Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug Report: Identified issues with arithmetic overflow, unreachable code, unwrap errors, and array out-of-bounds and so on #244

Open
xizheyin opened this issue Jun 17, 2023 · 12 comments
Open

Bug Report: Identified issues with arithmetic overflow, unreachable code, unwrap errors, and array out-of-bounds and so on #244

xizheyin opened this issue Jun 17, 2023 · 12 comments
Labels
bug

Comments

@xizheyin
Copy link

Description

HI! I am using my fuzz testing tool to test this library, and so far I have found 15 different bugs. Among them, there are 5 array out-of-bounds errors, 3 string encoding errors, 1 unwrap error, 1 unreachable code bug, and 5 arithmetic overflow bugs. Below is the list of errors. Please review them and check if any modifications are needed. The replay files are all stored in this repository.

Bug List:

1. Array out-of-bounds error

error message:

thread 'main' panicked at 'begin <= end (21 <= 20) when slicing `94-11-05T08:15:34.0-:0`', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/epoch.rs:993:43

source code:
image

2. Array out-of-bounds error

error message:

thread 'main' panicked at 'index out of bounds: the len is 16 but the index is 16', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:400:25

source code:
image

3. Array out-of-bounds error

thread 'main' panicked at 'index out of bounds: the len is 16 but the index is 16', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:488:25

source code:
image

4. Array out-of-bounds error

error message:

thread 'main' panicked at 'index out of bounds: the len is 16 but the index is 16', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:424:25

source code：
image

5. String encoding error

error message:

thread 'main' panicked at 'byte index 5 is not a char boundary; it is inside '밀' (bytes 4..7) of `%%%1밀%j0%`', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:296:25

source code：
image

6. String encoding error

error message:

thread 'main' panicked at 'byte index 16 is not a char boundary; it is inside '밀' (bytes 14..17) of `411-0j0%%Y
                                                                                                                밀%B`', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:228:3

source code：
image

7. String encoding error

error message:

thread 'main' panicked at 'byte index 1 is not a char boundary; it is inside 'Ͽ' (bytes 0..2) of `ϿTTT`', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:186:50

source code：
image

8. Unwrap error

error message:

thread 'main' panicked at 'called `Option::unwrap()` on a `None` value', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:157:53

source code：
image

9. Unreachable code bug

error message:

thread 'main' panicked at 'not yet implemented', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:246:25

source code：
image

10. Arithmetic overflow bug

error message:

thread 'main' panicked at 'attempt to negate with overflow', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/duration.rs:1247:38

source code：
image

11. Arithmetic overflow bug

error message:

thread 'main' panicked at 'attempt to subtract with overflow', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/epoch.rs:684:32

source code：
image

12. Arithmetic overflow bug

error message:

thread 'main' panicked at 'attempt to multiply with overflow', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/epoch.rs:685:59

source code：
image

13. Arithmetic overflow bug

error message:

thread 'main' panicked at 'attempt to subtract with overflow', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:267:66

source code：
image

14. Arithmetic overflow bug

error message:

thread 'main' panicked at 'attempt to calculate the remainder with a divisor of zero', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/duration.rs:511:40

source code：
image

15. Array out-of-bounds error

error message:

thread 'main' panicked at 'begin <= end (3 <= 2) when slicing `291@Jb0JJJJJ`', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/hifitime-3.8.2/src/efmt/format.rs:228:32

source code:
image
@xizheyin xizheyin changed the title Bug Report: Identified issues with arithmetic overflow, unreachable code, unwrap errors, and array out-of-bounds Bug Report: Identified issues with arithmetic overflow, unreachable code, unwrap errors, and array out-of-bounds and so on Jun 17, 2023
@ChristopherRabotin
Copy link
Member

ChristopherRabotin commented Jun 17, 2023 via email

@xizheyin
Copy link
Author

Thank you for taking the time to review these issues! All the replay files and their corresponding inputs are in this repository, including arithmetic overflow. If you want to reproduce the exact values that caused crashes during execution, perhaps you can run the replay files while monitoring them?

@ChristopherRabotin
Copy link
Member

Thanks, I hadn't seen the link to the replay files, but now I see them. This will help in fixing the bugs for sure, thank you.

What fuzz tool did you use ? It might be useful for me to add it to the CI.

@xizheyin
Copy link
Author

xizheyin commented Jun 17, 2023 •
edited
Loading

Thank you for your recognition. I am a Ph.D. student at SATE Laboratory, Nanjing University. We are currently working on a fuzzing tool for Rust library APIs under the guidance of our advisor. This tool aims to automate the testing of Rust library APIs more effectively. Once we complete it, we will open-source the tool and welcome your suggestions and contributions at that time!

@cardigan1008 cardigan1008 mentioned this issue Mar 12, 2024
Merged
@gwbres
Copy link
Collaborator

gwbres commented Mar 12, 2024 •
edited
Loading

@xizheyin,

am a Ph.D. student at SATE Laboratory, Nanjing University. We are currently working on a fuzzing tool for Rust library APIs under the guidance of our advisor. This tool aims to automate the testing of Rust library APIs more effectively. Once we complete it, we will open-source the tool and welcome your suggestions and contributions at that time!

this might be a little off topic but I'm also very interested in your stresser tool.
Did you guys get a chance to make progress on this ? i'd be interested in using it in my own tools

@xizheyin
Copy link
Author

@gwbres Thank you for your approval, the current version is a bit user-unfriendly, we will refactor the tool to make it more usable in the future.

@gwbres
Copy link
Collaborator

gwbres commented Mar 12, 2024

Thank you for your approval, the current version is a bit user-unfriendly, we will refactor the tool to make it more usable in the future

👍 do you have a link to this work ? is that the "llvm cov" project you contribute to ? or another repo

@xizheyin
Copy link
Author

xizheyin commented Mar 12, 2024 via email

@gwbres
Copy link
Collaborator

gwbres commented Mar 12, 2024

No worries, I'll try to keep an eye on it

This was referenced Mar 13, 2024
Merged
Merged
cardigan1008 added a commit to cardigan1008/hifitime that referenced this issue Jul 28, 2024
@cardigan1008
fix: ceil with zero duration
259097b 
In issue nyx-space#244, ceil() is called with 0 duration. It seems return 0
is an alternative way to fix this. But it seems that we can also
report user with error?
This was referenced Jul 28, 2024
Merged
Merged
@ChristopherRabotin
Copy link
Member

@cardigan1008 , thank you for your contribution in #324 ! Does the PR fix all of the bugs you reported here, or is there more work needed ? If your PR fixes all of these bugs, I can close this issue.

Thanks

@cardigan1008
Copy link
Contributor

cardigan1008 commented Jul 29, 2024 •
edited
Loading

@cardigan1008 , thank you for your contribution in #324 ! Does the PR fix all of the bugs you reported here, or is there more work needed ? If your PR fixes all of these bugs, I can close this issue.

Thanks

For this issue, we are halfway there with 8 out of 15 bugs fixed (panic 1-4, 8, 11-12, 14). Regarding #246, the panics are almost all resolved, with 13 out of 15 fixed (panic 16-28). I'll continue working on it and hopefully, we can close these two issues soon!

@ChristopherRabotin
Copy link
Member

Let's move the rest of this ticket to version 4.1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@ChristopherRabotin @gwbres @xizheyin @cardigan1008