fuzz: fix ChaCha20 encrypt_single_block to preserve data#4385
fuzz: fix ChaCha20 encrypt_single_block to preserve data#4385TheBlueMatt merged 1 commit intolightningdevkit:mainfrom
Conversation
The fuzzing ChaCha20 implementation's encrypt_single_block was not copying src to dest, causing encrypted data to be lost (dest remained zeros). This broke payment flows where metadata is encrypted into payment_secret - the receiver would decrypt zeros and detect the wrong payment method (LdkPaymentHash instead of UserPaymentHash), causing payments to fail with "mismatching preimage". Fix by making encrypt_single_block copy src to dest (identity encryption), matching the behavior of the process() method. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
🎉 This PR is now ready for review! |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4385 +/- ##
==========================================
- Coverage 86.01% 86.00% -0.01%
==========================================
Files 156 156
Lines 102857 102857
Branches 102857 102857
==========================================
- Hits 88471 88465 -6
- Misses 11877 11883 +6
Partials 2509 2509
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
👋 The first review has been submitted! Do you think this PR is ready for a second reviewer? If so, click here to assign a second reviewer. |
3 participants
The fuzzing ChaCha20's encrypt_single_block wasn't copying src to dest, leaving dest as zeros. This caused payment metadata in payment_secret to be lost, making the receiver detect LdkPaymentHash (method 0) instead of UserPaymentHash (method 1), which then failed preimage verification.
This means we were never actually fuzzing successful payment completions - all payments failed with "mismatching preimage". The fix makes encrypt_single_block copy src to dest (identity encryption), matching the behavior of process().
Verified by adding a panic in the PaymentSent handler: before the fix it never triggered, after the fix it does.