Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unsafe unwrap in parser #363

Closed
RadicalZephyr opened this issue Oct 13, 2018 · 2 comments · Fixed by #364
Closed

Unsafe unwrap in parser #363

RadicalZephyr opened this issue Oct 13, 2018 · 2 comments · Fixed by #364

Comments

@RadicalZephyr
Copy link
Contributor

Found with the new fuzz testing setup!

This input export\x09AA causes the Lexer to fail.

extern crate just;

fn lex_and_parse<'a>(input: &'a str) -> Result<(), just::CompilationError<'a>> {
  let tokens = just::Lexer::lex(input)?;
  let parser = just::Parser::new(input, tokens);
  let _justfile = parser.justfile()?;
  Ok(())
}

fn main() {
  let input = "export	AA";
  lex_and_parse(&input);
}
@casey
Copy link
Owner

casey commented Oct 13, 2018

Awesome, nice find!

The parser uses an itertools adapter that allows putting items back into an iterator. However, if you put back two items in a row, it overwrites the previous item. The bug was caused by removing and putting back an Eof token, and then putting back another token, overwriting the Eof token. The parser assumes that it will never advance past the last token, but since the Eof token was overwritten, it does so and crashes.

@casey
Copy link
Owner

casey commented Oct 13, 2018

I'm surprised that nobody ever hit this organically!

casey added a commit to casey/trophy-case that referenced this issue Oct 13, 2018
@RadicalZephyr added fuzz testing using `cargo-fuzz` to `just`, which found a [bug in the parser](github.com/casey/just/issues/363). It wasn't even a particularly weird edge case, and was definitely something that a normal user could have encountered.

Thanks `cargo-fuzz`!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants