fuzz-tests: improve fuzz-bech32

tests/fuzz/corpora/fuzz-bech32/77cd1e6dbfb8955912c858a45f31b04a820a5340

@@ -0,0 +1 @@
+;,;,

tests/fuzz/corpora/fuzz-bech32/ad6bcfc5fccbb6e0891d531b191b9d7bad04a4b6

@@ -0,0 +1 @@
+=

tests/fuzz/corpora/fuzz-bech32/c523762d2864dfb59f7bcd63826bffe0a084ae4a

@@ -0,0 +1 @@
+:���/�����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������

tests/fuzz/fuzz-bech32.c

@@ -1,6 +1,6 @@
 #include "config.h"
 #include <assert.h>
-
+#include <common/utils.h>
 #include <common/bech32.h>
 #include <stdint.h>
 #include <string.h>
@@ -25,34 +25,39 @@ void run(const uint8_t *data, size_t size)
 	/* Buffer size is defined in each function's doc comment. */
 	benc = data[0] ? BECH32_ENCODING_BECH32 : BECH32_ENCODING_BECH32M;
 	bech32_str_cap = (size - 1) + strlen(hrp_inv) + 8;
-	bech32_str = malloc(bech32_str_cap);
+	bech32_str = tal_arr(tmpctx, char, bech32_str_cap);
 	if (bech32_encode(bech32_str, hrp_inv, data + 1, size - 1,
 			  bech32_str_cap, benc) == 1) {
-		hrp_out = malloc(strlen(bech32_str) - 6);
-		data_out = malloc(strlen(bech32_str) - 8);
+		hrp_out = tal_arr(tmpctx, char, strlen(bech32_str) - 6);
+		data_out = tal_arr(tmpctx, uint8_t, strlen(bech32_str) - 8);
 
 		benc_decoded = bech32_decode(hrp_out, data_out, &data_out_len,
 					     bech32_str, bech32_str_cap);
 		assert(benc_decoded == benc);
 		assert(strcmp(hrp_inv, hrp_out) == 0);
 		assert(data_out_len == size - 1);
 		assert(memcmp(data_out, data + 1, data_out_len) == 0);
-
-		free(hrp_out);
-		free(data_out);
 	}
-	free(bech32_str);
 
-	data_out = malloc(size);
+	data_out = tal_arr(tmpctx, uint8_t, size * 2);
 
 	/* This is also used as part of sign and check message. */
 	data_out_len = 0;
-	bech32_convert_bits(data_out, &data_out_len, 8, data, size, 5, 1);
-	data_out_len = 0;
-	bech32_convert_bits(data_out, &data_out_len, 8, data, size, 5, 0);
+	/* First conversion uses pad=1 to ensure all bits are captured. */
+	if (bech32_convert_bits(data_out, &data_out_len, 5, data, size, 8, 1)) {
+		uint8_t *deconv_data_out = tal_arr(tmpctx, uint8_t, size);
+		size_t deconv_data_out_len = 0;
+
+		/* Second uses pad=0 to discard padding bits during reconstruction. */
+		if (bech32_convert_bits(deconv_data_out, &deconv_data_out_len, 8,
+							data_out, data_out_len, 5, 0)) {
+			assert(deconv_data_out_len == size);
+			assert(memcmp(data, deconv_data_out, size) == 0);
+		}
+	}
 
-	addr = malloc(73 + strlen(hrp_addr));
-	for (int wit_version = 0; wit_version < 2; ++wit_version) {
+	addr = tal_arr(tmpctx, char, 73 + strlen(hrp_addr));
+	for (int wit_version = 0; wit_version <= 16; ++wit_version) {
 		if (segwit_addr_encode(addr, hrp_addr, wit_version, data,
 				       size) == 0)
 			continue;
@@ -63,7 +68,6 @@ void run(const uint8_t *data, size_t size)
 		assert(data_out_len == size);
 		assert(memcmp(data_out, data, data_out_len) == 0);
 	}
-	free(addr);
 
-	free(data_out);
+	clean_tmpctx();
 }