Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Some overflow panics found by fuzzing #431

Closed
WIZeaz opened this issue Dec 11, 2023 · 1 comment
Closed

Some overflow panics found by fuzzing #431

WIZeaz opened this issue Dec 11, 2023 · 1 comment

Comments

@WIZeaz
Copy link

WIZeaz commented Dec 11, 2023

Hi, I am trying to do some fuzzing for this crate, and I found some panics related to overflow. I have filtered some panics which I think it is not a bug. But there still have some panics I wonder if it is a bug. I list the code snippets below.

I believe this one is a bug.

let _: i8 = num::integer::mod_floor(-128, -1); // panic at 'attempt to calculate the remainder with overflow'

The expected output of mod_floor is 0, which is not out of range of i8. The problem also exists on other types.

println!("{:?}",num::integer::mod_floor(i32::MIN, -1));
println!("{:?}",num::integer::mod_floor(i64::MIN, -1));
println!("{:?}",num::integer::mod_floor(i128::MIN, -1));

The following cases are caused by out of range result. I wonder if they should be considered as bugs.

let _: (i8 ,i8) = num::integer::div_rem(-128, -1); // panic at 'attempt to divide with overflow'
let _: i8 = num::traits::sign::abs(-128); // panic at 'attempt to negate with overflow'
let _: i64 = num::abs_sub(3544668469065756977, -9209525551093438927); // panic at 'attempt to subtract with overflow'
let _: (u128 ,u128) = num::integer::gcd_lcm(12009965891327239886941778839922608393, 12009965891328373236456281444243278208); // panic at 'attempt to multiply with overflow'
let _: u8 = num::integer::lcm(255, 127); // panic at 'attempt to multiply with overflow'
@cuviper
Copy link
Member

cuviper commented Dec 11, 2023

The mod_floor panics are consistent with Rust's % operator -- e.g. i8::MIN % -1 also panics.

The following cases are caused by out of range result. I wonder if they should be considered as bugs.

They should be considered bugs in the code that provided those inputs. There's no correct value that the library can return, but some of them will use Rust's wrapping-overflow semantics in release mode instead of panicking.

See also: https://doc.rust-lang.org/reference/expressions/operator-expr.html#overflow

@WIZeaz WIZeaz closed this as completed Mar 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants