider.ConsumeBytes<uint8_t>(16).data(), 16);
+            net_addr = CNetAddr{v6_addr, fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
+        }
+    } else if (network == Network::NET_INTERNAL) {
+        net_addr.SetInternal(fuzzed_data_provider.ConsumeBytesAsString(32));
+    } else if (network == Network::NET_ONION) {
+        net_addr.SetSpecial(fuzzed_data_provider.ConsumeBytesAsString(32));
+    }
+    return net_addr;
+}
+
+CSubNet ConsumeSubNet(FuzzedDataProvider& fuzzed_data_provider) noexcept
+{
+    return {ConsumeNetAddr(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<uint8_t>()};
+}
+
+void InitializeFuzzingContext(const std::string& chain_name = CBaseChainParams::REGTEST)
+{
+    static const BasicTestingSetup basic_testing_setup{chain_name, {"-nodebuglogfile"}};
+}
+
 #endif // BITCOIN_TEST_FUZZ_UTIL_H

From eb2fa8128893a84b8b0fefe9c36fb93648fddc8d Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Fri, 15 Jul 2022 21:23:01 +0530
Subject: [PATCH 06/13] partial bitcoin#19143: Add fuzzing harnesses for
 CAutoFile, CBufferedFile, LoadExternalBlockFile and other FILE* consumers

---
 src/Makefile.test.include                  |  21 +++
 src/test/fuzz/autofile.cpp                 |  72 +++++++
 src/test/fuzz/buffered_file.cpp            |  78 ++++++++
 src/test/fuzz/load_external_block_file.cpp |  31 ++++
 src/test/fuzz/util.h                       | 206 +++++++++++++++++++++
 5 files changed, 408 insertions(+)
 create mode 100644 src/test/fuzz/autofile.cpp
 create mode 100644 src/test/fuzz/buffered_file.cpp
 create mode 100644 src/test/fuzz/load_external_block_file.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 547d703e7b..c0114dc6f2 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -12,6 +12,7 @@ FUZZ_TARGETS = \
   test/fuzz/addrman_deserialize \
   test/fuzz/asmap \
   test/fuzz/asmap_direct \
+  test/fuzz/autofile \
   test/fuzz/banentry_deserialize \
   test/fuzz/banman \
   test/fuzz/base_encode_decode \
@@ -31,6 +32,7 @@ FUZZ_TARGETS = \
   test/fuzz/blockundo_deserialize \
   test/fuzz/bloom_filter \
   test/fuzz/bloomfilter_deserialize \
+  test/fuzz/buffered_file \
   test/fuzz/checkqueue \
   test/fuzz/coins_deserialize \
   test/fuzz/coins_view \
@@ -51,6 +53,7 @@ FUZZ_TARGETS = \
   test/fuzz/key \
   test/fuzz/key_io \
   test/fuzz/key_origin_info_deserialize \
+  test/fuzz/load_external_block_file \
   test/fuzz/locale \
   test/fuzz/merkle_block_deserialize \
   test/fuzz/merkleblock \
@@ -340,6 +343,12 @@ test_fuzz_asmap_direct_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_asmap_direct_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_asmap_direct_SOURCES = $(FUZZ_SUITE) test/fuzz/asmap_direct.cpp
 
+test_fuzz_autofile_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_autofile_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_autofile_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_autofile_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_autofile_SOURCES = $(FUZZ_SUITE) test/fuzz/autofile.cpp
+
 test_fuzz_banentry_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DBANENTRY_DESERIALIZE=1
 test_fuzz_banentry_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_banentry_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -454,6 +463,12 @@ test_fuzz_bloomfilter_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_bloomfilter_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_bloomfilter_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
 
+test_fuzz_buffered_file_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_buffered_file_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_buffered_file_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_buffered_file_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_buffered_file_SOURCES = $(FUZZ_SUITE) test/fuzz/buffered_file.cpp
+
 test_fuzz_checkqueue_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
 test_fuzz_checkqueue_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_checkqueue_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -574,6 +589,12 @@ test_fuzz_key_origin_info_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_key_origin_info_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_key_origin_info_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
 
+test_fuzz_load_external_block_file_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_load_external_block_file_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_load_external_block_file_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_load_external_block_file_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_load_external_block_file_SOURCES = $(FUZZ_SUITE) test/fuzz/load_external_block_file.cpp
+
 test_fuzz_locale_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
 test_fuzz_locale_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_locale_LDADD = $(FUZZ_SUITE_LD_COMMON)
diff --git a/src/test/fuzz/autofile.cpp b/src/test/fuzz/autofile.cpp
new file mode 100644
index 0000000000..7ea0bdd2a7
--- /dev/null
+++ b/src/test/fuzz/autofile.cpp
@@ -0,0 +1,72 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <optional.h>
+#include <streams.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <array>
+#include <cstdint>
+#include <iostream>
+#include <optional>
+#include <string>
+#include <vector>
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
+    FuzzedAutoFileProvider fuzzed_auto_file_provider = ConsumeAutoFile(fuzzed_data_provider);
+    CAutoFile auto_file = fuzzed_auto_file_provider.open();
+    while (fuzzed_data_provider.ConsumeBool()) {
+        switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 5)) {
+        case 0: {
+            std::array<uint8_t, 4096> arr{};
+            try {
+                auto_file.read((char*)arr.data(), fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4096));
+            } catch (const std::ios_base::failure&) {
+            }
+            break;
+        }
+        case 1: {
+            const std::array<uint8_t, 4096> arr{};
+            try {
+                auto_file.write((const char*)arr.data(), fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4096));
+            } catch (const std::ios_base::failure&) {
+            }
+            break;
+        }
+        case 2: {
+            try {
+                auto_file.ignore(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4096));
+            } catch (const std::ios_base::failure&) {
+            }
+            break;
+        }
+        case 3: {
+            auto_file.fclose();
+            break;
+        }
+        case 4: {
+            ReadFromStream(fuzzed_data_provider, auto_file);
+            break;
+        }
+        case 5: {
+            WriteToStream(fuzzed_data_provider, auto_file);
+            break;
+        }
+        }
+    }
+    (void)auto_file.Get();
+    (void)auto_file.GetType();
+    (void)auto_file.GetVersion();
+    (void)auto_file.IsNull();
+    if (fuzzed_data_provider.ConsumeBool()) {
+        FILE* f = auto_file.release();
+        if (f != nullptr) {
+            fclose(f);
+        }
+    }
+}
diff --git a/src/test/fuzz/buffered_file.cpp b/src/test/fuzz/buffered_file.cpp
new file mode 100644
index 0000000000..6bbd13eb5c
--- /dev/null
+++ b/src/test/fuzz/buffered_file.cpp
@@ -0,0 +1,78 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <optional.h>
+#include <streams.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <array>
+#include <cstdint>
+#include <iostream>
+#include <optional>
+#include <string>
+#include <vector>
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
+    FuzzedFileProvider fuzzed_file_provider = ConsumeFile(fuzzed_data_provider);
+    std::optional<CBufferedFile> opt_buffered_file;
+    FILE* fuzzed_file = fuzzed_file_provider.open();
+    try {
+        opt_buffered_file.emplace(fuzzed_file, fuzzed_data_provider.ConsumeIntegralInRange<uint64_t>(0, 4096), fuzzed_data_provider.ConsumeIntegralInRange<uint64_t>(0, 4096), fuzzed_data_provider.ConsumeIntegral<int>(), fuzzed_data_provider.ConsumeIntegral<int>());
+    } catch (const std::ios_base::failure&) {
+        if (fuzzed_file != nullptr) {
+            fclose(fuzzed_file);
+        }
+    }
+    if (opt_buffered_file && fuzzed_file != nullptr) {
+        bool setpos_fail = false;
+        while (fuzzed_data_provider.ConsumeBool()) {
+            switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 5)) {
+            case 0: {
+                std::array<uint8_t, 4096> arr{};
+                try {
+                    opt_buffered_file->read((char*)arr.data(), fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4096));
+                } catch (const std::ios_base::failure&) {
+                }
+                break;
+            }
+            case 1: {
+                opt_buffered_file->Seek(fuzzed_data_provider.ConsumeIntegralInRange<uint64_t>(0, 4096));
+                break;
+            }
+            case 2: {
+                opt_buffered_file->SetLimit(fuzzed_data_provider.ConsumeIntegralInRange<uint64_t>(0, 4096));
+                break;
+            }
+            case 3: {
+                if (!opt_buffered_file->SetPos(fuzzed_data_provider.ConsumeIntegralInRange<uint64_t>(0, 4096))) {
+                    setpos_fail = true;
+                }
+                break;
+            }
+            case 4: {
+                if (setpos_fail) {
+                    // Calling FindByte(...) after a failed SetPos(...) call may result in an infinite loop.
+                    break;
+                }
+                try {
+                    opt_buffered_file->FindByte(fuzzed_data_provider.ConsumeIntegral<char>());
+                } catch (const std::ios_base::failure&) {
+                }
+                break;
+            }
+            case 5: {
+                ReadFromStream(fuzzed_data_provider, *opt_buffered_file);
+                break;
+            }
+            }
+        }
+        opt_buffered_file->GetPos();
+        opt_buffered_file->GetType();
+        opt_buffered_file->GetVersion();
+    }
+}
diff --git a/src/test/fuzz/load_external_block_file.cpp b/src/test/fuzz/load_external_block_file.cpp
new file mode 100644
index 0000000000..d9de9d9866
--- /dev/null
+++ b/src/test/fuzz/load_external_block_file.cpp
@@ -0,0 +1,31 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <chainparams.h>
+#include <flatfile.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+#include <test/util/setup_common.h>
+#include <validation.h>
+
+#include <cstdint>
+#include <vector>
+
+void initialize()
+{
+    InitializeFuzzingContext();
+}
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
+    FuzzedFileProvider fuzzed_file_provider = ConsumeFile(fuzzed_data_provider);
+    FILE* fuzzed_block_file = fuzzed_file_provider.open();
+    if (fuzzed_block_file == nullptr) {
+        return;
+    }
+    FlatFilePos flat_file_pos;
+    LoadExternalBlockFile(Params(), fuzzed_block_file, fuzzed_data_provider.ConsumeBool() ? &flat_file_pos : nullptr);
+}
diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h
index 9a997a6ce8..2dd2d46e2c 100644
--- a/src/test/fuzz/util.h
+++ b/src/test/fuzz/util.h
@@ -23,6 +23,7 @@
 #include <version.h>
 
 #include <cstdint>
+#include <cstdio>
 #include <string>
 #include <vector>
 
@@ -194,4 +195,209 @@ void InitializeFuzzingContext(const std::string& chain_name = CBaseChainParams::
     static const BasicTestingSetup basic_testing_setup{chain_name, {"-nodebuglogfile"}};
 }
 
+class FuzzedFileProvider
+{
+    FuzzedDataProvider& m_fuzzed_data_provider;
+    int64_t m_offset = 0;
+
+public:
+    FuzzedFileProvider(FuzzedDataProvider& fuzzed_data_provider) : m_fuzzed_data_provider{fuzzed_data_provider}
+    {
+    }
+
+    FILE* open()
+    {
+        if (m_fuzzed_data_provider.ConsumeBool()) {
+            return nullptr;
+        }
+        std::string mode;
+        switch (m_fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 5)) {
+        case 0: {
+            mode = "r";
+            break;
+        }
+        case 1: {
+            mode = "r+";
+            break;
+        }
+        case 2: {
+            mode = "w";
+            break;
+        }
+        case 3: {
+            mode = "w+";
+            break;
+        }
+        case 4: {
+            mode = "a";
+            break;
+        }
+        case 5: {
+            mode = "a+";
+            break;
+        }
+        }
+#ifdef _GNU_SOURCE
+        const cookie_io_functions_t io_hooks = {
+            FuzzedFileProvider::read,
+            FuzzedFileProvider::write,
+            FuzzedFileProvider::seek,
+            FuzzedFileProvider::close,
+        };
+        return fopencookie(this, mode.c_str(), io_hooks);
+#else
+        (void)mode;
+        return nullptr;
+#endif
+    }
+
+    static ssize_t read(void* cookie, char* buf, size_t size)
+    {
+        FuzzedFileProvider* fuzzed_file = (FuzzedFileProvider*)cookie;
+        if (buf == nullptr || size == 0 || fuzzed_file->m_fuzzed_data_provider.ConsumeBool()) {
+            return fuzzed_file->m_fuzzed_data_provider.ConsumeBool() ? 0 : -1;
+        }
+        const std::vector<uint8_t> random_bytes = fuzzed_file->m_fuzzed_data_provider.ConsumeBytes<uint8_t>(size);
+        if (random_bytes.empty()) {
+            return 0;
+        }
+        std::memcpy(buf, random_bytes.data(), random_bytes.size());
+        if (AdditionOverflow((uint64_t)fuzzed_file->m_offset, random_bytes.size())) {
+            return fuzzed_file->m_fuzzed_data_provider.ConsumeBool() ? 0 : -1;
+        }
+        fuzzed_file->m_offset += random_bytes.size();
+        return random_bytes.size();
+    }
+
+    static ssize_t write(void* cookie, const char* buf, size_t size)
+    {
+        FuzzedFileProvider* fuzzed_file = (FuzzedFileProvider*)cookie;
+        const ssize_t n = fuzzed_file->m_fuzzed_data_provider.ConsumeIntegralInRange<ssize_t>(0, size);
+        if (AdditionOverflow(fuzzed_file->m_offset, n)) {
+            return fuzzed_file->m_fuzzed_data_provider.ConsumeBool() ? 0 : -1;
+        }
+        fuzzed_file->m_offset += n;
+        return n;
+    }
+
+    static int seek(void* cookie, int64_t* offset, int whence)
+    {
+        assert(whence == SEEK_SET || whence == SEEK_CUR); // SEEK_END not implemented yet.
+        FuzzedFileProvider* fuzzed_file = (FuzzedFileProvider*)cookie;
+        int64_t new_offset = 0;
+        if (whence == SEEK_SET) {
+            new_offset = *offset;
+        } else if (whence == SEEK_CUR) {
+            if (AdditionOverflow(fuzzed_file->m_offset, *offset)) {
+                return -1;
+            }
+            new_offset = fuzzed_file->m_offset + *offset;
+        }
+        if (new_offset < 0) {
+            return -1;
+        }
+        fuzzed_file->m_offset = new_offset;
+        *offset = new_offset;
+        return fuzzed_file->m_fuzzed_data_provider.ConsumeIntegralInRange<int>(-1, 0);
+    }
+
+    static int close(void* cookie)
+    {
+        FuzzedFileProvider* fuzzed_file = (FuzzedFileProvider*)cookie;
+        return fuzzed_file->m_fuzzed_data_provider.ConsumeIntegralInRange<int>(-1, 0);
+    }
+};
+
+[[ nodiscard ]] inline FuzzedFileProvider ConsumeFile(FuzzedDataProvider& fuzzed_data_provider) noexcept
+{
+    return {fuzzed_data_provider};
+}
+
+class FuzzedAutoFileProvider
+{
+    FuzzedDataProvider& m_fuzzed_data_provider;
+    FuzzedFileProvider m_fuzzed_file_provider;
+
+public:
+    FuzzedAutoFileProvider(FuzzedDataProvider& fuzzed_data_provider) : m_fuzzed_data_provider{fuzzed_data_provider}, m_fuzzed_file_provider{fuzzed_data_provider}
+    {
+    }
+
+    CAutoFile open()
+    {
+        return {m_fuzzed_file_provider.open(), m_fuzzed_data_provider.ConsumeIntegral<int>(), m_fuzzed_data_provider.ConsumeIntegral<int>()};
+    }
+};
+
+[[ nodiscard ]] inline FuzzedAutoFileProvider ConsumeAutoFile(FuzzedDataProvider& fuzzed_data_provider) noexcept
+{
+    return {fuzzed_data_provider};
+}
+
+#define WRITE_TO_STREAM_CASE(id, type, consume) \
+    case id: {                                  \
+        type o = consume;                       \
+        stream << o;                            \
+        break;                                  \
+    }
+template <typename Stream>
+void WriteToStream(FuzzedDataProvider& fuzzed_data_provider, Stream& stream) noexcept
+{
+    while (fuzzed_data_provider.ConsumeBool()) {
+        try {
+            switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 13)) {
+                WRITE_TO_STREAM_CASE(0, bool, fuzzed_data_provider.ConsumeBool())
+                WRITE_TO_STREAM_CASE(1, char, fuzzed_data_provider.ConsumeIntegral<char>())
+                WRITE_TO_STREAM_CASE(2, int8_t, fuzzed_data_provider.ConsumeIntegral<int8_t>())
+                WRITE_TO_STREAM_CASE(3, uint8_t, fuzzed_data_provider.ConsumeIntegral<uint8_t>())
+                WRITE_TO_STREAM_CASE(4, int16_t, fuzzed_data_provider.ConsumeIntegral<int16_t>())
+                WRITE_TO_STREAM_CASE(5, uint16_t, fuzzed_data_provider.ConsumeIntegral<uint16_t>())
+                WRITE_TO_STREAM_CASE(6, int32_t, fuzzed_data_provider.ConsumeIntegral<int32_t>())
+                WRITE_TO_STREAM_CASE(7, uint32_t, fuzzed_data_provider.ConsumeIntegral<uint32_t>())
+                WRITE_TO_STREAM_CASE(8, int64_t, fuzzed_data_provider.ConsumeIntegral<int64_t>())
+                WRITE_TO_STREAM_CASE(9, uint64_t, fuzzed_data_provider.ConsumeIntegral<uint64_t>())
+                WRITE_TO_STREAM_CASE(10, float, fuzzed_data_provider.ConsumeFloatingPoint<float>())
+                WRITE_TO_STREAM_CASE(11, double, fuzzed_data_provider.ConsumeFloatingPoint<double>())
+                WRITE_TO_STREAM_CASE(12, std::string, fuzzed_data_provider.ConsumeRandomLengthString(32))
+                WRITE_TO_STREAM_CASE(13, std::vector<char>, ConsumeRandomLengthIntegralVector<char>(fuzzed_data_provider))
+            }
+        } catch (const std::ios_base::failure&) {
+            break;
+        }
+    }
+}
+
+#define READ_FROM_STREAM_CASE(id, type) \
+    case id: {                          \
+        type o;                         \
+        stream >> o;                    \
+        break;                          \
+    }
+template <typename Stream>
+void ReadFromStream(FuzzedDataProvider& fuzzed_data_provider, Stream& stream) noexcept
+{
+    while (fuzzed_data_provider.ConsumeBool()) {
+        try {
+            switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 13)) {
+                READ_FROM_STREAM_CASE(0, bool)
+                READ_FROM_STREAM_CASE(1, char)
+                READ_FROM_STREAM_CASE(2, int8_t)
+                READ_FROM_STREAM_CASE(3, uint8_t)
+                READ_FROM_STREAM_CASE(4, int16_t)
+                READ_FROM_STREAM_CASE(5, uint16_t)
+                READ_FROM_STREAM_CASE(6, int32_t)
+                READ_FROM_STREAM_CASE(7, uint32_t)
+                READ_FROM_STREAM_CASE(8, int64_t)
+                READ_FROM_STREAM_CASE(9, uint64_t)
+                READ_FROM_STREAM_CASE(10, float)
+                READ_FROM_STREAM_CASE(11, double)
+                READ_FROM_STREAM_CASE(12, std::string)
+                READ_FROM_STREAM_CASE(13, std::vector<char>)
+            }
+        } catch (const std::ios_base::failure&) {
+            break;
+        }
+    }
+}
+
 #endif // BITCOIN_TEST_FUZZ_UTIL_H

From 01367c944e8ad7b512605ed30e147e65098e2b07 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Fri, 15 Jul 2022 21:24:20 +0530
Subject: [PATCH 07/13] fix(fuzz): statically cast to consistent type to
 account for type similarity

AdditionOverflow is a template function that expects both inputs to explicitly be of the same type
---
 src/test/fuzz/util.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h
index 2dd2d46e2c..c4d06ee111 100644
--- a/src/test/fuzz/util.h
+++ b/src/test/fuzz/util.h
@@ -262,7 +262,7 @@ public:
             return 0;
         }
         std::memcpy(buf, random_bytes.data(), random_bytes.size());
-        if (AdditionOverflow((uint64_t)fuzzed_file->m_offset, random_bytes.size())) {
+        if (AdditionOverflow(static_cast<size_t>(fuzzed_file->m_offset), random_bytes.size())) {
             return fuzzed_file->m_fuzzed_data_provider.ConsumeBool() ? 0 : -1;
         }
         fuzzed_file->m_offset += random_bytes.size();
@@ -273,7 +273,7 @@ public:
     {
         FuzzedFileProvider* fuzzed_file = (FuzzedFileProvider*)cookie;
         const ssize_t n = fuzzed_file->m_fuzzed_data_provider.ConsumeIntegralInRange<ssize_t>(0, size);
-        if (AdditionOverflow(fuzzed_file->m_offset, n)) {
+        if (AdditionOverflow(static_cast<ssize_t>(fuzzed_file->m_offset), n)) {
             return fuzzed_file->m_fuzzed_data_provider.ConsumeBool() ? 0 : -1;
         }
         fuzzed_file->m_offset += n;

From 93d3c260632513b66c4eb7e65b3af8c60b737498 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Tue, 14 Jun 2022 12:00:15 +0530
Subject: [PATCH 08/13] merge bitcoin#18363: Add fuzzing harness for
 HTTPRequest, libevent's evhttp and related functions

---
 src/Makefile.test.include      |  7 +++++
 src/httpserver.cpp             |  6 ++--
 src/httpserver.h               |  2 +-
 src/test/fuzz/http_request.cpp | 56 ++++++++++++++++++++++++++++++++++
 4 files changed, 67 insertions(+), 4 deletions(-)
 create mode 100644 src/test/fuzz/http_request.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index c0114dc6f2..ce0b68423b 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -48,6 +48,7 @@ FUZZ_TARGETS = \
   test/fuzz/flatfile \
   test/fuzz/float \
   test/fuzz/hex \
+  test/fuzz/http_request \
   test/fuzz/integer \
   test/fuzz/inv_deserialize \
   test/fuzz/key \
@@ -559,6 +560,12 @@ test_fuzz_hex_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_hex_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_hex_SOURCES = $(FUZZ_SUITE) test/fuzz/hex.cpp
 
+test_fuzz_http_request_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_http_request_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_http_request_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_http_request_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_http_request_SOURCES = $(FUZZ_SUITE) test/fuzz/http_request.cpp
+
 test_fuzz_integer_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
 test_fuzz_integer_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_integer_LDADD = $(FUZZ_SUITE_LD_COMMON)
diff --git a/src/httpserver.cpp b/src/httpserver.cpp
index 610ab29524..d001a9690c 100644
--- a/src/httpserver.cpp
+++ b/src/httpserver.cpp
@@ -188,7 +188,7 @@ static bool InitHTTPAllowList()
 }
 
 /** HTTP request method as string - use for logging only */
-static std::string RequestMethodString(HTTPRequest::RequestMethod m)
+std::string RequestMethodString(HTTPRequest::RequestMethod m)
 {
     switch (m) {
     case HTTPRequest::GET:
@@ -513,10 +513,10 @@ void HTTPEvent::trigger(struct timeval* tv)
     else
         evtimer_add(ev, tv); // trigger after timeval passed
 }
-HTTPRequest::HTTPRequest(struct evhttp_request* _req) : req(_req),
-                                                       replySent(false)
+HTTPRequest::HTTPRequest(struct evhttp_request* _req, bool _replySent) : req(_req), replySent(_replySent)
 {
 }
+
 HTTPRequest::~HTTPRequest()
 {
     if (!replySent) {
diff --git a/src/httpserver.h b/src/httpserver.h
index 3c38eb5241..5a783e7bdc 100644
--- a/src/httpserver.h
+++ b/src/httpserver.h
@@ -60,7 +60,7 @@ private:
     bool replySent;
 
 public:
-    explicit HTTPRequest(struct evhttp_request* req);
+    explicit HTTPRequest(struct evhttp_request* req, bool replySent = false);
     ~HTTPRequest();
 
     enum RequestMethod {
diff --git a/src/test/fuzz/http_request.cpp b/src/test/fuzz/http_request.cpp
new file mode 100644
index 0000000000..4104c5574d
--- /dev/null
+++ b/src/test/fuzz/http_request.cpp
@@ -0,0 +1,56 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <httpserver.h>
+#include <netaddress.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <event2/buffer.h>
+#include <event2/http.h>
+#include <event2/http_struct.h>
+
+#include <cassert>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+extern "C" int evhttp_parse_firstline_(struct evhttp_request*, struct evbuffer*);
+extern "C" int evhttp_parse_headers_(struct evhttp_request*, struct evbuffer*);
+std::string RequestMethodString(HTTPRequest::RequestMethod m);
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
+    evhttp_request* evreq = evhttp_request_new(nullptr, nullptr);
+    assert(evreq != nullptr);
+    evreq->kind = EVHTTP_REQUEST;
+    evbuffer* evbuf = evbuffer_new();
+    assert(evbuf != nullptr);
+    const std::vector<uint8_t> http_buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, 4096);
+    evbuffer_add(evbuf, http_buffer.data(), http_buffer.size());
+    if (evhttp_parse_firstline_(evreq, evbuf) != 1 || evhttp_parse_headers_(evreq, evbuf) != 1) {
+        evbuffer_free(evbuf);
+        evhttp_request_free(evreq);
+        return;
+    }
+
+    HTTPRequest http_request{evreq, true};
+    const HTTPRequest::RequestMethod request_method = http_request.GetRequestMethod();
+    (void)RequestMethodString(request_method);
+    (void)http_request.GetURI();
+    (void)http_request.GetHeader("Host");
+    const std::string header = fuzzed_data_provider.ConsumeRandomLengthString(16);
+    (void)http_request.GetHeader(header);
+    (void)http_request.WriteHeader(header, fuzzed_data_provider.ConsumeRandomLengthString(16));
+    (void)http_request.GetHeader(header);
+    const std::string body = http_request.ReadBody();
+    assert(body.empty());
+    const CService service = http_request.GetPeer();
+    assert(service.ToString() == "[::]:0");
+
+    evbuffer_free(evbuf);
+    evhttp_request_free(evreq);
+}

From b50f00a2d58088d1df98c27570ff87e0ca912e44 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Tue, 14 Jun 2022 12:00:28 +0530
Subject: [PATCH 09/13] merge bitcoin#18190: Add fuzzing harness for
 Golomb-Rice coding (GolombRiceEncode/GolombRiceDecode)

---
 src/Makefile.am               |   1 +
 src/Makefile.test.include     |   7 +++
 src/blockfilter.cpp           |  32 +---------
 src/test/fuzz/golomb_rice.cpp | 112 ++++++++++++++++++++++++++++++++++
 src/util/golombrice.h         |  43 +++++++++++++
 5 files changed, 164 insertions(+), 31 deletions(-)
 create mode 100644 src/test/fuzz/golomb_rice.cpp
 create mode 100644 src/util/golombrice.h

diff --git a/src/Makefile.am b/src/Makefile.am
index 0ba869099d..e54f5e629e 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -294,6 +294,7 @@ BITCOIN_CORE_H = \
   util/check.h \
   util/error.h \
   util/fees.h \
+  util/golombrice.h \
   util/irange.h \
   util/spanparsing.h \
   util/system.h \
diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index ce0b68423b..1b881b03c0 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -47,6 +47,7 @@ FUZZ_TARGETS = \
   test/fuzz/flat_file_pos_deserialize \
   test/fuzz/flatfile \
   test/fuzz/float \
+  test/fuzz/golomb_rice \
   test/fuzz/hex \
   test/fuzz/http_request \
   test/fuzz/integer \
@@ -554,6 +555,12 @@ test_fuzz_float_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_float_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_float_SOURCES = $(FUZZ_SUITE) test/fuzz/float.cpp
 
+test_fuzz_golomb_rice_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_golomb_rice_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_golomb_rice_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_golomb_rice_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_golomb_rice_SOURCES = $(FUZZ_SUITE) test/fuzz/golomb_rice.cpp
+
 test_fuzz_hex_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
 test_fuzz_hex_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_hex_LDADD = $(FUZZ_SUITE_LD_COMMON)
diff --git a/src/blockfilter.cpp b/src/blockfilter.cpp
index 5a260a04cd..3b286b7e4f 100644
--- a/src/blockfilter.cpp
+++ b/src/blockfilter.cpp
@@ -12,6 +12,7 @@
 #include <primitives/transaction.h>
 #include <script/script.h>
 #include <streams.h>
+#include <util/golombrice.h>
 
 /// SerType used to serialize parameters in GCS filter encoding.
 static constexpr int GCS_SER_TYPE = SER_NETWORK;
@@ -23,37 +24,6 @@ static const std::map<BlockFilterType, std::string> g_filter_types = {
     {BlockFilterType::BASIC_FILTER, "basic"},
 };
 
-template <typename OStream>
-static void GolombRiceEncode(BitStreamWriter<OStream>& bitwriter, uint8_t P, uint64_t x)
-{
-    // Write quotient as unary-encoded: q 1's followed by one 0.
-    uint64_t q = x >> P;
-    while (q > 0) {
-        int nbits = q <= 64 ? static_cast<int>(q) : 64;
-        bitwriter.Write(~0ULL, nbits);
-        q -= nbits;
-    }
-    bitwriter.Write(0, 1);
-
-    // Write the remainder in P bits. Since the remainder is just the bottom
-    // P bits of x, there is no need to mask first.
-    bitwriter.Write(x, P);
-}
-
-template <typename IStream>
-static uint64_t GolombRiceDecode(BitStreamReader<IStream>& bitreader, uint8_t P)
-{
-    // Read unary-encoded quotient: q 1's followed by one 0.
-    uint64_t q = 0;
-    while (bitreader.Read(1) == 1) {
-        ++q;
-    }
-
-    uint64_t r = bitreader.Read(P);
-
-    return (q << P) + r;
-}
-
 // Map a value x that is uniformly distributed in the range [0, 2^64) to a
 // value uniformly distributed in [0, n) by returning the upper 64 bits of
 // x * n.
diff --git a/src/test/fuzz/golomb_rice.cpp b/src/test/fuzz/golomb_rice.cpp
new file mode 100644
index 0000000000..3e20416116
--- /dev/null
+++ b/src/test/fuzz/golomb_rice.cpp
@@ -0,0 +1,112 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <blockfilter.h>
+#include <serialize.h>
+#include <streams.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/util.h>
+#include <util/bytevectorhash.h>
+#include <util/golombrice.h>
+
+#include <algorithm>
+#include <cassert>
+#include <cstdint>
+#include <iosfwd>
+#include <unordered_set>
+#include <vector>
+
+namespace {
+uint64_t MapIntoRange(const uint64_t x, const uint64_t n)
+{
+    const uint64_t x_hi = x >> 32;
+    const uint64_t x_lo = x & 0xFFFFFFFF;
+    const uint64_t n_hi = n >> 32;
+    const uint64_t n_lo = n & 0xFFFFFFFF;
+    const uint64_t ac = x_hi * n_hi;
+    const uint64_t ad = x_hi * n_lo;
+    const uint64_t bc = x_lo * n_hi;
+    const uint64_t bd = x_lo * n_lo;
+    const uint64_t mid34 = (bd >> 32) + (bc & 0xFFFFFFFF) + (ad & 0xFFFFFFFF);
+    const uint64_t upper64 = ac + (bc >> 32) + (ad >> 32) + (mid34 >> 32);
+    return upper64;
+}
+
+uint64_t HashToRange(const std::vector<uint8_t>& element, const uint64_t f)
+{
+    const uint64_t hash = CSipHasher(0x0706050403020100ULL, 0x0F0E0D0C0B0A0908ULL)
+                              .Write(element.data(), element.size())
+                              .Finalize();
+    return MapIntoRange(hash, f);
+}
+
+std::vector<uint64_t> BuildHashedSet(const std::unordered_set<std::vector<uint8_t>, ByteVectorHash>& elements, const uint64_t f)
+{
+    std::vector<uint64_t> hashed_elements;
+    hashed_elements.reserve(elements.size());
+    for (const std::vector<uint8_t>& element : elements) {
+        hashed_elements.push_back(HashToRange(element, f));
+    }
+    std::sort(hashed_elements.begin(), hashed_elements.end());
+    return hashed_elements;
+}
+} // namespace
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    std::vector<uint8_t> golomb_rice_data;
+    std::vector<uint64_t> encoded_deltas;
+    {
+        std::unordered_set<std::vector<uint8_t>, ByteVectorHash> elements;
+        const int n = fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 512);
+        for (int i = 0; i < n; ++i) {
+            elements.insert(ConsumeRandomLengthByteVector(fuzzed_data_provider, 16));
+        }
+        CVectorWriter stream(SER_NETWORK, 0, golomb_rice_data, 0);
+        WriteCompactSize(stream, static_cast<uint32_t>(elements.size()));
+        BitStreamWriter<CVectorWriter> bitwriter(stream);
+        if (!elements.empty()) {
+            uint64_t last_value = 0;
+            for (const uint64_t value : BuildHashedSet(elements, static_cast<uint64_t>(elements.size()) * static_cast<uint64_t>(BASIC_FILTER_M))) {
+                const uint64_t delta = value - last_value;
+                encoded_deltas.push_back(delta);
+                GolombRiceEncode(bitwriter, BASIC_FILTER_P, delta);
+                last_value = value;
+            }
+        }
+        bitwriter.Flush();
+    }
+
+    std::vector<uint64_t> decoded_deltas;
+    {
+        VectorReader stream{SER_NETWORK, 0, golomb_rice_data, 0};
+        BitStreamReader<VectorReader> bitreader(stream);
+        const uint32_t n = static_cast<uint32_t>(ReadCompactSize(stream));
+        for (uint32_t i = 0; i < n; ++i) {
+            decoded_deltas.push_back(GolombRiceDecode(bitreader, BASIC_FILTER_P));
+        }
+    }
+
+    assert(encoded_deltas == decoded_deltas);
+
+    {
+        const std::vector<uint8_t> random_bytes = ConsumeRandomLengthByteVector(fuzzed_data_provider, 1024);
+        VectorReader stream{SER_NETWORK, 0, random_bytes, 0};
+        uint32_t n;
+        try {
+            n = static_cast<uint32_t>(ReadCompactSize(stream));
+        } catch (const std::ios_base::failure&) {
+            return;
+        }
+        BitStreamReader<VectorReader> bitreader(stream);
+        for (uint32_t i = 0; i < std::min<uint32_t>(n, 1024); ++i) {
+            try {
+                (void)GolombRiceDecode(bitreader, BASIC_FILTER_P);
+            } catch (const std::ios_base::failure&) {
+            }
+        }
+    }
+}
diff --git a/src/util/golombrice.h b/src/util/golombrice.h
new file mode 100644
index 0000000000..425e7f6681
--- /dev/null
+++ b/src/util/golombrice.h
@@ -0,0 +1,43 @@
+// Copyright (c) 2018-2019 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_UTIL_GOLOMBRICE_H
+#define BITCOIN_UTIL_GOLOMBRICE_H
+
+#include <streams.h>
+
+#include <cstdint>
+
+template <typename OStream>
+void GolombRiceEncode(BitStreamWriter<OStream>& bitwriter, uint8_t P, uint64_t x)
+{
+    // Write quotient as unary-encoded: q 1's followed by one 0.
+    uint64_t q = x >> P;
+    while (q > 0) {
+        int nbits = q <= 64 ? static_cast<int>(q) : 64;
+        bitwriter.Write(~0ULL, nbits);
+        q -= nbits;
+    }
+    bitwriter.Write(0, 1);
+
+    // Write the remainder in P bits. Since the remainder is just the bottom
+    // P bits of x, there is no need to mask first.
+    bitwriter.Write(x, P);
+}
+
+template <typename IStream>
+uint64_t GolombRiceDecode(BitStreamReader<IStream>& bitreader, uint8_t P)
+{
+    // Read unary-encoded quotient: q 1's followed by one 0.
+    uint64_t q = 0;
+    while (bitreader.Read(1) == 1) {
+        ++q;
+    }
+
+    uint64_t r = bitreader.Read(P);
+
+    return (q << P) + r;
+}
+
+#endif // BITCOIN_UTIL_GOLOMBRICE_H

From bf04694e730000fe8635a73047fbac770843e150 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Fri, 20 Mar 2020 16:15:17 +0000
Subject: [PATCH 10/13] merge bitcoin#18393: Don't assume presence of
 __builtin_mul_overflow in MultiplicationOverflow(...) fuzzing harness

---
 src/test/fuzz/multiplication_overflow.cpp | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/test/fuzz/multiplication_overflow.cpp b/src/test/fuzz/multiplication_overflow.cpp
index 923db8058b..a4b158c18b 100644
--- a/src/test/fuzz/multiplication_overflow.cpp
+++ b/src/test/fuzz/multiplication_overflow.cpp
@@ -10,6 +10,14 @@
 #include <string>
 #include <vector>
 
+#if defined(__has_builtin)
+#if __has_builtin(__builtin_mul_overflow)
+#define HAVE_BUILTIN_MUL_OVERFLOW
+#endif
+#elif defined(__GNUC__) && (__GNUC__ >= 5)
+#define HAVE_BUILTIN_MUL_OVERFLOW
+#endif
+
 namespace {
 template <typename T>
 void TestMultiplicationOverflow(FuzzedDataProvider& fuzzed_data_provider)
@@ -17,12 +25,18 @@ void TestMultiplicationOverflow(FuzzedDataProvider& fuzzed_data_provider)
     const T i = fuzzed_data_provider.ConsumeIntegral<T>();
     const T j = fuzzed_data_provider.ConsumeIntegral<T>();
     const bool is_multiplication_overflow_custom = MultiplicationOverflow(i, j);
+#if defined(HAVE_BUILTIN_MUL_OVERFLOW)
     T result_builtin;
     const bool is_multiplication_overflow_builtin = __builtin_mul_overflow(i, j, &result_builtin);
     assert(is_multiplication_overflow_custom == is_multiplication_overflow_builtin);
     if (!is_multiplication_overflow_custom) {
         assert(i * j == result_builtin);
     }
+#else
+    if (!is_multiplication_overflow_custom) {
+        (void)(i * j);
+    }
+#endif
 }
 } // namespace
 
@@ -38,5 +52,4 @@ void test_one_input(const std::vector<uint8_t>& buffer)
     TestMultiplicationOverflow<char>(fuzzed_data_provider);
     TestMultiplicationOverflow<unsigned char>(fuzzed_data_provider);
     TestMultiplicationOverflow<signed char>(fuzzed_data_provider);
-    TestMultiplicationOverflow<bool>(fuzzed_data_provider);
 }

From e17767ccf1a8eb9fabfde7fb59531ce8d40b9d09 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Tue, 14 Jun 2022 12:00:48 +0530
Subject: [PATCH 11/13] merge bitcoin#19286: Add fuzzing harness for
 CHash{160,256}, C{HMAC_,}SHA{1,256,512}, CRIPEMD160, CSipHasher, etc.

---
 src/Makefile.test.include |   7 +++
 src/test/fuzz/crypto.cpp  | 123 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 130 insertions(+)
 create mode 100644 src/test/fuzz/crypto.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 1b881b03c0..717f7a1771 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -36,6 +36,7 @@ FUZZ_TARGETS = \
   test/fuzz/checkqueue \
   test/fuzz/coins_deserialize \
   test/fuzz/coins_view \
+  test/fuzz/crypto \
   test/fuzz/crypto_common \
   test/fuzz/cuckoocache \
   test/fuzz/decode_tx \
@@ -489,6 +490,12 @@ test_fuzz_coins_view_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_coins_view_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_coins_view_SOURCES = $(FUZZ_SUITE) test/fuzz/coins_view.cpp
 
+test_fuzz_crypto_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
+test_fuzz_crypto_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_crypto_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_crypto_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_crypto_SOURCES = $(FUZZ_SUITE) test/fuzz/crypto.cpp
+
 test_fuzz_crypto_common_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
 test_fuzz_crypto_common_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_crypto_common_LDADD = $(FUZZ_SUITE_LD_COMMON)
diff --git a/src/test/fuzz/crypto.cpp b/src/test/fuzz/crypto.cpp
new file mode 100644
index 0000000000..cf4f84889a
--- /dev/null
+++ b/src/test/fuzz/crypto.cpp
@@ -0,0 +1,123 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <crypto/hmac_sha256.h>
+#include <crypto/hmac_sha512.h>
+#include <crypto/ripemd160.h>
+#include <crypto/sha1.h>
+#include <crypto/sha256.h>
+#include <crypto/sha512.h>
+#include <hash.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cstdint>
+#include <vector>
+
+void test_one_input(const std::vector<uint8_t>& buffer)
+{
+    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
+    std::vector<uint8_t> data = ConsumeRandomLengthByteVector(fuzzed_data_provider);
+    if (data.empty()) {
+        data.resize(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 4096), fuzzed_data_provider.ConsumeIntegral<uint8_t>());
+    }
+
+    CHash160 hash160;
+    CHash256 hash256;
+    CHMAC_SHA256 hmac_sha256{data.data(), data.size()};
+    CHMAC_SHA512 hmac_sha512{data.data(), data.size()};
+    CRIPEMD160 ripemd160;
+    CSHA1 sha1;
+    CSHA256 sha256;
+    CSHA512 sha512;
+    CSipHasher sip_hasher{fuzzed_data_provider.ConsumeIntegral<uint64_t>(), fuzzed_data_provider.ConsumeIntegral<uint64_t>()};
+
+    while (fuzzed_data_provider.ConsumeBool()) {
+        switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 2)) {
+        case 0: {
+            if (fuzzed_data_provider.ConsumeBool()) {
+                data = ConsumeRandomLengthByteVector(fuzzed_data_provider);
+                if (data.empty()) {
+                    data.resize(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 4096), fuzzed_data_provider.ConsumeIntegral<uint8_t>());
+                }
+            }
+
+            (void)hash160.Write(data);
+            (void)hash256.Write(data);
+            (void)hmac_sha256.Write(data.data(), data.size());
+            (void)hmac_sha512.Write(data.data(), data.size());
+            (void)ripemd160.Write(data.data(), data.size());
+            (void)sha1.Write(data.data(), data.size());
+            (void)sha256.Write(data.data(), data.size());
+            (void)sha512.Write(data.data(), data.size());
+            (void)sip_hasher.Write(data.data(), data.size());
+
+            (void)Hash160(data);
+            (void)Hash160(data.begin(), data.end());
+            (void)sha512.Size();
+            break;
+        }
+        case 1: {
+            (void)hash160.Reset();
+            (void)hash256.Reset();
+            (void)ripemd160.Reset();
+            (void)sha1.Reset();
+            (void)sha256.Reset();
+            (void)sha512.Reset();
+            break;
+        }
+        case 2: {
+            switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 8)) {
+            case 0: {
+                data.resize(CHash160::OUTPUT_SIZE);
+                hash160.Finalize(data);
+                break;
+            }
+            case 1: {
+                data.resize(CHash256::OUTPUT_SIZE);
+                hash256.Finalize(data);
+                break;
+            }
+            case 2: {
+                data.resize(CHMAC_SHA256::OUTPUT_SIZE);
+                hmac_sha256.Finalize(data.data());
+                break;
+            }
+            case 3: {
+                data.resize(CHMAC_SHA512::OUTPUT_SIZE);
+                hmac_sha512.Finalize(data.data());
+                break;
+            }
+            case 4: {
+                data.resize(CRIPEMD160::OUTPUT_SIZE);
+                ripemd160.Finalize(data.data());
+                break;
+            }
+            case 5: {
+                data.resize(CSHA1::OUTPUT_SIZE);
+                sha1.Finalize(data.data());
+                break;
+            }
+            case 6: {
+                data.resize(CSHA256::OUTPUT_SIZE);
+                sha256.Finalize(data.data());
+                break;
+            }
+            case 7: {
+                data.resize(CSHA512::OUTPUT_SIZE);
+                sha512.Finalize(data.data());
+                break;
+            }
+            case 8: {
+                data.resize(1);
+                data[0] = sip_hasher.Finalize() % 256;
+                break;
+            }
+            }
+            break;
+        }
+        }
+    }
+}

From 141c6e29206c78afd8df50b63b98b21b65ff0432 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Thu, 10 Sep 2020 05:42:51 +0000
Subject: [PATCH 12/13] merge bitcoin#19934: Add fuzzing harness for Keccak and
 SHA3_256

---
 src/test/fuzz/crypto.cpp | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/test/fuzz/crypto.cpp b/src/test/fuzz/crypto.cpp
index cf4f84889a..456b773f27 100644
--- a/src/test/fuzz/crypto.cpp
+++ b/src/test/fuzz/crypto.cpp
@@ -7,6 +7,7 @@
 #include <crypto/ripemd160.h>
 #include <crypto/sha1.h>
 #include <crypto/sha256.h>
+#include <crypto/sha3.h>
 #include <crypto/sha512.h>
 #include <hash.h>
 #include <test/fuzz/FuzzedDataProvider.h>
@@ -32,6 +33,7 @@ void test_one_input(const std::vector<uint8_t>& buffer)
     CSHA1 sha1;
     CSHA256 sha256;
     CSHA512 sha512;
+    SHA3_256 sha3;
     CSipHasher sip_hasher{fuzzed_data_provider.ConsumeIntegral<uint64_t>(), fuzzed_data_provider.ConsumeIntegral<uint64_t>()};
 
     while (fuzzed_data_provider.ConsumeBool()) {
@@ -51,6 +53,7 @@ void test_one_input(const std::vector<uint8_t>& buffer)
             (void)ripemd160.Write(data.data(), data.size());
             (void)sha1.Write(data.data(), data.size());
             (void)sha256.Write(data.data(), data.size());
+            (void)sha3.Write(data);
             (void)sha512.Write(data.data(), data.size());
             (void)sip_hasher.Write(data.data(), data.size());
 
@@ -65,11 +68,12 @@ void test_one_input(const std::vector<uint8_t>& buffer)
             (void)ripemd160.Reset();
             (void)sha1.Reset();
             (void)sha256.Reset();
+            (void)sha3.Reset();
             (void)sha512.Reset();
             break;
         }
         case 2: {
-            switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 8)) {
+            switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 9)) {
             case 0: {
                 data.resize(CHash160::OUTPUT_SIZE);
                 hash160.Finalize(data);
@@ -115,9 +119,21 @@ void test_one_input(const std::vector<uint8_t>& buffer)
                 data[0] = sip_hasher.Finalize() % 256;
                 break;
             }
+            case 9: {
+                data.resize(SHA3_256::OUTPUT_SIZE);
+                sha3.Finalize(data);
+                break;
+            }
             }
             break;
         }
         }
     }
+    if (fuzzed_data_provider.ConsumeBool()) {
+        uint64_t state[25];
+        for (size_t i = 0; i < 25; ++i) {
+            state[i] = fuzzed_data_provider.ConsumeIntegral<uint64_t>();
+        }
+        KeccakF(state);
+    }
 }

From 38781fc11478bb2fe1cffae51f964d2fa1a8de50 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kittywhiskers@users.noreply.github.com>
Date: Thu, 23 Jan 2020 11:47:12 +0000
Subject: [PATCH 13/13] merge bitcoin#17989: Add one specialized
 ProcessMessage(...) fuzzing binary per message type for optimal results when
 using coverage-guided fuzzing

---
 src/Makefile.test.include | 169 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 168 insertions(+), 1 deletion(-)

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 717f7a1771..4b3dceea9e 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -3,7 +3,6 @@
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
-
 FUZZ_TARGETS = \
   test/fuzz/addition_overflow \
   test/fuzz/addr_info_deserialize \
@@ -79,6 +78,30 @@ FUZZ_TARGETS = \
   test/fuzz/prefilled_transaction_deserialize \
   test/fuzz/process_messages \
   test/fuzz/process_message \
+  test/fuzz/process_message_addr \
+  test/fuzz/process_message_block \
+  test/fuzz/process_message_blocktxn \
+  test/fuzz/process_message_cmpctblock \
+  test/fuzz/process_message_feefilter \
+  test/fuzz/process_message_filteradd \
+  test/fuzz/process_message_filterclear \
+  test/fuzz/process_message_filterload \
+  test/fuzz/process_message_getaddr \
+  test/fuzz/process_message_getblocks \
+  test/fuzz/process_message_getblocktxn \
+  test/fuzz/process_message_getdata \
+  test/fuzz/process_message_getheaders \
+  test/fuzz/process_message_headers \
+  test/fuzz/process_message_inv \
+  test/fuzz/process_message_mempool \
+  test/fuzz/process_message_notfound \
+  test/fuzz/process_message_ping \
+  test/fuzz/process_message_pong \
+  test/fuzz/process_message_sendcmpct \
+  test/fuzz/process_message_sendheaders \
+  test/fuzz/process_message_tx \
+  test/fuzz/process_message_verack \
+  test/fuzz/process_message_version \
   test/fuzz/psbt_input_deserialize \
   test/fuzz/psbt_output_deserialize \
   test/fuzz/pub_key_deserialize \
@@ -748,6 +771,150 @@ test_fuzz_process_message_LDADD = $(FUZZ_SUITE_LD_COMMON)
 test_fuzz_process_message_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
 test_fuzz_process_message_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
 
+test_fuzz_process_message_addr_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=addr
+test_fuzz_process_message_addr_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_addr_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_addr_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_addr_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_block_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=block
+test_fuzz_process_message_block_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_block_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_block_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_block_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_blocktxn_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=blocktxn
+test_fuzz_process_message_blocktxn_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_blocktxn_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_blocktxn_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_blocktxn_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_cmpctblock_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=cmpctblock
+test_fuzz_process_message_cmpctblock_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_cmpctblock_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_cmpctblock_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_cmpctblock_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_feefilter_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=feefilter
+test_fuzz_process_message_feefilter_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_feefilter_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_feefilter_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_feefilter_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_filteradd_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=filteradd
+test_fuzz_process_message_filteradd_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_filteradd_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_filteradd_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_filteradd_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_filterclear_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=filterclear
+test_fuzz_process_message_filterclear_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_filterclear_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_filterclear_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_filterclear_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_filterload_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=filterload
+test_fuzz_process_message_filterload_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_filterload_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_filterload_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_filterload_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_getaddr_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=getaddr
+test_fuzz_process_message_getaddr_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_getaddr_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_getaddr_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_getaddr_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_getblocks_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=getblocks
+test_fuzz_process_message_getblocks_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_getblocks_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_getblocks_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_getblocks_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_getblocktxn_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=getblocktxn
+test_fuzz_process_message_getblocktxn_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_getblocktxn_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_getblocktxn_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_getblocktxn_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_getdata_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=getdata
+test_fuzz_process_message_getdata_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_getdata_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_getdata_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_getdata_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_getheaders_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=getheaders
+test_fuzz_process_message_getheaders_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_getheaders_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_getheaders_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_getheaders_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_headers_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=headers
+test_fuzz_process_message_headers_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_headers_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_headers_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_headers_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_inv_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=inv
+test_fuzz_process_message_inv_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_inv_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_inv_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_inv_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_mempool_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=mempool
+test_fuzz_process_message_mempool_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_mempool_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_mempool_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_mempool_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_notfound_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=notfound
+test_fuzz_process_message_notfound_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_notfound_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_notfound_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_notfound_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_ping_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=ping
+test_fuzz_process_message_ping_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_ping_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_ping_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_ping_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_pong_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=pong
+test_fuzz_process_message_pong_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_pong_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_pong_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_pong_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_sendcmpct_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=sendcmpct
+test_fuzz_process_message_sendcmpct_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_sendcmpct_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_sendcmpct_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_sendcmpct_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_sendheaders_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=sendheaders
+test_fuzz_process_message_sendheaders_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_sendheaders_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_sendheaders_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_sendheaders_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_tx_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=tx
+test_fuzz_process_message_tx_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_tx_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_tx_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_tx_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_verack_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=verack
+test_fuzz_process_message_verack_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_verack_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_verack_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_verack_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
+test_fuzz_process_message_version_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DMESSAGE_TYPE=version
+test_fuzz_process_message_version_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
+test_fuzz_process_message_version_LDADD = $(FUZZ_SUITE_LD_COMMON)
+test_fuzz_process_message_version_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) $(LDFLAGS_WRAP_EXCEPTIONS)
+test_fuzz_process_message_version_SOURCES = $(FUZZ_SUITE) test/fuzz/process_message.cpp
+
 test_fuzz_psbt_input_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DPSBT_INPUT_DESERIALIZE=1
 test_fuzz_psbt_input_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 test_fuzz_psbt_input_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)