Add fuzz target for ShortId parsing - #1826
Merged
benalleng merged 1 commit intoAug 21, 2026
Merged
Conversation
caarloshenriq
requested review from
DanGould,
benalleng and
spacebear21
as code owners
August 19, 2026 18:19
Collaborator
Coverage Report for CI Build 32400373640Coverage remained the same at 86.718%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
benalleng
previously approved these changes
Aug 20, 2026
benalleng
left a comment
benalleng
left a comment
Collaborator
There was a problem hiding this comment.
TACK 7200876
directory_short_id
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1601642367
...
#4741050: cov: 280 ft: 874 corp: 156 exec/s: 139574 oom/timeout/crash: 0/0/0 time: 37s job: 7 dft_time: 0
INFO: fuzzed for 37 seconds, wrapping up soon
erickcestari
suggested changes
Aug 20, 2026
caarloshenriq
force-pushed
the
feat/fuzz-directory-short-id
branch
from
August 20, 2026 17:26
7200876 to
e2fbef6
Compare
Add a libFuzzer target covering payjoin::directory::ShortId, the
64-bit identifier used in Payjoin Directory URL path segments.
The target exercises three paths: TryFrom<&[u8]> on raw 8-byte
slices, FromStr on attacker-controlled bech32 strings as seen by
payjoin-mailroom when routing /{id} requests, and a structured
mutation path that corrupts known-good encodings (truncation,
character substitution, case change, transposition, overlong
input, trailing garbage) to keep the fuzzer near the parser's
acceptance boundary.
All three paths assert that a successfully parsed ShortId
round-trips through Display/FromStr, since sender and receiver
depend on that round-trip to agree on a session's mailbox.
Addresses part of the payjoin directory fuzzing candidate in
payjoin#1267. The network-facing OHTTP/bhttp handling in
payjoin-mailroom is left for a follow-up pending discussion on
the intended scope of that item.
caarloshenriq
force-pushed
the
feat/fuzz-directory-short-id
branch
from
August 20, 2026 17:56
e2fbef6 to
8f4aad6
Compare
benalleng
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a libFuzzer target for
payjoin::directory::ShortId, the 64-bit identifier used in Payjoin Directory URL path segments (/{id}).What is covered
Three input paths are exercised:
TryFrom<&[u8]>: raw 8-byte slices, as stored internally and compared against database keys. Any length other than 8 must be rejected; the target asserts this explicitly.FromStr: attacker-controlled bech32-without-checksum strings, the actual path exercised bypayjoin-mailroomwhen routing incoming requests.fuzz_near_valid): builds a valid encoding from the input seed, then corrupts it using the remaining bytes as a mutation opcode (truncation, single character substitution, case change, transposition, overlong segment, trailing garbage). This keeps the fuzzer near the parser's acceptance boundary rather than generating inputs that are rejected on the first invalid character.All three paths assert that a successfully parsed
ShortIdround-trips throughDisplay/FromStr. Sender and receiver both derive the mailbox URL from this string, so any asymmetry between encoding and decoding would split a session silently.What is not covered
The network-facing OHTTP/bhttp handling in
payjoin-mailroomis out of scope here. Covering those handlers would require addingtokio/axum/hyperto the fuzz crate. The next logical step is fuzzing the session routing and mailboxmatching logic using
Arbitraryon payjoin protocol types, pending #1662 and the upstreamrust-bitcoinArbitraryrelease.Fuzzing results
Run on x86_64 Linux, 6 forks (
nproc - 2), 305 seconds:Coverage saturated at ~72s and held stable through the remaining ~230s, confirming the reachable space for this parser is fully explored. The target's value going forward is regression detection: any change to
ShortId,bech32::nochecksum, or theDisplay/FromStrcontract will surface here before reaching CI.Addresses part of #1267.
Disclosure: co-authored by Claude
Pull Request Checklist
Please confirm the following before requesting review:
AI
in the body of this PR.