Some panics found by afl.rs #309

StevenJiang1110 · 2021-01-24T12:33:59Z

I have used afl.rs to fuzz this crate, and I found several cases will crash. The version I work on is version 0.2.24.

There are 2 about unreachable.

let date_ = time::Date::try_from_ymd(-36 ,11 ,1).unwrap();
let _ = time::Date::weekday(date_);

let date_ = time::Date::try_from_yo(-26 ,96).unwrap();
let _ = time::Date::weekday(date_);

And there are several about arithmetic overflow.

let _ = time::UtcOffset::west_minutes(32768);

let _ = time::util::weeks_in_year(-102);

let date_ = time::Date::try_from_yo(-31 ,136).unwrap();
let date2_ = time::Date::next_day(date_);
let _ = time::Date::iso_year_week(date2_);

let date_ = time::Date::try_from_yo(-60, 64).unwrap();
let date2_ = time::Date::previous_day(date_);
let _ = time::Date::week(date2_);

let date_ = time::Date::try_from_yo(-208 ,99).unwrap();
let date2_ = time::Date::try_with_hms_milli(date_, 22, 48,48 ,48).unwrap();
let _ = time::PrimitiveDateTime::week(date2_);

I hope you can check if these are really bugs that need to be fixed. Thanks a lot.

jhpratt · 2021-01-24T19:53:53Z

I'll verify these once I'm on my laptop, but on the assumption everything you've said is true, these are mostly bugs. The only one that would not be is the construction of the UtcOffset with an out of bounds minute value; this is explicitly mentioned in the documentation, so a panic is valid behavior.

Would you mind sharing the code used to find these? I've never used a fuzzer myself. This would also let me run it on the current head, where significant changes have taken place across the board.

jhpratt · 2021-01-24T22:57:19Z

Verifying the following as bugs in 0.2.24:

date!(-36-11-01).weekday()
date!(-26-96).weekday()
util::weeks_in_year(-102)
date!(-31-137).weekday()
date!(-31-137).week()
date!(-60-63).iso_year_week()
date!(-208-99).week()

I'll be investigating these further, of course. First up is to see if these bugs exist on main; I know one won't, as I (apparently incorrectly) assumed valid data. Needless to say this should be interesting.

This simple change fixes all reported invalid values.

jhpratt · 2021-01-25T02:55:17Z

Fixed in 0540d19.

jhpratt · 2021-01-25T03:16:57Z

v0.2.25 has been released with this patch. I'd also like to report that this issue does not exist on main.

StevenJiang1110 · 2021-01-25T04:28:36Z

Thanks for your prompt reply. That's very helpful.
I would like to issue a pr about the fuzzing codes to find the bugs I found(I'm working on ddl now, so maybe several days later). They are using afl.rs.

jhpratt added A-core Area: anything not otherwise covered C-bug Category: bug in current code labels Jan 24, 2021

jhpratt self-assigned this Jan 24, 2021

jhpratt added a commit that referenced this issue Jan 25, 2021

Fix #309

0540d19

This simple change fixes all reported invalid values.

jhpratt closed this as completed Jan 25, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Some panics found by afl.rs #309

Some panics found by afl.rs #309

StevenJiang1110 commented Jan 24, 2021

jhpratt commented Jan 24, 2021

jhpratt commented Jan 24, 2021

jhpratt commented Jan 25, 2021

jhpratt commented Jan 25, 2021

StevenJiang1110 commented Jan 25, 2021

Some panics found by afl.rs #309

Some panics found by afl.rs #309

Comments

StevenJiang1110 commented Jan 24, 2021

jhpratt commented Jan 24, 2021

jhpratt commented Jan 24, 2021

jhpratt commented Jan 25, 2021

jhpratt commented Jan 25, 2021

StevenJiang1110 commented Jan 25, 2021