I set up cargo-fuzz to test for inputs that would cause a panic. After 15 minutes or so, I came across this input, and was able to minimize it slightly (all of these result in a panic):
tpw0m0mB2B2e
tpw0m0mB2B
tp0m0mB2B
p0m0mB2B
Here's the fuzz target I used:
#![no_main]
use libfuzzer_sys::fuzz_target;
use smartcalc::SmartCalc;
fuzz_target!(|input: String| {
eprintln!("FUZZ: {:?}", input);
let calc = SmartCalc::default();
let _ = calc.execute("en".to_string(), input);
});
Expected
Returns an error.
Actual
smartcalc = "1.0.7"
Panics with the following backtrace:
thread '<unnamed>' panicked at 'called `Option::unwrap()` on a `None` value', /home/aaron/code/smartcalc/src/compiler/dynamic_type.rs:160:161
stack backtrace:
0: rust_begin_unwind
at /rustc/8d60bf427a4b055f464122062e76b3ec34d4f8ba/library/std/src/panicking.rs:584:5
1: core::panicking::panic_fmt
at /rustc/8d60bf427a4b055f464122062e76b3ec34d4f8ba/library/core/src/panicking.rs:143:14
2: core::panicking::panic
at /rustc/8d60bf427a4b055f464122062e76b3ec34d4f8ba/library/core/src/panicking.rs:48:5
3: <smartcalc::compiler::dynamic_type::DynamicTypeItem as smartcalc::compiler::DataItem>::calculate
4: smartcalc::compiler::Interpreter::calculate_item
5: smartcalc::compiler::Interpreter::executer_binary
6: smartcalc::compiler::Interpreter::execute_ast
7: smartcalc::compiler::Interpreter::executer_binary
8: smartcalc::compiler::Interpreter::execute_ast
9: smartcalc::smartcalc::SmartCalc::execute_text
10: smartcalc::smartcalc::SmartCalc::execute_session
11: smartcalc::smartcalc::SmartCalc::execute
12: rust_fuzzer_test_input
13: __rust_try
14: LLVMFuzzerTestOneInput
15: _ZN6fuzzer6Fuzzer15ExecuteCallbackEPKhm
16: _ZN6fuzzer10RunOneTestEPNS_6FuzzerEPKcm
17: _ZN6fuzzer12FuzzerDriverEPiPPPcPFiPKhmE
18: main
19: __libc_start_main
20: _start
Reproduction
I set up cargo-fuzz to test for inputs that would cause a panic. After 15 minutes or so, I came across this input, and was able to minimize it slightly (all of these result in a panic):
Here's the fuzz target I used:
Expected
Returns an error.
Actual
Panics with the following backtrace: