djc / askama

Type-safe, compiled Jinja-like templates for Rust
Apache License 2.0
3.25k stars 213 forks source link

filter: fix errors found by fuzz #1067

Closed manunio closed 1 month ago

manunio commented 1 month ago

While fuzzing built-in filters center and indent, they errored out or caused an OOM due to a large value as input.

For center:

Executing task: cargo test --package askama --lib -- filters::tests::test_center --exact --show-output 

   Compiling askama v0.13.0 (/home/maxx/dev/security/oss-fuzz-projects/askama-manunio/askama)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.93s
     Running unittests src/lib.rs (target/debug/deps/askama-0c856712117dc4ab)

running 1 test
memory allocation of 111669149696 bytes failed
error: test failed, to rerun pass `-p askama --lib`

For indent:

cargo +nightly fuzz run fuzz_filters artifacts/fuzz_filters/oom-72ee499821247cdd28e7e114c397347901d4d5c7
   Compiling askama v0.13.0 (/home/maxx/dev/security/oss-fuzz-projects/askama-manunio/askama)
   Compiling askama-fuzz v0.0.0 (/home/maxx/dev/security/oss-fuzz-projects/askama-manunio/fuzz)
    Finished `release` profile [optimized + debuginfo] target(s) in 3.25s
    Finished `release` profile [optimized + debuginfo] target(s) in 0.05s
     Running `target/x86_64-unknown-linux-gnu/release/fuzz_filters -artifact_prefix=/home/maxx/dev/security/oss-fuzz-projects/askama-manunio/fuzz/artifacts/fuzz_filters/ artifacts/fuzz_filters/oom-72ee499821247cdd28e7e114c397347901d4d5c7`
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3494758370
INFO: Loaded 1 modules   (12661 inline 8-bit counters): 12661 [0x560504272ec0, 0x560504276035), 
INFO: Loaded 1 PC tables (12661 PCs): 12661 [0x560504276038,0x5605042a7788), 
target/x86_64-unknown-linux-gnu/release/fuzz_filters: Running 1 inputs 1 time(s) each.
Running: artifacts/fuzz_filters/oom-72ee499821247cdd28e7e114c397347901d4d5c7
8
==399595== ERROR: libFuzzer: out-of-memory (malloc(2147483648))
   To change the out-of-memory limit use -rss_limit_mb=<N>