hyperledger-labs / fabric-smart-client / 34848468181
91%

DEFAULT BRANCH: main
Ran
Jobs 22
Files 505
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 85.335% (+0.03%) from 85.31%
34848468181

push

github

web-flow 
test: add fuzz coverage for pre-auth parsing paths (#1818)

Adds native Go fuzz targets for byte-parsing paths a remote peer reaches
before signature verification, where a panic is a remotely triggerable DoS:

- platform/fabric/core/generic/msp/x509: FuzzDeserializeVerifier, covering
  both key- and certificate-backed identities through the shared
  proto.Unmarshal -> PemDecodeKey path.
- platform/view/services/comm/io: FuzzVarintReaderReadData, the length-prefix
  framing reader on inbound peer streams.
- platform/view/services/comm: FuzzPKExtractorExtractPublicKey.

These join the existing transaction-package targets (FuzzUnpackSignedProposal,
FuzzUnpackEnvelopeFromBytes, FuzzTransactionSetFromBytes,
FuzzTransactionSetFromEnvelopeBytes) in .github/workflows/fuzz.yml's nightly
matrix, one job per target at a 2h -fuzztime budget.

Most targets are crash-only, matching stdlib precedent (encoding/pem,
crypto/x509): the fuzzing engine's own panic reporting is the check. Three
targets whose functions carry a documented postcondition beyond "don't panic"
assert it on the success path: FuzzVarintReaderReadData asserts the returned
buffer never exceeds the configured max message size; FuzzUnpackSignedProposal
and FuzzUnpackEnvelopeFromBytes assert their documented "no zero-ed fields on
success" guarantee, which downstream code relies on via unguarded field
access. All targets use testify/require for setup and rely on the fuzzing
engine's native panic reporting rather than a defer/recover wrapper.

docs/dev/testing.md documents the targets and the crash-reproduction workflow.

Signed-off-by: Shashank <yshashank959@gmail.com>
Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>

27251 of 31934 relevant lines covered (85.34%)

2348.27 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
86.15
1.66% platform/view/services/comm/host/websocket/ws/multiplexed_provider.go
2
90.76
-0.66% platform/view/services/comm/p2p.go
1
98.04
-1.96% platform/common/utils/cache/timeout.go
Jobs
ID Job ID Ran Files Coverage
1 utest-postgres - 34848468181.1 496
9.71
GitHub Action Run
2 itest-fabric-iouhsm - 34848468181.2 461
39.72
GitHub Action Run
3 itest-fabric-iou-libp2p - 34848468181.3 461
36.53
GitHub Action Run
4 itest-fabricx-atsa - 34848468181.4 483
30.82
GitHub Action Run
5 utest-extensions - 34848468181.5 8
52.57
GitHub Action Run
6 utest-root - 34848468181.6 496
80.56
GitHub Action Run
7 itest-fabric-iou - 34848468181.7 461
40.44
GitHub Action Run
8 itest-fabric-configupdate - 34848468181.8 461
38.73
GitHub Action Run
9 itest-fabric-twonets - 34848468181.9 451
29.12
GitHub Action Run
10 itest-fsc-pingpong - 34848468181.10 249
34.42
GitHub Action Run
11 itest-fsc-stoprestart - 34848468181.11 245
33.32
GitHub Action Run
12 itest-fabricx-configupdate - 34848468181.12 483
28.5
GitHub Action Run
13 itest-fabric-stoprestart - 34848468181.13 451
31.11
GitHub Action Run
14 itest-fabric-atsa - 34848468181.14 451
43.71
GitHub Action Run
15 itest-fabricx-multiendorsement - 34848468181.15 483
28.52
GitHub Action Run
16 itest-fabric-events - 34848468181.16 456
28.97
GitHub Action Run
17 itest-fabricx-iou - 34848468181.17 483
29.36
GitHub Action Run
18 itest-fabricx-deployment - 34848468181.18 483
28.51
GitHub Action Run
19 itest-fabric-runtimeconfig - 34848468181.19 461
38.88
GitHub Action Run
20 itest-fabric-atsachaincode - 34848468181.20 456
30.85
GitHub Action Run
21 itest-fsc-signedpingpong - 34848468181.21 243
31.44
GitHub Action Run
22 itest-fabricx-simple - 34848468181.22 483
27.87
GitHub Action Run
Source Files on build 34848468181