fuzz: reset the mockable steady clock between iterations
What the developer wrote
Authored by Hao Xu
fuzz: reset the mockable steady clock between iterations
CheckGlobalsImpl's constructor runs at the start of every fuzz iteration
and already resets the global RNG flags and the mockable NodeClock via
SetMockTime(0s), but it never reset the mockable steady clock. A value
written to g_mock_steady_time by one input therefore leaked into the
next one. For example, FuzzedSock's constructor calls
SetMockTime(INITIAL_MOCK_TIME) and never clears it, so the mocked steady
time stays set for all subsequent iterations.
Reset MockableSteadyClock symmetrically with NodeClock so each input
starts from an unmocked steady clock. This also brings the steady clock
under the same discipline as the system clock: a target that reads
MockableSteadyClock::now() without first mocking it is now caught by the
existing g_used_system_time check instead of silently reusing a leaked
value.
What changed, and why it matters
This is a small fix inside Bitcoin Core's internal fuzz-testing harness. Fuzz testing feeds the program many random inputs in sequence; the harness is supposed to reset global state between inputs so each test starts clean. The reset code already cleared the regular mock clock but forgot to clear a separate 'steady' mock clock. That meant one fuzz input could leave a fake time value behind, polluting later inputs and making fuzz results less reliable. The patch adds one line to clear that steady mock clock too. It is a test-infrastructure bug, not a vulnerability in live Bitcoin node code.
No production action required. Ensure fuzz CI runs include this reset; consider auditing other mockable globals for similar per-iteration reset omissions.
Security signals we found
State leakage across fuzz iterations
Test-only global state isolation failure
Mock clock not reset between test runs
Evidence from the diff
CheckGlobalsImpl’s constructor in src/test/fuzz/util/check_globals.cpp resets per-iteration fuzz state: g_seeded_g_prng_zero, g_used_system_time, and the mockable NodeClock via SetMockTime(0s). It omitted MockableSteadyClock::ClearMockTime(), so g_mock_steady_time leaked across fuzz iterations. The patch adds that call, aligning steady-clock reset behavior with the system clock. This also ensures any target that reads MockableSteadyClock::now() without first mocking it is caught by the existing g_used_system_time guard instead of reusing a stale leaked value.
Changed components
src/test/fuzz/util/check_globals.cppFuzz testing harness onlyInspect captured patch +1 / −0
diff --git a/src/test/fuzz/util/check_globals.cpp b/src/test/fuzz/util/check_globals.cpp
index ca311153..87d96ebd 100644
--- a/src/test/fuzz/util/check_globals.cpp
+++ b/src/test/fuzz/util/check_globals.cpp
@@ -19,6 +19,7 @@ struct CheckGlobalsImpl {
g_seeded_g_prng_zero = false;
g_used_system_time = false;
SetMockTime(0s);
+ MockableSteadyClock::ClearMockTime();
}
~CheckGlobalsImpl()
{
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.