Add fuzz target for payjoin v2 URI parsing - #1848
Merged
Merged
Conversation
caarloshenriq
requested review from
DanGould,
benalleng and
spacebear21
as code owners
August 27, 2026 15:37
Collaborator
Coverage Report for CI Build 33417410484Coverage remained the same at 86.64%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
Collaborator
|
Looks like needs a rebase. |
Covers the v2-specific fragment parameters (EX1, OH1, RK1) that the existing uri_deserialize_pjuri target never reaches. A custom mutator seeds the fuzzer with a valid v2 pj parameter so it reaches the v2 parsing paths from an empty corpus. 25% of mutations pass straight to fuzzer_mutate to keep the reject paths covered.
caarloshenriq
force-pushed
the
feat/fuzz-pjuri-v2
branch
from
August 31, 2026 17:02
b1642bf to
40690ca
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a libFuzzer target for the v2-specific URI parsing paths in
payjoin::Uri, covering the fragment parameters that the existinguri_deserialize_pjuritarget never reaches.What is covered
The v2
pjparameter encodes three required fields in the URL fragment:EX1(expiration),OH1(OHTTP keys), andRK1(receiver HPKE pubkey), each encoded as bech32 without a checksum.
The target exercises:
v2::PjParam::parse: validates that all three fields are present and uppercasecheck_fragment_delimiter: backwards-compatible+/-delimiter handlingget_param/set_param: fragment parameter extraction and round-trip reconstructionOhttpKeys::try_from: OHTTP key deserializationHpkePublicKey::from_compressed_bytes: secp256k1 pubkey parsingMutator design
Follows the same structure as
uri_deserialize_pjuri: a custom mutator preserves a valid bitcoin address and spends the mutation budget on the query.DEFAULT_QUERYseeds the fuzzer with a well-formed v2pjparameter so it reaches the v2 parsing paths from an empty corpus without needing to construct checksummed or bech32-encoded values by chance. 25% of mutations pass straight tofuzzer_mutateto keep the reject paths and non-UTF-8 handling covered.Fuzzing results
Run from an empty corpus on x86_64 Linux, 1 fork, 38 seconds:
Closes part of #1267.
Disclosure: co-authored by Claude
Pull Request Checklist
Please confirm the following before requesting review:
AI
in the body of this PR.