dotnet / runtime

.NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.
https://docs.microsoft.com/dotnet/core/
MIT License
15.27k stars 4.73k forks source link

[Fuzzing] AssemblyNameInfoFuzzer: CultureNotFoundException: Culture is not supported #107949

Closed MihaZupan closed 1 month ago

MihaZupan commented 1 month ago
System.Globalization.CultureNotFoundException: Culture is not supported. (Parameter 'name')
aaaA is an invalid culture identifier.
   at System.Globalization.CultureInfo..ctor(String name, Boolean useUserOverride)
   at System.Reflection.AssemblyName.set_CultureName(String value)
   at System.Reflection.Metadata.AssemblyNameInfo.ToAssemblyName()
   at DotnetFuzzing.Fuzzers.AssemblyNameInfoFuzzer.Test(Span`1 span) in D:\a\_work\1\s\src\libraries\Fuzzing\DotnetFuzzing\Fuzzers\AssemblyNameInfoFuzzer.cs:line 44
   at DotnetFuzzing.Fuzzers.AssemblyNameInfoFuzzer.FuzzTarget(ReadOnlySpan`1 bytes) in D:\a\_work\1\s\src\libraries\Fuzzing\DotnetFuzzing\Fuzzers\AssemblyNameInfoFuzzer.cs:line 27
   at DotnetFuzzing.Program.<>c__DisplayClass1_0.b__0(ReadOnlySpan`1 bytes) in D:\a\_work\1\s\src\libraries\Fuzzing\DotnetFuzzing\Program.cs:line 91
   at SharpFuzz.Fuzzer.LibFuzzer.Run(ReadOnlySpanAction action, Boolean ignoreExceptions)

Input: sibP,culture=aaaA

cc: @adamsitnik @buyaa-n

dotnet-policy-service[bot] commented 1 month ago

Tagging subscribers to this area: @dotnet/area-system-reflection-metadata See info in area-owners.md if you want to be subscribed.

dotnet-policy-service[bot] commented 1 month ago

Tagging subscribers to 'binaryformatter-migration': @adamsitnik, @bartonjs, @jeffhandley, @terrajobst

ericstj commented 1 month ago

@adamsitnik I'm guessing this is by-design? AssemblyName represents the Culture as a CultureInfo so feeding in a bogus value here will cause it to throw. Are there any side effects from this that would warrant it being a bug and not "by-design"?

adamsitnik commented 1 month ago

We just need to make sure this scenario is recognized properly (all unexpected exceptions are treated as bugs)

ericstj commented 1 month ago

I see, so you need to add a catch here to indicate you expect a CultureNotFoundException: https://github.com/dotnet/runtime/blob/d6094d218c74e0cc496a7bceeda016a3b34b1967/src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/AssemblyNameInfoFuzzer.cs#L60