What happened?
More fuzzing results. Opening a crafted .vortex file whose file DType is a struct with a field whose DType-union
discriminant is unknown panics. The public open path (VortexOpenOptions::open) calls into StructFields::fields(), which vortex_expect(...)s a fallible flatbuffer decode. Field-DType validity is checked lazily, so the top-level DType segment parses fine and the panic only fires later, while parsing the file-statistics footer.
Backtrace:
0: vortex_array::dtype::serde::flatbuffers::<impl core::convert::TryFrom<vortex_array::dtype::serde::flatbuffers::ViewedDType> for vortex_array::dtype::DType>::try_from
1: vortex_array::dtype::struct_::FieldDTypeInner::value
2: <core::iter::adapters::GenericShunt<I,R> as core::iter::traits::iterator::Iterator>::next
3: vortex_file::footer::file_statistics::FileStatistics::from_flatbuffer
4: vortex_file::footer::deserializer::FooterDeserializer::deserialize
5: vortex_file::open::VortexOpenOptions::open::{{closure}}
6: vortex_file::open::VortexOpenOptions::open_path::{{closure}}
7: vortex_tui::inspect::VortexInspector::read_footer::{{closure}}
8: vortex_tui::inspect::exec_inspect::{{closure}}
9: vortex_tui::native_cli::launch_from::{{closure}}
10: vx::main::{{closure}}
11: vx::main
12: std::sys::backtrace::__rust_begin_short_backtrace
13: std::rt::lang_start::{{closure}}
14: std::rt::lang_start_internal
15: main
16: __libc_start_call_main
at ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
17: __libc_start_main_impl
at ./csu/../csu/libc-start.c:360:3
18: _start
stack backtrace:
0: __rustc::rust_begin_unwind
1: core::panicking::panic_fmt
2: <core::result::Result<T,E> as vortex_error::VortexExpect>::vortex_expect::{{closure}}
3: <core::iter::adapters::GenericShunt<I,R> as core::iter::traits::iterator::Iterator>::next
4: vortex_file::footer::file_statistics::FileStatistics::from_flatbuffer
5: vortex_file::footer::deserializer::FooterDeserializer::deserialize
6: vortex_file::open::VortexOpenOptions::open::{{closure}}
7: vortex_file::open::VortexOpenOptions::open_path::{{closure}}
8: vortex_tui::inspect::VortexInspector::read_footer::{{closure}}
9: vortex_tui::inspect::exec_inspect::{{closure}}
10: vortex_tui::native_cli::launch_from::{{closure}}
11: vx::main::{{closure}}
12: vx::main
Steps to reproduce
https://4z2.de/fuzz_dtype.vortex sha256sum: 0730a2948c2632c5f462049d0bf6d120fa8d42a2856962f31b6e57818cde444f
vx inspect does the trick
Environment
reproes on develop as of c5e075a
Additional context
No response
What happened?
More fuzzing results. Opening a crafted
.vortexfile whose fileDTypeis a struct with a field whose DType-uniondiscriminant is unknown panics. The public open path (
VortexOpenOptions::open) calls intoStructFields::fields(), whichvortex_expect(...)s a fallible flatbuffer decode. Field-DType validity is checked lazily, so the top-level DType segment parses fine and the panic only fires later, while parsing the file-statistics footer.Steps to reproduce
https://4z2.de/fuzz_dtype.vortex sha256sum:
0730a2948c2632c5f462049d0bf6d120fa8d42a2856962f31b6e57818cde444fvx inspectdoes the trickEnvironment
reproes on
developas of c5e075aAdditional context
No response