MiSawa / xq

Pure rust implementation of jq
MIT License
318 stars 18 forks source link

Fuzzer found a case that lexer panics #122

Closed MiSawa closed 2 years ago

MiSawa commented 2 years ago
$ cargo fuzz fmt xq artifacts/xq/minimized-from-37bd2336ef7f08284b31460a375dac942849b84a

Output of `std::fmt::Debug`:

(
    "\n\t{\"n3\\fbr\\uffbr\\uffb3333fffbr",
    "",
)

This can further be minimized to

#[test]
fn test_from_fuzz() {
    assert_lex(
        r#""\uffbr\uffb3"#,
        &[], // actually this isn't what we expect, but they panic before it comes to assert_eq so it's fine
    );
}

It appeared that \\uffbr part causes an InvalidToken, and then when it comes to \\uffb3, lexer.match_() actually has the invalid part left \\uffbr\\uffb3 which causes

u32::from_str_radix(&lexer.match_()[2..], 16).unwrap()

to panic. Filed https://github.com/osa1/lexgen/issues/48