add fuzz corpus

lightsail-network · Jul 21, 2024 · 292e502 · 292e502
1 parent 518c1cb
commit 292e502
Show file tree

Hide file tree

Showing 144 changed files with 134 additions and 28 deletions.
diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml
@@ -1,33 +1,48 @@
-name: ClusterFuzzLite batch fuzzing
+name: ClusterFuzzLite cron tasks
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - develop # Use your actual default branch here.
   schedule:
     - cron: "0 8 * * 1" # At 08:00 on Monday.
 permissions: read-all
 jobs:
-  BatchFuzzing:
+  Fuzzing:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        sanitizer: [address, undefined, memory]
+        include:
+          - mode: batch
+            sanitizer: address
+          - mode: batch
+            sanitizer: undefined
+          - mode: batch
+            sanitizer: memory
+          - mode: prune
+            sanitizer: address
+          - mode: coverage
+            sanitizer: coverage
     steps:
-      - name: Build Fuzzers (${{ matrix.sanitizer }})
+      - name: Build Fuzzers (${{ matrix.mode }} - ${{ matrix.sanitizer }})
         id: build
         uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
-          language: c++
+          language: c # Change this to the language you are fuzzing.
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           sanitizer: ${{ matrix.sanitizer }}
-      - name: Run Fuzzers (${{ matrix.sanitizer }})
+          storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/lightsail-network/app-stellar-fuzz-corpus
+          storage-repo-branch: main
+          storage-repo-branch-coverage: gh-pages
+      - name: Run Fuzzers (${{ matrix.mode }} - ${{ matrix.sanitizer }})
         id: run
         uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          fuzz-seconds: 3600 # 1 hour
-          mode: "batch"
+          fuzz-seconds: 600 # 10 minutes
+          mode: ${{ matrix.mode }}
           sanitizer: ${{ matrix.sanitizer }}
-          # Optional but recommended: For storing certain artifacts from fuzzing.
-          # See later section on "Git repo for storage".
-          #storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/LedgerHQ/fuzzers-corpus.git
-          #storage-repo-branch: main   # Optional. Defaults to "main"
-          #storage-repo-branch-coverage: gh-pages  # Optional. Defaults to "gh-pages".
+          storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/lightsail-network/app-stellar-fuzz-corpus
+          storage-repo-branch: main   # Optional. Defaults to "main"
+          storage-repo-branch-coverage: gh-pages  # Optional. Defaults to "gh-pages".
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
@@ -13,32 +13,27 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        sanitizer: [address, undefined, memory]
+        sanitizer: [address, undefined, memory] # Override this with the sanitizers you want.
     steps:
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
         uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
-          language: c++
+          language: c # Change this to the language you are fuzzing.
           github-token: ${{ secrets.GITHUB_TOKEN }}
           sanitizer: ${{ matrix.sanitizer }}
-          # Optional but recommended: used to only run fuzzers that are affected
-          # by the PR.
-          # See later section on "Git repo for storage".
-          #storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/LedgerHQ/fuzzers-corpus.git
-          #storage-repo-branch: main   # Optional. Defaults to "main"
-          #storage-repo-branch-coverage: gh-pages  # Optional. Defaults to "gh-pages".
+          storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/lightsail-network/app-stellar-fuzz-corpus
+          storage-repo-branch: main
+          storage-repo-branch-coverage: gh-pages
       - name: Run Fuzzers (${{ matrix.sanitizer }})
         id: run
         uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          fuzz-seconds: 600 # 10 minutes
+          fuzz-seconds: 300 # 5 minutes
           mode: "code-change"
           sanitizer: ${{ matrix.sanitizer }}
-          # Optional but recommended: used to download the corpus produced by
-          # batch fuzzing.
-          # See later section on "Git repo for storage".
-          #storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/LedgerHQ/fuzzers-corpus.git
-          #storage-repo-branch: main   # Optional. Defaults to "main"
-          #storage-repo-branch-coverage: gh-pages  # Optional. Defaults to "gh-pages".
+          output-sarif: true
+          storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/lightsail-network/app-stellar-fuzz-corpus
+          storage-repo-branch: main
+          storage-repo-branch-coverage: gh-pages
diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt
@@ -19,6 +19,12 @@ if (NOT CMAKE_C_COMPILER_ID MATCHES "Clang")
     message(FATAL_ERROR "Fuzzer needs to be built with Clang")
 endif ()
 
+# Build with code coverage generation
+if(CODE_COVERAGE)
+    add_compile_options(-fprofile-instr-generate -fcoverage-mapping)
+    add_link_options(-fprofile-instr-generate -fcoverage-mapping)
+endif()
+
 include(CTest)
 ENABLE_TESTING()
 

diff --git a/fuzz/corpus/feeBumpTx.raw b/fuzz/corpus/feeBumpTx.raw
diff --git a/fuzz/corpus/feeBumpTxOmitFeeSourceEqualSigner.raw b/fuzz/corpus/feeBumpTxOmitFeeSourceEqualSigner.raw
diff --git a/fuzz/corpus/feeBumpTxOmitFeeSourceNotEqualSigner.raw b/fuzz/corpus/feeBumpTxOmitFeeSourceNotEqualSigner.raw
diff --git a/fuzz/corpus/feeBumpTxOmitMuxedFeeSourceEqualSigner.raw b/fuzz/corpus/feeBumpTxOmitMuxedFeeSourceEqualSigner.raw
diff --git a/fuzz/corpus/feeBumpTxWithMuxedFeeSource.raw b/fuzz/corpus/feeBumpTxWithMuxedFeeSource.raw
diff --git a/fuzz/corpus/opAccountMerge.raw b/fuzz/corpus/opAccountMerge.raw
diff --git a/fuzz/corpus/opAccountMergeWithMuxedDestination.raw b/fuzz/corpus/opAccountMergeWithMuxedDestination.raw
diff --git a/fuzz/corpus/opAllowTrustAuthorize.raw b/fuzz/corpus/opAllowTrustAuthorize.raw
diff --git a/fuzz/corpus/opAllowTrustAuthorizeToMaintainLiabilities.raw b/fuzz/corpus/opAllowTrustAuthorizeToMaintainLiabilities.raw
diff --git a/fuzz/corpus/opAllowTrustDeauthorize.raw b/fuzz/corpus/opAllowTrustDeauthorize.raw
diff --git a/fuzz/corpus/opBeginSponsoringFutureReserves.raw b/fuzz/corpus/opBeginSponsoringFutureReserves.raw
diff --git a/fuzz/corpus/opBumpSequence.raw b/fuzz/corpus/opBumpSequence.raw
diff --git a/fuzz/corpus/opChangeTrustAddTrustLine.raw b/fuzz/corpus/opChangeTrustAddTrustLine.raw
diff --git a/fuzz/corpus/opChangeTrustRemoveTrustLine.raw b/fuzz/corpus/opChangeTrustRemoveTrustLine.raw
diff --git a/fuzz/corpus/opChangeTrustWithLiquidityPoolAssetAddTrustLine.raw b/fuzz/corpus/opChangeTrustWithLiquidityPoolAssetAddTrustLine.raw
diff --git a/fuzz/corpus/opChangeTrustWithLiquidityPoolAssetRemoveTrustLine.raw b/fuzz/corpus/opChangeTrustWithLiquidityPoolAssetRemoveTrustLine.raw
diff --git a/fuzz/corpus/opClaimClaimableBalance.raw b/fuzz/corpus/opClaimClaimableBalance.raw
diff --git a/fuzz/corpus/opClawback.raw b/fuzz/corpus/opClawback.raw
diff --git a/fuzz/corpus/opClawbackClaimableBalance.raw b/fuzz/corpus/opClawbackClaimableBalance.raw
diff --git a/fuzz/corpus/opClawbackWithMuxedFrom.raw b/fuzz/corpus/opClawbackWithMuxedFrom.raw
diff --git a/fuzz/corpus/opCreateAccount.raw b/fuzz/corpus/opCreateAccount.raw
diff --git a/fuzz/corpus/opCreateClaimableBalance.raw b/fuzz/corpus/opCreateClaimableBalance.raw
diff --git a/fuzz/corpus/opCreatePassiveSellOffer.raw b/fuzz/corpus/opCreatePassiveSellOffer.raw
diff --git a/fuzz/corpus/opEndSponsoringFutureReserves.raw b/fuzz/corpus/opEndSponsoringFutureReserves.raw
diff --git a/fuzz/corpus/opExtendFootprintTtl.raw b/fuzz/corpus/opExtendFootprintTtl.raw
diff --git a/fuzz/corpus/opInflation.raw b/fuzz/corpus/opInflation.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionApproveUsdc.raw b/fuzz/corpus/opInvokeHostFunctionApproveUsdc.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionAssetApprove.raw b/fuzz/corpus/opInvokeHostFunctionAssetApprove.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionAssetTransfer.raw b/fuzz/corpus/opInvokeHostFunctionAssetTransfer.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionCreateContractNewAsset.raw b/fuzz/corpus/opInvokeHostFunctionCreateContractNewAsset.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionCreateContractWasmId.raw b/fuzz/corpus/opInvokeHostFunctionCreateContractWasmId.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionCreateContractWrapAsset.raw b/fuzz/corpus/opInvokeHostFunctionCreateContractWrapAsset.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionScvalsCase0.raw b/fuzz/corpus/opInvokeHostFunctionScvalsCase0.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionScvalsCase1.raw b/fuzz/corpus/opInvokeHostFunctionScvalsCase1.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionScvalsCase2.raw b/fuzz/corpus/opInvokeHostFunctionScvalsCase2.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionTestPlugin.raw b/fuzz/corpus/opInvokeHostFunctionTestPlugin.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionTransferUsdc.raw b/fuzz/corpus/opInvokeHostFunctionTransferUsdc.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionTransferXlm.raw b/fuzz/corpus/opInvokeHostFunctionTransferXlm.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionUploadWasm.raw b/fuzz/corpus/opInvokeHostFunctionUploadWasm.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionWithAuth.raw b/fuzz/corpus/opInvokeHostFunctionWithAuth.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionWithAuthAndNoArgs.raw b/fuzz/corpus/opInvokeHostFunctionWithAuthAndNoArgs.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionWithAuthAndNoArgsAndNoSource.raw b/fuzz/corpus/opInvokeHostFunctionWithAuthAndNoArgsAndNoSource.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionWithComplexSubInvocation.raw b/fuzz/corpus/opInvokeHostFunctionWithComplexSubInvocation.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionWithoutArgs.raw b/fuzz/corpus/opInvokeHostFunctionWithoutArgs.raw
diff --git a/fuzz/corpus/opInvokeHostFunctionWithoutAuthAndNoSource.raw b/fuzz/corpus/opInvokeHostFunctionWithoutAuthAndNoSource.raw
diff --git a/fuzz/corpus/opLiquidityPoolDeposit.raw b/fuzz/corpus/opLiquidityPoolDeposit.raw
diff --git a/fuzz/corpus/opLiquidityPoolWithdraw.raw b/fuzz/corpus/opLiquidityPoolWithdraw.raw
diff --git a/fuzz/corpus/opManageBuyOfferCreate.raw b/fuzz/corpus/opManageBuyOfferCreate.raw
diff --git a/fuzz/corpus/opManageBuyOfferDelete.raw b/fuzz/corpus/opManageBuyOfferDelete.raw
diff --git a/fuzz/corpus/opManageBuyOfferUpdate.raw b/fuzz/corpus/opManageBuyOfferUpdate.raw
diff --git a/fuzz/corpus/opManageDataAdd.raw b/fuzz/corpus/opManageDataAdd.raw
diff --git a/fuzz/corpus/opManageDataAddWithUnprintableData.raw b/fuzz/corpus/opManageDataAddWithUnprintableData.raw
diff --git a/fuzz/corpus/opManageDataRemove.raw b/fuzz/corpus/opManageDataRemove.raw
diff --git a/fuzz/corpus/opManageSellOfferCreate.raw b/fuzz/corpus/opManageSellOfferCreate.raw
diff --git a/fuzz/corpus/opManageSellOfferDelete.raw b/fuzz/corpus/opManageSellOfferDelete.raw
diff --git a/fuzz/corpus/opManageSellOfferUpdate.raw b/fuzz/corpus/opManageSellOfferUpdate.raw
diff --git a/fuzz/corpus/opPathPaymentStrictReceive.raw b/fuzz/corpus/opPathPaymentStrictReceive.raw
diff --git a/fuzz/corpus/opPathPaymentStrictReceiveWithEmptyPath.raw b/fuzz/corpus/opPathPaymentStrictReceiveWithEmptyPath.raw
diff --git a/fuzz/corpus/opPathPaymentStrictReceiveWithMuxedDestination.raw b/fuzz/corpus/opPathPaymentStrictReceiveWithMuxedDestination.raw
diff --git a/fuzz/corpus/opPathPaymentStrictSend.raw b/fuzz/corpus/opPathPaymentStrictSend.raw
diff --git a/fuzz/corpus/opPathPaymentStrictSendWithEmptyPath.raw b/fuzz/corpus/opPathPaymentStrictSendWithEmptyPath.raw
diff --git a/fuzz/corpus/opPathPaymentStrictSendWithMuxedDestination.raw b/fuzz/corpus/opPathPaymentStrictSendWithMuxedDestination.raw
diff --git a/fuzz/corpus/opPaymentAssetAlphanum12.raw b/fuzz/corpus/opPaymentAssetAlphanum12.raw
diff --git a/fuzz/corpus/opPaymentAssetAlphanum4.raw b/fuzz/corpus/opPaymentAssetAlphanum4.raw
diff --git a/fuzz/corpus/opPaymentAssetNative.raw b/fuzz/corpus/opPaymentAssetNative.raw
diff --git a/fuzz/corpus/opPaymentWithMuxedDestination.raw b/fuzz/corpus/opPaymentWithMuxedDestination.raw
diff --git a/fuzz/corpus/opRestoreFootprint.raw b/fuzz/corpus/opRestoreFootprint.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipAccount.raw b/fuzz/corpus/opRevokeSponsorshipAccount.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipClaimableBalance.raw b/fuzz/corpus/opRevokeSponsorshipClaimableBalance.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipData.raw b/fuzz/corpus/opRevokeSponsorshipData.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipEd25519PublicKeySigner.raw b/fuzz/corpus/opRevokeSponsorshipEd25519PublicKeySigner.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipHashXSigner.raw b/fuzz/corpus/opRevokeSponsorshipHashXSigner.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipLiquidityPool.raw b/fuzz/corpus/opRevokeSponsorshipLiquidityPool.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipOffer.raw b/fuzz/corpus/opRevokeSponsorshipOffer.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipPreAuthTxSigner.raw b/fuzz/corpus/opRevokeSponsorshipPreAuthTxSigner.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipTrustLineWithAsset.raw b/fuzz/corpus/opRevokeSponsorshipTrustLineWithAsset.raw
diff --git a/fuzz/corpus/opRevokeSponsorshipTrustLineWithLiquidityPoolId.raw b/fuzz/corpus/opRevokeSponsorshipTrustLineWithLiquidityPoolId.raw
diff --git a/fuzz/corpus/opSetOptions.raw b/fuzz/corpus/opSetOptions.raw
diff --git a/fuzz/corpus/opSetOptionsAddEd25519SignerPayloadSigner.raw b/fuzz/corpus/opSetOptionsAddEd25519SignerPayloadSigner.raw
diff --git a/fuzz/corpus/opSetOptionsAddHashXSigner.raw b/fuzz/corpus/opSetOptionsAddHashXSigner.raw
diff --git a/fuzz/corpus/opSetOptionsAddPreAuthTxSigner.raw b/fuzz/corpus/opSetOptionsAddPreAuthTxSigner.raw
diff --git a/fuzz/corpus/opSetOptionsAddPublicKeySigner.raw b/fuzz/corpus/opSetOptionsAddPublicKeySigner.raw
diff --git a/fuzz/corpus/opSetOptionsRemoveEd25519SignerPayloadSigner.raw b/fuzz/corpus/opSetOptionsRemoveEd25519SignerPayloadSigner.raw
diff --git a/fuzz/corpus/opSetOptionsRemoveHashXSigner.raw b/fuzz/corpus/opSetOptionsRemoveHashXSigner.raw
diff --git a/fuzz/corpus/opSetOptionsRemovePreAuthTxSigner.raw b/fuzz/corpus/opSetOptionsRemovePreAuthTxSigner.raw
diff --git a/fuzz/corpus/opSetOptionsRemovePublicKeySigner.raw b/fuzz/corpus/opSetOptionsRemovePublicKeySigner.raw
diff --git a/fuzz/corpus/opSetOptionsWithEmptyBody.raw b/fuzz/corpus/opSetOptionsWithEmptyBody.raw
diff --git a/fuzz/corpus/opSetTrustLineFlagsAuthorized.raw b/fuzz/corpus/opSetTrustLineFlagsAuthorized.raw
diff --git a/fuzz/corpus/opSetTrustLineFlagsAuthorizedAndClawbackEnabled.raw b/fuzz/corpus/opSetTrustLineFlagsAuthorizedAndClawbackEnabled.raw
diff --git a/fuzz/corpus/opSetTrustLineFlagsAuthorizedToMaintainLiabilities.raw b/fuzz/corpus/opSetTrustLineFlagsAuthorizedToMaintainLiabilities.raw
diff --git a/fuzz/corpus/opSetTrustLineFlagsUnauthorized.raw b/fuzz/corpus/opSetTrustLineFlagsUnauthorized.raw
diff --git a/fuzz/corpus/opSourceOmitOpSourceEqualSignerNotEqualTxSource.raw b/fuzz/corpus/opSourceOmitOpSourceEqualSignerNotEqualTxSource.raw
diff --git a/fuzz/corpus/opSourceOmitTxMuxedSourceEqualOpMuxedSourceEqualSigner.raw b/fuzz/corpus/opSourceOmitTxMuxedSourceEqualOpMuxedSourceEqualSigner.raw
diff --git a/fuzz/corpus/opSourceOmitTxMuxedSourceEqualOpSourceEqualSigner.raw b/fuzz/corpus/opSourceOmitTxMuxedSourceEqualOpSourceEqualSigner.raw
diff --git a/fuzz/corpus/opSourceOmitTxSourceEqualOpMuxedSourceEqualSigner.raw b/fuzz/corpus/opSourceOmitTxSourceEqualOpMuxedSourceEqualSigner.raw
diff --git a/fuzz/corpus/opSourceOmitTxSourceEqualOpSourceEqualSigner.raw b/fuzz/corpus/opSourceOmitTxSourceEqualOpSourceEqualSigner.raw
diff --git a/fuzz/corpus/opSourceOmitTxSourceEqualOpSourceNotEqualSigner.raw b/fuzz/corpus/opSourceOmitTxSourceEqualOpSourceNotEqualSigner.raw
diff --git a/fuzz/corpus/opSourceOmitTxSourceEqualSignerNotEqualOpSource.raw b/fuzz/corpus/opSourceOmitTxSourceEqualSignerNotEqualOpSource.raw
diff --git a/fuzz/corpus/opWithEmptySource.raw b/fuzz/corpus/opWithEmptySource.raw
diff --git a/fuzz/corpus/opWithMuxedSource.raw b/fuzz/corpus/opWithMuxedSource.raw
diff --git a/fuzz/corpus/sorobanAuthCreateSmartContract.raw b/fuzz/corpus/sorobanAuthCreateSmartContract.raw
diff --git a/fuzz/corpus/sorobanAuthInvokeContract.raw b/fuzz/corpus/sorobanAuthInvokeContract.raw
diff --git a/fuzz/corpus/sorobanAuthInvokeContractTestPlugin.raw b/fuzz/corpus/sorobanAuthInvokeContractTestPlugin.raw
diff --git a/fuzz/corpus/sorobanAuthInvokeContractWithComplexSubInvocation.raw b/fuzz/corpus/sorobanAuthInvokeContractWithComplexSubInvocation.raw
diff --git a/fuzz/corpus/sorobanAuthInvokeContractWithoutArgs.raw b/fuzz/corpus/sorobanAuthInvokeContractWithoutArgs.raw
diff --git a/fuzz/corpus/sorobanAuthPublic.raw b/fuzz/corpus/sorobanAuthPublic.raw
diff --git a/fuzz/corpus/sorobanAuthTestnet.raw b/fuzz/corpus/sorobanAuthTestnet.raw
diff --git a/fuzz/corpus/sorobanAuthUnknownNetwork.raw b/fuzz/corpus/sorobanAuthUnknownNetwork.raw
diff --git a/fuzz/corpus/txCondExtraSignersWithOneSigner.raw b/fuzz/corpus/txCondExtraSignersWithOneSigner.raw
diff --git a/fuzz/corpus/txCondExtraSignersWithTwoSigners.raw b/fuzz/corpus/txCondExtraSignersWithTwoSigners.raw
diff --git a/fuzz/corpus/txCondIsNone.raw b/fuzz/corpus/txCondIsNone.raw
diff --git a/fuzz/corpus/txCondLedgerBounds.raw b/fuzz/corpus/txCondLedgerBounds.raw
diff --git a/fuzz/corpus/txCondLedgerBoundsAreZero.raw b/fuzz/corpus/txCondLedgerBoundsAreZero.raw
diff --git a/fuzz/corpus/txCondLedgerBoundsMaxIsZero.raw b/fuzz/corpus/txCondLedgerBoundsMaxIsZero.raw
diff --git a/fuzz/corpus/txCondLedgerBoundsMinIsZero.raw b/fuzz/corpus/txCondLedgerBoundsMinIsZero.raw
diff --git a/fuzz/corpus/txCondMinAccountSequence.raw b/fuzz/corpus/txCondMinAccountSequence.raw
diff --git a/fuzz/corpus/txCondMinAccountSequenceAge.raw b/fuzz/corpus/txCondMinAccountSequenceAge.raw
diff --git a/fuzz/corpus/txCondMinAccountSequenceLedgerGap.raw b/fuzz/corpus/txCondMinAccountSequenceLedgerGap.raw
diff --git a/fuzz/corpus/txCondTimeBounds.raw b/fuzz/corpus/txCondTimeBounds.raw
diff --git a/fuzz/corpus/txCondTimeBoundsAreZero.raw b/fuzz/corpus/txCondTimeBoundsAreZero.raw
diff --git a/fuzz/corpus/txCondTimeBoundsIsNone.raw b/fuzz/corpus/txCondTimeBoundsIsNone.raw
diff --git a/fuzz/corpus/txCondTimeBoundsMaxIsZero.raw b/fuzz/corpus/txCondTimeBoundsMaxIsZero.raw
diff --git a/fuzz/corpus/txCondTimeBoundsMinIsZero.raw b/fuzz/corpus/txCondTimeBoundsMinIsZero.raw
diff --git a/fuzz/corpus/txCondWithAllItems.raw b/fuzz/corpus/txCondWithAllItems.raw
diff --git a/fuzz/corpus/txCustomBaseFee.raw b/fuzz/corpus/txCustomBaseFee.raw
diff --git a/fuzz/corpus/txMemoHash.raw b/fuzz/corpus/txMemoHash.raw
diff --git a/fuzz/corpus/txMemoId.raw b/fuzz/corpus/txMemoId.raw
diff --git a/fuzz/corpus/txMemoNone.raw b/fuzz/corpus/txMemoNone.raw
diff --git a/fuzz/corpus/txMemoReturnHash.raw b/fuzz/corpus/txMemoReturnHash.raw
diff --git a/fuzz/corpus/txMemoText.raw b/fuzz/corpus/txMemoText.raw
diff --git a/fuzz/corpus/txMemoTextUnprintable.raw b/fuzz/corpus/txMemoTextUnprintable.raw
diff --git a/fuzz/corpus/txMultiOperations.raw b/fuzz/corpus/txMultiOperations.raw
diff --git a/fuzz/corpus/txNetworkCustom.raw b/fuzz/corpus/txNetworkCustom.raw
diff --git a/fuzz/corpus/txNetworkPublic.raw b/fuzz/corpus/txNetworkPublic.raw
diff --git a/fuzz/corpus/txNetworkTestnet.raw b/fuzz/corpus/txNetworkTestnet.raw
diff --git a/fuzz/corpus/txSourceOmitMuxedSourceEqualSigner.raw b/fuzz/corpus/txSourceOmitMuxedSourceEqualSigner.raw
diff --git a/fuzz/corpus/txSourceOmitSourceEqualSigner.raw b/fuzz/corpus/txSourceOmitSourceEqualSigner.raw
diff --git a/fuzz/corpus/txSourceOmitSourceNotEqualSigner.raw b/fuzz/corpus/txSourceOmitSourceNotEqualSigner.raw
diff --git a/fuzz/corpus/txWithMuxedSource.raw b/fuzz/corpus/txWithMuxedSource.raw
diff --git a/fuzz/fuzz_tx.c b/fuzz/fuzz_tx.c
@@ -9,6 +9,17 @@
 #define DETAIL_CAPTION_MAX_LENGTH 21
 #define DETAIL_VALUE_MAX_LENGTH   105
 
+static bool plugin_check_presence(const uint8_t *contract_address);
+static stellar_plugin_result_t plugin_init_contract(const uint8_t *contract_address);
+static stellar_plugin_result_t plugin_query_data_pair_count(const uint8_t *contract_address,
+                                                            uint8_t *data_pair_count);
+static stellar_plugin_result_t plugin_query_data_pair(const uint8_t *contract_address,
+                                                      uint8_t data_pair_index,
+                                                      char *caption,
+                                                      uint8_t caption_len,
+                                                      char *value,
+                                                      uint8_t value_len);
+
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     envelope_t envelope;
     bool data_exists = true;
@@ -57,6 +68,10 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
             .caption_len = DETAIL_CAPTION_MAX_LENGTH,
             .value_len = DETAIL_VALUE_MAX_LENGTH,
             .display_sequence = true,
+            .plugin_check_presence = &plugin_check_presence,
+            .plugin_init_contract = &plugin_init_contract,
+            .plugin_query_data_pair_count = &plugin_query_data_pair_count,
+            .plugin_query_data_pair = &plugin_query_data_pair,
         };
 
         reset_formatter();
@@ -74,3 +89,56 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
     return 0;
 }
+
+static bool plugin_check_presence(const uint8_t *contract_address) {
+    uint8_t expected[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+    return memcmp(contract_address, expected, 32) == 0;
+}
+
+stellar_plugin_result_t plugin_init_contract(const uint8_t *contract_address) {
+    // Build-in token plugin
+    if (plugin_check_presence(contract_address)) {
+        return STELLAR_PLUGIN_RESULT_OK;
+    }
+    return STELLAR_PLUGIN_RESULT_UNAVAILABLE;
+}
+
+stellar_plugin_result_t plugin_query_data_pair_count(const uint8_t *contract_address,
+                                                     uint8_t *data_pair_count) {
+    // Build-in token plugin
+    if (plugin_check_presence(contract_address)) {
+        *data_pair_count = 3;
+        return STELLAR_PLUGIN_RESULT_OK;
+    }
+    return STELLAR_PLUGIN_RESULT_UNAVAILABLE;
+}
+
+stellar_plugin_result_t plugin_query_data_pair(const uint8_t *contract_address,
+                                               uint8_t data_pair_index,
+                                               char *caption,
+                                               uint8_t caption_len,
+                                               char *value,
+                                               uint8_t value_len) {
+    if (!plugin_check_presence(contract_address)) {
+        return STELLAR_PLUGIN_RESULT_UNAVAILABLE;
+    }
+    switch (data_pair_index) {
+        case 0:
+            strncpy(caption, "caption 0", caption_len);
+            strncpy(value, "value 0", value_len);
+            break;
+        case 1:
+            strncpy(caption, "caption 1", caption_len);
+            strncpy(value, "value 1", value_len);
+            break;
+        case 2:
+            strncpy(caption, "caption 2", caption_len);
+            strncpy(value, "value 2", value_len);
+            break;
+        default:
+            return STELLAR_PLUGIN_RESULT_ERROR;
+    }
+    return STELLAR_PLUGIN_RESULT_OK;
+}
diff --git a/fuzz/run.sh b/fuzz/run.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+set -e
+
+SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+BUILDDIR="$SCRIPTDIR/cmake-build-fuzz-coverage"
+CORPUSDIR="$SCRIPTDIR/corpus"
+HTMLCOVDIR="$SCRIPTDIR/html-coverage"
+
+# Compile the fuzzer with code coverage support
+rm -rf "$BUILDDIR" "$HTMLCOVDIR"
+cmake -DBOLOS_SDK=/opt/ledger-secure-sdk -DCMAKE_C_COMPILER=clang -DCODE_COVERAGE=1 -B"$BUILDDIR" -H.
+cmake --build "$BUILDDIR" --target fuzz_tx
+
+# Run the fuzzer on the corpus files
+export LLVM_PROFILE_FILE="$BUILDDIR/fuzz_tx.%p.profraw"
+# "$BUILDDIR/fuzz_tx" "$CORPUSDIR"/*
+"$BUILDDIR/fuzz_tx" -rss_limit_mb=1024 -max_len=20000 -max_total_time=600 -print_final_stats=1 "$CORPUSDIR" -jobs=4 -workers=4
+llvm-profdata merge --sparse "$BUILDDIR"/fuzz_tx.*.profraw -o "$BUILDDIR/fuzz_tx.profdata"
+
+# Exclude lib_standard_app directory, base32 and base64 code from coverage report
+llvm-cov show "$BUILDDIR/fuzz_tx" -instr-profile="$BUILDDIR/fuzz_tx.profdata" -show-line-counts-or-regions -output-dir="$HTMLCOVDIR" -format=html -ignore-filename-regex="(.*lib_standard_app.*)|(.*libstellar/base64\.c.*)|(.*libstellar/base32\.c.*)"
+llvm-cov report "$BUILDDIR/fuzz_tx" -instr-profile="$BUILDDIR/fuzz_tx.profdata" -ignore-filename-regex="(.*lib_standard_app.*)|(.*libstellar/base64\.c.*)|(.*libstellar/base32\.c.*)"