fuzz: add P2P message parser harness (#142)

* fuzz: add P2P message parser harness

* fuzz: avoid duplicate legacy header includes

* fuzz: seed the corpus with our network magic, not Bitcoin's

The two seed inputs began f5 be b6 d9, which is Bitcoin's message
start. Ours is bf 20 5c fd. CMessageHeader::IsValid rejects on that
field first, so both seeds died at the first check and the smoke run
exercised the reject path and nothing else.

libFuzzer would have to mutate its way onto four exact bytes before
reaching any parser, which does not happen in 128 runs. The job would
have gone green while covering none of what it was added to cover.

---------

Co-authored-by: Gilcimar Duarte <ti@gpm.infra>
Co-authored-by: Bitflash-sh <btf01@proton.me>

4 files changed, 73 insertions, 3 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 985ba8a..9efd66f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,6 +25,9 @@ jobs:
       - name: Run Linux selftests
         run: make tests
 
+      - name: Run P2P message fuzz smoke
+        run: make fuzz-net-message-smoke
+
   windows-ucrt64:
     name: Windows UCRT64 selftests
     runs-on: windows-latest
diff --git a/Makefile b/Makefile
index 0788b61..736f5d8 100644
--- a/Makefile
+++ b/Makefile
@@ -42,7 +42,7 @@ deps-apt:
         @if command -v apt-get >/dev/null 2>&1; then \
           $(SUDO) apt-get install -y build-essential cmake git pkg-config autoconf \
             libtool libssl-dev libdb5.3++-dev libsodium-dev nlohmann-json3-dev \
-            libboost-system-dev libglfw3-dev libgl-dev python3-pil; \
+            libboost-system-dev libglfw3-dev libgl-dev python3-pil clang; \
         else \
           echo "Not an apt system — install: g++ cmake git autoconf libtool"; \
           echo "  libssl libdb++ libsodium nlohmann-json boost glfw3 opengl python3-pil"; \
@@ -191,6 +191,9 @@ clean:
 tests:
         $(MAKE) -C src -f Makefile tests
 
+fuzz-net-message-smoke: deps-linux
+        $(MAKE) -C src -f Makefile fuzz-net-message-smoke
+
 checksums:
         ./scripts/make-release-checksums.sh
 
@@ -201,5 +204,5 @@ verify-release:
         ./scripts/verify-release.sh $(if $(TAG),$(TAG),latest)
 
 .PHONY: linux windows clean appimage \
-        tests checksums sign-checksums verify-release \
+        tests fuzz-net-message-smoke checksums sign-checksums verify-release \
         deps-linux deps-windows deps-apt deps-secp256k1 deps-randomx
diff --git a/src/Makefile b/src/Makefile
index 3577dd6..ac0226e 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -2,6 +2,7 @@
 # Called by: make linux (root Makefile)
 
 CXX ?= g++
+FUZZ_CXX ?= clang++
 
 SECP_INC    ?= /usr/local/include
 SECP_LIB    ?= /usr/local/lib
@@ -33,6 +34,9 @@ CXXFLAGS = -std=gnu++14 -O2 $(WARNFLAGS) -fpermissive -pthread \
            -I$(SECP_INC) -I$(RANDOMX_DIR)/src \
            -I/usr/include/nlohmann \
            -I$(IMGUI_DIR)
+FUZZ_CXXFLAGS = $(filter-out -O2,$(CXXFLAGS)) -O1 -g -fno-omit-frame-pointer \
+                -fsanitize=fuzzer-no-link,address,undefined
+FUZZ_LDFLAGS = -fsanitize=fuzzer,address,undefined
 
 LIBS = -L$(SECP_LIB) -lsecp256k1 \
        -L$(RANDOMX_DIR)/build -lrandomx \
@@ -117,6 +121,9 @@ NODE_LIBS = -L$(SECP_LIB) -lsecp256k1 \
 NODE_ONLY_OBJS = $(patsubst obj/%,obj-node/%,$(NODE_OBJS)) \
                  obj-node/main_gui.o obj-node/headless.o
 
+FUZZ_OBJS = $(patsubst obj/%,obj-fuzz/%,$(NODE_OBJS)) \
+            obj-fuzz/fuzz_net_message.o
+
 obj-node/%.o: %.cpp $(HEADERS)
         @mkdir -p obj-node
         $(CXX) -c $(CXXFLAGS) -DBITFLASH_NO_GUI -o $@ $<
@@ -129,8 +136,31 @@ bitflash-node: $(NODE_ONLY_OBJS)
         $(CXX) $(CXXFLAGS) -o $@ $^ $(NODE_LIBS)
         @echo "Built: bitflash-node (headless, no libGL needed)"
 
+obj-fuzz/%.o: %.cpp $(HEADERS)
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -o $@ $<
+
+obj-fuzz/sha.o: sha.cpp sha.h
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -O1 -o $@ $<
+
+obj-fuzz/fuzz_net_message.o: fuzz_net_message.cpp $(HEADERS)
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -o $@ $<
+
+fuzz-net-message: $(FUZZ_OBJS)
+        $(FUZZ_CXX) $(filter-out -fsanitize=fuzzer-no-link%,$(FUZZ_CXXFLAGS)) \
+          $(FUZZ_LDFLAGS) -o $@ $^ $(NODE_LIBS)
+        @echo "Built: fuzz-net-message"
+
+fuzz-net-message-smoke: fuzz-net-message
+        @mkdir -p ../work/fuzz-corpus/net-message
+        @printf '\277\040\134\375ping\000\000\000\000\000\000\000\000\000\000\000\000' > ../work/fuzz-corpus/net-message/ping-header
+        @printf '\277\040\134\375version\000\000\000\000\000\000\000\000\000' > ../work/fuzz-corpus/net-message/version-header
+        ./fuzz-net-message -runs=128 ../work/fuzz-corpus/net-message
+
 clean:
-        rm -rf obj obj-node bitflash bitflash-node test_bip32
+        rm -rf obj obj-node obj-fuzz bitflash bitflash-node fuzz-net-message test_bip32
 
 test_bip32: test_bip32.cpp bip32.cpp bip32.h bip39_english.h
         $(CXX) $(CXXFLAGS) -o $@ test_bip32.cpp bip32.cpp -lssl -lcrypto
@@ -144,3 +174,5 @@ tests: test_bip32 bitflash-node
         ./bitflash-node -selftest=wallet-encrypt
         ./bitflash-node -selftest=net-message
         ./bitflash-node -selftest=consensus-limits
+
+.PHONY: tests fuzz-net-message-smoke
diff --git a/src/fuzz_net_message.cpp b/src/fuzz_net_message.cpp
new file mode 100644
index 0000000..1104d90
--- /dev/null
+++ b/src/fuzz_net_message.cpp
@@ -0,0 +1,32 @@
+// Copyright (c) 2026 Bitflash developers
+// Distributed under the MIT/X11 software license.
+//
+// libFuzzer harness for the P2P message envelope parser. It feeds arbitrary
+// receive-buffer bytes into ProcessMessages() through a dummy CNode, without
+// opening sockets or starting node threads.
+
+#include "headers_core.h"
+
+#include <stdint.h>
+#include <stddef.h>
+
+// Stand-ins normally supplied by the GUI/headless entry objects.
+map<string,string> mapAddressBook;
+bool gPoolServerRunning = false;
+void MainFrameRepaint() {}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    // Keep this first target focused on parser behavior, not multi-megabyte
+    // allocation pressure. The protocol size guards have their own selftest.
+    if (size > 4096)
+        return 0;
+
+    CNode node(INVALID_SOCKET, CAddress("127.0.0.1"));
+    node.nVersion = 0; // exercise pre-version gating plus the version parser
+    if (size > 0)
+        node.vRecv.write((const char*)data, (int)size);
+
+    ProcessMessages(&node);
+    return 0;
+}