hyperium / h2

HTTP 2.0 client & server implementation for Rust.
MIT License
1.35k stars 270 forks source link

Panic in `h2::proto::streams::store::Store::insert` #570

Closed olix0r closed 2 years ago

olix0r commented 2 years ago

oss-fuzz reports a panic in fuzz_e2e:

target/x86_64-unknown-linux-gnu/release/fuzz_e2e: Running 1 inputs 1 time(s) each.
Running: ../fuzz.repro
thread '<unnamed>' panicked at 'assertion failed: self.ids.insert(id, index).is_none()', /home/ver/b/h2/src/proto/streams/store.rs:108:9
stack backtrace:
   0: rust_begin_unwind
             at /rustc/8f8092cc32ec171becef8ceacec7dbb06c5d7d7e/library/std/src/panicking.rs:517:5
   1: core::panicking::panic_fmt
             at /rustc/8f8092cc32ec171becef8ceacec7dbb06c5d7d7e/library/core/src/panicking.rs:100:14
   2: core::panicking::panic
             at /rustc/8f8092cc32ec171becef8ceacec7dbb06c5d7d7e/library/core/src/panicking.rs:50:5
   3: h2::proto::streams::store::Store::insert
   4: h2::proto::streams::streams::Streams<B,P>::send_request
   5: fuzz_e2e::run::{{closure}}::{{closure}}
   6: fuzz_e2e::run::{{closure}}

I can reproduce this locally with

:; curl -Lo /tmp/fuzz https://oss-fuzz.com/download\?testcase_id\=5828090960936960
:; (cd fuzz && cargo +nightly fuzz run fuzz_e2e /tmp/fuzz)

More information at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36451 and https://oss-fuzz.com/testcase-detail/5828090960936960 (may require a Google login).

Is this a problem with the fuzz test? Or does this describe an actual runtime panic?

cc @DavidKorczynski @seanmonstar

seanmonstar commented 2 years ago

It appears it's not a fuzzing error, but a real panic. I think I've tracked it down, fiddling now to determine the best fix.