Skip to content

Panic in StructFields::fields() on malformed file: unwraps a fallible DType decode #8848

Description

@lorenzhs

What happened?

More fuzzing results. Opening a crafted .vortex file whose file DType is a struct with a field whose DType-union
discriminant is unknown panics. The public open path (VortexOpenOptions::open) calls into StructFields::fields(), which vortex_expect(...)s a fallible flatbuffer decode. Field-DType validity is checked lazily, so the top-level DType segment parses fine and the panic only fires later, while parsing the file-statistics footer.

Backtrace:
   0: vortex_array::dtype::serde::flatbuffers::<impl core::convert::TryFrom<vortex_array::dtype::serde::flatbuffers::ViewedDType> for vortex_array::dtype::DType>::try_from
   1: vortex_array::dtype::struct_::FieldDTypeInner::value
   2: <core::iter::adapters::GenericShunt<I,R> as core::iter::traits::iterator::Iterator>::next
   3: vortex_file::footer::file_statistics::FileStatistics::from_flatbuffer
   4: vortex_file::footer::deserializer::FooterDeserializer::deserialize
   5: vortex_file::open::VortexOpenOptions::open::{{closure}}
   6: vortex_file::open::VortexOpenOptions::open_path::{{closure}}
   7: vortex_tui::inspect::VortexInspector::read_footer::{{closure}}
   8: vortex_tui::inspect::exec_inspect::{{closure}}
   9: vortex_tui::native_cli::launch_from::{{closure}}
  10: vx::main::{{closure}}
  11: vx::main
  12: std::sys::backtrace::__rust_begin_short_backtrace
  13: std::rt::lang_start::{{closure}}
  14: std::rt::lang_start_internal
  15: main
  16: __libc_start_call_main
             at ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
  17: __libc_start_main_impl
             at ./csu/../csu/libc-start.c:360:3
  18: _start

stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: <core::result::Result<T,E> as vortex_error::VortexExpect>::vortex_expect::{{closure}}
   3: <core::iter::adapters::GenericShunt<I,R> as core::iter::traits::iterator::Iterator>::next
   4: vortex_file::footer::file_statistics::FileStatistics::from_flatbuffer
   5: vortex_file::footer::deserializer::FooterDeserializer::deserialize
   6: vortex_file::open::VortexOpenOptions::open::{{closure}}
   7: vortex_file::open::VortexOpenOptions::open_path::{{closure}}
   8: vortex_tui::inspect::VortexInspector::read_footer::{{closure}}
   9: vortex_tui::inspect::exec_inspect::{{closure}}
  10: vortex_tui::native_cli::launch_from::{{closure}}
  11: vx::main::{{closure}}
  12: vx::main

Steps to reproduce

https://4z2.de/fuzz_dtype.vortex sha256sum: 0730a2948c2632c5f462049d0bf6d120fa8d42a2856962f31b6e57818cde444f

vx inspect does the trick

Environment

reproes on develop as of c5e075a

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugA bug issue

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions