Fuzz test failure - process_onion_failure

[martinsaposnic]

This failed on the CI https://github.com/lightningdevkit/rust-lightning/actions/runs/15828554643/job/44615114107?pr=3662

Error message:

thread '<unnamed>' panicked at .../rust-lightning/lightning/src/ln/onion_utils.rs:1229:8:
attempt to multiply with overflow

Steps to reproduce (includes hex):

export TARGET="process_onion_failure"
export HEX="2100004000000000abababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababab7e8a0738889fcd2ed5bec80f215819dd9713bfff914ef2e5650eafcc53fcfdeb9d853f770319e22b10299d4100c4848b93ce3eabababababababababababababababababababababababababababababababababababababababababababab0004010000000000abababababababababababababababababababababababababababababababababababababababababababababababababababababababababababab00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000abab000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003480000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffc18000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
mkdir -p ./test_cases/$TARGET
echo $HEX | xxd -r -p > ./test_cases/$TARGET/any_filename_works
export RUST_BACKTRACE=1
export RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz"
cargo test

full test run output:

     Running unittests src/bin/process_onion_failure_target.rs (target/debug/deps/process_onion_failure_target-27156fbebc46035b)

running 1 test
test run_test_cases ... FAILED

failures:

---- run_test_cases stdout ----

thread '<unnamed>' panicked at .../rust-lightning/lightning/src/ln/onion_utils.rs:1229:8:
attempt to multiply with overflow
stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/17067e9ac6d7ecb70e50f92c1944e545188d2359/library/std/src/panicking.rs:697:5
   1: core::panicking::panic_fmt
             at /rustc/17067e9ac6d7ecb70e50f92c1944e545188d2359/library/core/src/panicking.rs:75:14
   2: core::panicking::panic_const::panic_const_mul_overflow
             at /rustc/17067e9ac6d7ecb70e50f92c1944e545188d2359/library/core/src/panicking.rs:178:21
   3: lightning::ln::onion_utils::process_onion_failure_inner
             at .../rust-lightning/lightning/src/ln/onion_utils.rs:1229:8
   4: lightning::ln::onion_utils::process_onion_failure
             at .../rust-lightning/lightning/src/ln/onion_utils.rs:1020:3
   5: lightning_fuzz::process_onion_failure::do_test
             at ./src/process_onion_failure.rs:137:2
   6: lightning_fuzz::process_onion_failure::process_onion_failure_test
             at ./src/process_onion_failure.rs:142:2
   7: process_onion_failure_target::run_test_cases::{{closure}}::{{closure}}
             at ./src/bin/process_onion_failure_target.rs:92:7
   8: std::panicking::try::do_call
             at .../.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:589:40
   9: std::panicking::try
             at .../.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:552:19
  10: std::panic::catch_unwind
             at .../.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/std/src/panic.rs:359:14
  11: process_onion_failure_target::run_test_cases::{{closure}}
             at ./src/bin/process_onion_failure_target.rs:91:19
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

Output of any_filename_works:


Test cases which failed: 
any_filename_works

thread 'run_test_cases' panicked at src/bin/process_onion_failure_target.rs:118:9:
explicit panic
stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/17067e9ac6d7ecb70e50f92c1944e545188d2359/library/std/src/panicking.rs:697:5
   1: core::panicking::panic_fmt
             at /rustc/17067e9ac6d7ecb70e50f92c1944e545188d2359/library/core/src/panicking.rs:75:14
   2: core::panicking::panic_display
             at /rustc/17067e9ac6d7ecb70e50f92c1944e545188d2359/library/core/src/panicking.rs:261:5
   3: core::panicking::panic_explicit
             at /rustc/17067e9ac6d7ecb70e50f92c1944e545188d2359/library/core/src/panicking.rs:234:5
   4: process_onion_failure_target::run_test_cases::panic_cold_explicit
             at .../.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/core/src/panic.rs:88:13
   5: process_onion_failure_target::run_test_cases
             at ./src/bin/process_onion_failure_target.rs:118:3
   6: process_onion_failure_target::run_test_cases::{{closure}}
             at ./src/bin/process_onion_failure_target.rs:65:20
   7: core::ops::function::FnOnce::call_once
             at .../.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
   8: core::ops::function::FnOnce::call_once
             at /rustc/17067e9ac6d7ecb70e50f92c1944e545188d2359/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.


failures:
    run_test_cases

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s

error: test failed, to rerun pass `--bin process_onion_failure_target`

[martinsaposnic]

Also failed here https://github.com/lightningdevkit/rust-lightning/actions/runs/15822717425/job/44595459716?pr=3882

[tnull]

Seems this slipped past review in #3868. Good the fuzzer caught it. (cc @joostjager)