Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Panics found by fuzzing #33

Open
WIZeaz opened this issue Dec 4, 2023 · 0 comments
Open

Panics found by fuzzing #33

WIZeaz opened this issue Dec 4, 2023 · 0 comments

Comments

@WIZeaz
Copy link

WIZeaz commented Dec 4, 2023

Hi, I am fuzzing xorfilter-rs with afl.rs, and I have found some panics. The version I test is 0.5.1. I list the code snippets below, and hope you can check whether these panics are bugs. All code snippets can be run directly.

These cases are panicked at 'attempt to add with overflow'

let mut _local0: xorfilter::Fuse8::<xorfilter::NoHash> = xorfilter::Fuse8::<xorfilter::NoHash>::with_hasher(4177066232, xorfilter::NoHash{});
xorfilter::Fuse16::<xorfilter::NoHash>::with_hasher(4177066232, xorfilter::NoHash{});
thread 'main' panicked at 'attempt to add with overflow', /home/jjf/Fuzzing-Target-Generator/experiments/xorfilter/src/fuse8.rs:202:23
stack backtrace:
   0: rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic
   3: xorfilter::fuse8::Fuse8<H>::with_hasher
   4: replay_xorfilter19::test_function19
             at ./fuzz_target/build/replay_xorfilter19/src/main.rs:28:62
   5: replay_xorfilter19::main
             at ./fuzz_target/build/replay_xorfilter19/src/main.rs:64:5
   6: core::ops::function::FnOnce::call_once
             at /home/jjf/Fuzzing-Target-Generator/library/core/src/ops/function.rs:251:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

This case is panicked at 'index out of bounds: the len is 0 but the index is 0'

    let _local0: xorfilter::Xor8::<xorfilter::NoHash> = xorfilter::Xor8::<xorfilter::NoHash>::with_hasher(xorfilter::NoHash{});
    let _local1_param0_helper1 = &(_local0);
    let _: bool = xorfilter::Xor8::<xorfilter::NoHash>::contains_key(_local1_param0_helper1, 14355285626356002360);
thread 'main' panicked at 'index out of bounds: the len is 0 but the index is 0', /home/jjf/Fuzzing-Target-Generator/experiments/xorfilter/src/xor8.rs:422:15
stack backtrace:
   0: rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic_bounds_check
   3: <usize as core::slice::index::SliceIndex<[T]>>::index
             at /home/jjf/Fuzzing-Target-Generator/library/core/src/slice/index.rs:259:10
   4: core::slice::index::<impl core::ops::index::Index<I> for [T]>::index
             at /home/jjf/Fuzzing-Target-Generator/library/core/src/slice/index.rs:18:9
   5: <alloc::vec::Vec<T,A> as core::ops::index::Index<I>>::index
             at /home/jjf/Fuzzing-Target-Generator/library/alloc/src/vec/mod.rs:2736:9
   6: xorfilter::xor8::Xor8<H>::contains_key
             at ./src/xor8.rs:422:15
   7: replay_xorfilter35::test_function35
             at ./fuzz_target/build/replay_xorfilter35/src/main.rs:30:19
   8: replay_xorfilter35::main
             at ./fuzz_target/build/replay_xorfilter35/src/main.rs:62:5
   9: core::ops::function::FnOnce::call_once
             at /home/jjf/Fuzzing-Target-Generator/library/core/src/ops/function.rs:251:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant