nautilus-fuzz / nautilus

A grammar based feedback Fuzzer
MIT License
427 stars 64 forks source link

Regex mutator panics when producing u32 values above char::MAX #62

Open djuricmilan opened 9 months ago

djuricmilan commented 9 months ago

The following regex rule can produce a u32 value that cannot be converted to a char :

ctx.regex(u'ANY', '.*')

As a consequence, the regex_mutator will panic in append_unicode_range on line 116, because from_u32 will return a None that the code tries to unwrap:

fn append_unicode_range(res: &mut Vec<u8>, scr: &mut RegexScript, cls: ClassUnicodeRange) {
    let mut chr_a_buf = [0; 4];
    let mut chr_b_buf = [0; 4];
    cls.start().encode_utf8(&mut chr_a_buf);
    cls.end().encode_utf8(&mut chr_b_buf);
    let a = u32::from_le_bytes(chr_a_buf);
    let b = u32::from_le_bytes(chr_b_buf);
    let c = scr.get_range(a as usize, (b + 1) as usize) as u32;
    append_char(res, std::char::from_u32(c).unwrap());
}

I suggest capping the value of b+1 to char::MAX to prevent this error, or using char::from_u32_unchecked instead.