AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 15 Bitcoin

Clean up fuzz crate: use panic=abort, add stdin_fuzz support, remove dylib

Public commit record

What the developer wrote

Authored by Joost Jager

95/100 · Strong
Clean up fuzz crate: use panic=abort, add stdin_fuzz support, remove dylib

This commit makes three related changes to the fuzz infrastructure:

1. Set panic=abort on both dev and release profiles, and remove the
dylib crate type (keeping rlib and staticlib). The dylib crate type
was added in e28fd78e6 (2019) for a C-callable harness that was
never implemented. Removing dylib is what enables panic=abort,
since Rust forces panic=unwind on dylib crates. staticlib is
retained as it is compatible with panic=abort.

2. Add stdin_fuzz support: a new Stdout logger, updated target template
so that stdin_fuzz calls _test() with Stdout logging, and updated
README with usage instructions. This allows reproducing crashes via
piped input, useful for git bisect and AI-assisted debugging.

3. Update all fuzzer frontends (AFL, honggfuzz, libfuzzer, stdin_fuzz)
to call the _test() functions directly instead of going through the
_run() C wrappers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
The short version

What changed, and why it matters

This commit is a routine cleanup of the project's fuzz-testing infrastructure. It changes how fuzz tests are compiled and run, adds a new way to feed test input via standard input, and removes an unused dynamic-library build mode. There is no indication it fixes or introduces a security vulnerability in the actual Lightning library code.

Recommended action

No security action required. Treat as normal maintenance; verify fuzz CI still passes if reviewing for build health.

Security signals we found

No strong security signals were identified.

Risk score

Why this scored 15/100

Our methodology →
Potential impact 0/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 0/15
Confidence 10/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.