Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vrl::compile: attempt to subtract with overflow #46

Closed
stasos24 opened this issue Jul 13, 2022 · 3 comments
Closed

vrl::compile: attempt to subtract with overflow #46

stasos24 opened this issue Jul 13, 2022 · 3 comments
Labels
fuzz Issues found from fuzz testing type: bug A code related bug vrl: compiler Changes to the compiler

Comments

@stasos24
Copy link

stasos24 commented Jul 13, 2022

Hello, i've found a secureity bug during fuzzing vector.

Version: v0.23.0

Steps to reproduce:
Download a repo with fuzz harness: https://github.com/stasos24/vector/tree/master/lib/vrl/core/fuzzing

cargo build --bin covbuild
target/debug/covbuild < crash.file

Link to crash.file:
crash_file

Rust backtrace:

thread 'main' panicked at 'attempt to subtract with overflow', /opt/fuzz/vector/lib/vrl/compiler/src/expression/assignment.rs:250:37
stack backtrace:
   0: rust_begin_unwind
             at /rustc/38b72154ded23847cd08a796d0c6708b5efac265/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /rustc/38b72154ded23847cd08a796d0c6708b5efac265/library/core/src/panicking.rs:142:14
   2: core::panicking::panic
             at /rustc/38b72154ded23847cd08a796d0c6708b5efac265/library/core/src/panicking.rs:48:5
   3: vrl_compiler::expression::assignment::verify_overwriteable
             at /opt/fuzz/vector/lib/vrl/compiler/src/expression/assignment.rs:250:37
   4: vrl_compiler::expression::assignment::Assignment::new
             at /opt/fuzz/vector/lib/vrl/compiler/src/expression/assignment.rs:64:17
   5: vrl_compiler::compiler::Compiler::compile_assignment
             at /opt/fuzz/vector/lib/vrl/compiler/src/compiler.rs:551:26
   6: vrl_compiler::compiler::Compiler::compile_expr
             at /opt/fuzz/vector/lib/vrl/compiler/src/compiler.rs:118:33
   7: vrl_compiler::compiler::Compiler::compile_root_exprs
             at /opt/fuzz/vector/lib/vrl/compiler/src/compiler.rs:231:41
   8: vrl_compiler::compiler::Compiler::compile
             at /opt/fuzz/vector/lib/vrl/compiler/src/compiler.rs:61:27
   9: vrl::compile_with_state
             at /opt/fuzz/vector/lib/vrl/vrl/src/lib.rs:45:5
  10: vrl::compile_with_external
             at /opt/fuzz/vector/lib/vrl/vrl/src/lib.rs:34:5
  11: vrl::compile
             at /opt/fuzz/vector/lib/vrl/vrl/src/lib.rs:26:5
  12: covbuild::main
             at ./src/cov.rs:14:3
  13: core::ops::function::FnOnce::call_once
             at /rustc/38b72154ded23847cd08a796d0c6708b5efac265/library/core/src/ops/function.rs:248:5
@fuchsnj
Copy link
Member

fuchsnj commented Jul 13, 2022

This is likely a duplicate of vectordotdev/vector#13461

@fuchsnj fuchsnj added vrl: compiler Changes to the compiler type: bug A code related bug labels Jul 13, 2022
@stasos24
Copy link
Author

Also found same error at:
thread 'main' panicked at 'attempt to subtract with overflow', /opt/fuzz/vector/lib/vrl/compiler/src/expression/assignment.rs:259:37
Input file:
crash_file
And at:
thread 'main' panicked at 'attempt to subtract with overflow', /opt/fuzz/vector/lib/vrl/compiler/src/expression/assignment.rs:253:62
Input file:
crash_file

@fuchsnj fuchsnj transferred this issue from vectordotdev/vector Mar 28, 2023
@fuchsnj
Copy link
Member

fuchsnj commented Apr 28, 2023

The panics here have been prevented by vectordotdev/vector#14114 and #207
There is still a known bug related to this behavior tracked here but it can no longer panic.

@fuchsnj fuchsnj closed this as completed Apr 28, 2023
@fuchsnj fuchsnj added the fuzz Issues found from fuzz testing label May 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
fuzz Issues found from fuzz testing type: bug A code related bug vrl: compiler Changes to the compiler
Projects
None yet
Development

No branches or pull requests

2 participants