another fuzzing bug

kokes · Jul 20, 2021 · 2c2548f · 2c2548f
1 parent b41ac00
commit 2c2548f
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 1 deletion.
diff --git a/src/database/dataset.go b/src/database/dataset.go
@@ -203,6 +203,7 @@ func (uid UID) MarshalJSON() ([]byte, error) {
 }
 
 // ARCH: test this instead the Unmarshal? Or both?
+// TODO(next): test that input is 18 chars exactly (fuzzing found a bug here)
 func UIDFromHex(data []byte) (UID, error) {
 	var uid UID
 	unhexed := make([]byte, 9)

diff --git a/src/query/expr/parser.go b/src/query/expr/parser.go
@@ -17,6 +17,7 @@ var errInvalidQuery = errors.New("invalid SQL query")
 var errInvalidFunctionName = errors.New("invalid function name")
 var errEmptyExpression = errors.New("cannot parse an expression from an empty string")
 var errInvalidTuple = errors.New("invalid tuple expression")
+var errInvalidDatasetVersion = errors.New("invalid dataset version")
 
 const (
 	_ int = iota
@@ -488,7 +489,10 @@ func ParseQuerySQL(s string) (Query, error) {
 		}
 		dsn := p.curToken().value
 		if len(dsn) == 0 || dsn[0] != 'v' {
-			return q, fmt.Errorf("invalid dataset version, got %s", dsn)
+			return q, fmt.Errorf("%w: %s", errInvalidDatasetVersion, dsn)
+		}
+		if len(dsn[1:]) != 18 {
+			return q, fmt.Errorf("%w: %s", errInvalidDatasetVersion, dsn)
 		}
 		datasetID.Version, err = database.UIDFromHex(dsn[1:])
 		if err != nil {

diff --git a/src/query/expr/parser_fuzz_test.go b/src/query/expr/parser_fuzz_test.go
@@ -15,6 +15,17 @@ func FuzzExpressionParser(f *testing.F) {
 		}
 	})
 }
+func FuzzExpressionsParser(f *testing.F) {
+	f.Add("1+2*3, true, false")
+	f.Add("foo = bar, foo > 1")
+	f.Add("foo * 2 > 3e2")
+	f.Add("foo, bar, baz")
+	f.Fuzz(func(t *testing.T, raw string) {
+		if _, err := ParseStringExprs(raw); err != nil {
+			t.Skip()
+		}
+	})
+}
 
 func FuzzSQLParser(f *testing.F) {
 	f.Add("SELECT foo, bar, baz FROM bar")

diff --git a/src/query/expr/parser_test.go b/src/query/expr/parser_test.go
@@ -520,6 +520,9 @@ func TestParsingSQL(t *testing.T) {
 		{"SELECT foo FROM bar GROUP BY foo ORDER BY foo NULLS BY LIMIT 100", errInvalidQuery},
 		{"SELECT foo FROM bar GROUP BY foo ORDER BY foo ASC NULLS LIMIT 100", errInvalidQuery},
 		{"SELECT foo FROM bar GROUP BY foo ORDER BY foo DESC NULLS LIMIT 100", errInvalidQuery},
+
+		// fuzzing entries
+		{"SELECT r FROM J@v111111D1110000000011", errInvalidDatasetVersion}, // this is invalid, because the version needs to be 18 chars
 	}
 
 	for _, test := range tests {