4 files changed, 88 insertions, 6 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9efd66f..ba8074c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,9 @@ jobs:
       - name: Run P2P message fuzz smoke
         run: make fuzz-net-message-smoke
 
+      - name: Run script fuzz smoke
+        run: make fuzz-script-smoke
+
   windows-ucrt64:
     name: Windows UCRT64 selftests
     runs-on: windows-latest
diff --git a/Makefile b/Makefile
index 736f5d8..d0f1b26 100644
--- a/Makefile
+++ b/Makefile
@@ -194,6 +194,9 @@ tests:
 fuzz-net-message-smoke: deps-linux
         $(MAKE) -C src -f Makefile fuzz-net-message-smoke
 
+fuzz-script-smoke: deps-linux
+        $(MAKE) -C src -f Makefile fuzz-script-smoke
+
 checksums:
         ./scripts/make-release-checksums.sh
 
@@ -204,5 +207,5 @@ verify-release:
         ./scripts/verify-release.sh $(if $(TAG),$(TAG),latest)
 
 .PHONY: linux windows clean appimage \
-        tests fuzz-net-message-smoke checksums sign-checksums verify-release \
+        tests fuzz-net-message-smoke fuzz-script-smoke checksums sign-checksums verify-release \
         deps-linux deps-windows deps-apt deps-secp256k1 deps-randomx
diff --git a/src/Makefile b/src/Makefile
index ac0226e..cc52fd6 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -121,8 +121,9 @@ NODE_LIBS = -L$(SECP_LIB) -lsecp256k1 \
 NODE_ONLY_OBJS = $(patsubst obj/%,obj-node/%,$(NODE_OBJS)) \
                  obj-node/main_gui.o obj-node/headless.o
 
-FUZZ_OBJS = $(patsubst obj/%,obj-fuzz/%,$(NODE_OBJS)) \
-            obj-fuzz/fuzz_net_message.o
+FUZZ_BASE_OBJS = $(patsubst obj/%,obj-fuzz/%,$(NODE_OBJS))
+FUZZ_NET_MESSAGE_OBJS = $(FUZZ_BASE_OBJS) obj-fuzz/fuzz_net_message.o
+FUZZ_SCRIPT_OBJS = $(FUZZ_BASE_OBJS) obj-fuzz/fuzz_script.o
 
 obj-node/%.o: %.cpp $(HEADERS)
         @mkdir -p obj-node
@@ -148,19 +149,35 @@ obj-fuzz/fuzz_net_message.o: fuzz_net_message.cpp $(HEADERS)
         @mkdir -p obj-fuzz
         $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -o $@ $<
 
-fuzz-net-message: $(FUZZ_OBJS)
+obj-fuzz/fuzz_script.o: fuzz_script.cpp $(HEADERS)
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -o $@ $<
+
+fuzz-net-message: $(FUZZ_NET_MESSAGE_OBJS)
         $(FUZZ_CXX) $(filter-out -fsanitize=fuzzer-no-link%,$(FUZZ_CXXFLAGS)) \
           $(FUZZ_LDFLAGS) -o $@ $^ $(NODE_LIBS)
         @echo "Built: fuzz-net-message"
 
+fuzz-script: $(FUZZ_SCRIPT_OBJS)
+        $(FUZZ_CXX) $(filter-out -fsanitize=fuzzer-no-link%,$(FUZZ_CXXFLAGS)) \
+          $(FUZZ_LDFLAGS) -o $@ $^ $(NODE_LIBS)
+        @echo "Built: fuzz-script"
+
 fuzz-net-message-smoke: fuzz-net-message
         @mkdir -p ../work/fuzz-corpus/net-message
         @printf '\277\040\134\375ping\000\000\000\000\000\000\000\000\000\000\000\000' > ../work/fuzz-corpus/net-message/ping-header
         @printf '\277\040\134\375version\000\000\000\000\000\000\000\000\000' > ../work/fuzz-corpus/net-message/version-header
         ./fuzz-net-message -runs=128 ../work/fuzz-corpus/net-message
 
+fuzz-script-smoke: fuzz-script
+        @mkdir -p ../work/fuzz-corpus/script
+        @printf '\000\121' > ../work/fuzz-corpus/script/op-true
+        @printf '\001\166\251\024\001\002\003\004\005\006\007\010\011\012\013\014\015\016\017\020\021\022\023\024\210\254' > ../work/fuzz-corpus/script/p2pkh-shape
+        @printf '\000\115\377\377' > ../work/fuzz-corpus/script/truncated-pushdata2
+        ./fuzz-script -runs=128 ../work/fuzz-corpus/script
+
 clean:
-        rm -rf obj obj-node obj-fuzz bitflash bitflash-node fuzz-net-message test_bip32
+        rm -rf obj obj-node obj-fuzz bitflash bitflash-node fuzz-net-message fuzz-script test_bip32
 
 test_bip32: test_bip32.cpp bip32.cpp bip32.h bip39_english.h
         $(CXX) $(CXXFLAGS) -o $@ test_bip32.cpp bip32.cpp -lssl -lcrypto
@@ -175,4 +192,4 @@ tests: test_bip32 bitflash-node
         ./bitflash-node -selftest=net-message
         ./bitflash-node -selftest=consensus-limits
 
-.PHONY: tests fuzz-net-message-smoke
+.PHONY: tests fuzz-net-message-smoke fuzz-script-smoke
diff --git a/src/fuzz_script.cpp b/src/fuzz_script.cpp
new file mode 100644
index 0000000..28c84f6
--- /dev/null
+++ b/src/fuzz_script.cpp
@@ -0,0 +1,59 @@
+// Copyright (c) 2026 Bitflash developers
+// Distributed under the MIT/X11 software license.
+//
+// libFuzzer harness for raw script parsing and evaluation. It keeps the
+// target deliberately small: arbitrary bytes become one CScript, then the
+// parser, standard-script extractors and EvalScript all see that same input.
+
+#include "headers_core.h"
+
+#include <stdint.h>
+#include <stddef.h>
+
+// Stand-ins normally supplied by the GUI/headless entry objects.
+map<string,string> mapAddressBook;
+bool gPoolServerRunning = false;
+void MainFrameRepaint() {}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    if (size < 1 || size > 4096)
+        return 0;
+
+    try
+    {
+        int nHashType = data[0];
+        const unsigned char* pbegin = data + 1;
+        const unsigned char* pend = data + size;
+        CScript script(pbegin, pend);
+
+        CScript::const_iterator pc = script.begin();
+        opcodetype opcode;
+        vector<unsigned char> vchPush;
+        while (pc < script.end())
+        {
+            if (!script.GetOp(pc, opcode, vchPush))
+                break;
+        }
+
+        script.GetSigOpCount();
+        script.ToString();
+
+        vector<unsigned char> vchPubKey;
+        ExtractPubKey(script, false, vchPubKey);
+        uint160 hash160;
+        ExtractHash160(script, hash160);
+
+        CTransaction tx;
+        tx.vin.push_back(CTxIn(COutPoint(), CScript()));
+        tx.vout.push_back(CTxOut(0, CScript()));
+
+        vector<vector<unsigned char> > stack;
+        EvalScript(script, tx, 0, nHashType, &stack);
+    }
+    catch (...)
+    {
+    }
+
+    return 0;
+}