2 files changed, 65 insertions, 1 deletions

diff --git a/src/Makefile b/src/Makefile
index 3577dd6..ac0226e 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -2,6 +2,7 @@
 # Called by: make linux (root Makefile)
 
 CXX ?= g++
+FUZZ_CXX ?= clang++
 
 SECP_INC    ?= /usr/local/include
 SECP_LIB    ?= /usr/local/lib
@@ -33,6 +34,9 @@ CXXFLAGS = -std=gnu++14 -O2 $(WARNFLAGS) -fpermissive -pthread \
            -I$(SECP_INC) -I$(RANDOMX_DIR)/src \
            -I/usr/include/nlohmann \
            -I$(IMGUI_DIR)
+FUZZ_CXXFLAGS = $(filter-out -O2,$(CXXFLAGS)) -O1 -g -fno-omit-frame-pointer \
+                -fsanitize=fuzzer-no-link,address,undefined
+FUZZ_LDFLAGS = -fsanitize=fuzzer,address,undefined
 
 LIBS = -L$(SECP_LIB) -lsecp256k1 \
        -L$(RANDOMX_DIR)/build -lrandomx \
@@ -117,6 +121,9 @@ NODE_LIBS = -L$(SECP_LIB) -lsecp256k1 \
 NODE_ONLY_OBJS = $(patsubst obj/%,obj-node/%,$(NODE_OBJS)) \
                  obj-node/main_gui.o obj-node/headless.o
 
+FUZZ_OBJS = $(patsubst obj/%,obj-fuzz/%,$(NODE_OBJS)) \
+            obj-fuzz/fuzz_net_message.o
+
 obj-node/%.o: %.cpp $(HEADERS)
         @mkdir -p obj-node
         $(CXX) -c $(CXXFLAGS) -DBITFLASH_NO_GUI -o $@ $<
@@ -129,8 +136,31 @@ bitflash-node: $(NODE_ONLY_OBJS)
         $(CXX) $(CXXFLAGS) -o $@ $^ $(NODE_LIBS)
         @echo "Built: bitflash-node (headless, no libGL needed)"
 
+obj-fuzz/%.o: %.cpp $(HEADERS)
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -o $@ $<
+
+obj-fuzz/sha.o: sha.cpp sha.h
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -O1 -o $@ $<
+
+obj-fuzz/fuzz_net_message.o: fuzz_net_message.cpp $(HEADERS)
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -o $@ $<
+
+fuzz-net-message: $(FUZZ_OBJS)
+        $(FUZZ_CXX) $(filter-out -fsanitize=fuzzer-no-link%,$(FUZZ_CXXFLAGS)) \
+          $(FUZZ_LDFLAGS) -o $@ $^ $(NODE_LIBS)
+        @echo "Built: fuzz-net-message"
+
+fuzz-net-message-smoke: fuzz-net-message
+        @mkdir -p ../work/fuzz-corpus/net-message
+        @printf '\277\040\134\375ping\000\000\000\000\000\000\000\000\000\000\000\000' > ../work/fuzz-corpus/net-message/ping-header
+        @printf '\277\040\134\375version\000\000\000\000\000\000\000\000\000' > ../work/fuzz-corpus/net-message/version-header
+        ./fuzz-net-message -runs=128 ../work/fuzz-corpus/net-message
+
 clean:
-        rm -rf obj obj-node bitflash bitflash-node test_bip32
+        rm -rf obj obj-node obj-fuzz bitflash bitflash-node fuzz-net-message test_bip32
 
 test_bip32: test_bip32.cpp bip32.cpp bip32.h bip39_english.h
         $(CXX) $(CXXFLAGS) -o $@ test_bip32.cpp bip32.cpp -lssl -lcrypto
@@ -144,3 +174,5 @@ tests: test_bip32 bitflash-node
         ./bitflash-node -selftest=wallet-encrypt
         ./bitflash-node -selftest=net-message
         ./bitflash-node -selftest=consensus-limits
+
+.PHONY: tests fuzz-net-message-smoke
diff --git a/src/fuzz_net_message.cpp b/src/fuzz_net_message.cpp
new file mode 100644
index 0000000..1104d90
--- /dev/null
+++ b/src/fuzz_net_message.cpp
@@ -0,0 +1,32 @@
+// Copyright (c) 2026 Bitflash developers
+// Distributed under the MIT/X11 software license.
+//
+// libFuzzer harness for the P2P message envelope parser. It feeds arbitrary
+// receive-buffer bytes into ProcessMessages() through a dummy CNode, without
+// opening sockets or starting node threads.
+
+#include "headers_core.h"
+
+#include <stdint.h>
+#include <stddef.h>
+
+// Stand-ins normally supplied by the GUI/headless entry objects.
+map<string,string> mapAddressBook;
+bool gPoolServerRunning = false;
+void MainFrameRepaint() {}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    // Keep this first target focused on parser behavior, not multi-megabyte
+    // allocation pressure. The protocol size guards have their own selftest.
+    if (size > 4096)
+        return 0;
+
+    CNode node(INVALID_SOCKET, CAddress("127.0.0.1"));
+    node.nVersion = 0; // exercise pre-version gating plus the version parser
+    if (size > 0)
+        node.vRecv.write((const char*)data, (int)size);
+
+    ProcessMessages(&node);
+    return 0;
+}