You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
I did some fuzzing for neli with afl.rs. I have found some overflow related bugs.
To Reproduce
I list the code snippets and panic information below.
This case panick at 'attempt to subtract with overflow'
let data = [0,0,0,0];let _local0 = neli::utils::Groups::new_groups(&data[..]);let _local1_param0_helper1 = &(_local0);let _local1 = neli::utils::Groups::as_groups(_local1_param0_helper1);let _local2_param0_helper1 = &(_local1);let _:usize = <std::vec::Vec<u32>as neli::Size>::unpadded_size(_local2_param0_helper1);
thread 'main' panicked at /home/wizeaz/.cargo/registry/src/index.crates.io-6f17d22bba15001f/neli-0.7.0-rc2/src/utils.rs:119:44:
attempt to subtract with overflow
stack backtrace:
0: rust_begin_unwind
at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library/std/src/panicking.rs:595:5
1: core::panicking::panic_fmt
at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library/core/src/panicking.rs:67:14
2: core::panicking::panic
at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library/core/src/panicking.rs:117:5
3: neli::utils::slice_to_mask::{{closure}}
at /home/wizeaz/.cargo/registry/src/index.crates.io-6f17d22bba15001f/neli-0.7.0-rc2/src/utils.rs:119:44
4: <core::slice::iter::Iter<T> as core::iter::traits::iterator::Iterator>::fold
at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library/core/src/slice/iter/macros.rs:232:27
5: neli::utils::slice_to_mask
at /home/wizeaz/.cargo/registry/src/index.crates.io-6f17d22bba15001f/neli-0.7.0-rc2/src/utils.rs:117:5
6: neli::utils::Groups::new_groups
at /home/wizeaz/.cargo/registry/src/index.crates.io-6f17d22bba15001f/neli-0.7.0-rc2/src/utils.rs:158:16
7: RustPlayground::test_function0
at ./src/main.rs:9:19
8: RustPlayground::main
at ./src/main.rs:37:5
9: core::ops::function::FnOnce::call_once
at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
Same code, with different data, can trigger 'attempt to shift left with overflow'
let data = [78,122,122,122,122,250,104,122,122,122,122,56];let _local0 = neli::utils::Groups::new_groups(&data[..]);let _local1_param0_helper1 = &(_local0);let _local1 = neli::utils::Groups::as_groups(_local1_param0_helper1);let _local2_param0_helper1 = &(_local1);let _:usize = <std::vec::Vec<u32>as neli::Size>::unpadded_size(_local2_param0_helper1);
thread 'main' panicked at 'attempt to shift left with overflow', /home/jjf/Fuzzing-Target-Generator/experiments/neli/src/utils.rs:120:38
stack backtrace:
0: rust_begin_unwind
1: core::panicking::panic_fmt
2: core::panicking::panic
3: neli::utils::slice_to_mask::{{closure}}
at ./src/utils.rs:120:38
4: core::iter::traits::iterator::Iterator::fold
at /home/jjf/Fuzzing-Target-Generator/library/core/src/iter/traits/iterator.rs:2414:21
5: neli::utils::slice_to_mask
at ./src/utils.rs:118:5
6: neli::utils::Groups::new_groups
at ./src/utils.rs:159:16
7: replay_neli0::test_function0
at ./fuzz_target/build/replay_neli0/src/main.rs:12:19
8: replay_neli0::main
at ./fuzz_target/build/replay_neli0/src/main.rs:48:5
9: core::ops::function::FnOnce::call_once
at /home/jjf/Fuzzing-Target-Generator/library/core/src/ops/function.rs:251:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
Another problem is neli::utils::NetlinkBitArray::new, when giving an maximum of i64, it will panick at 'attempt to add with overflow'
Version of neli
v0.7.0-rc2
Describe the bug
I did some fuzzing for neli with afl.rs. I have found some overflow related bugs.
To Reproduce
I list the code snippets and panic information below.
This case panick at 'attempt to subtract with overflow'
Same code, with different data, can trigger 'attempt to shift left with overflow'
Another problem is neli::utils::NetlinkBitArray::new, when giving an maximum of i64, it will panick at 'attempt to add with overflow'
It also have the memory allocation failure problem when the argument is big enough.
The program will show a failure message and crash.
Please provide a minimal, ready-to-compile example that reproduces the bug
See above.
Expected behavior
The overflow panic and memory allocation failure should not exist.
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered: