Skip to content

Panic in StructFields::from_fields() on malformed file: length mismatch between names and dtypes #8849

Description

@lorenzhs

What happened?

More fuzzing, again in struct types: if the number of field names and dtypes doesn't match, StructFields::from_fields panics. StructFields::from_fb decodes them independently and passes them to StructFields::from_fields which is infallible.

thread 'main' (2155192) panicked at vortex-array/src/dtype/struct_.rs:325:13:
Other error: length mismatch between names (0) and dtypes (3)
Backtrace:
   0: vortex_array::dtype::struct_::StructFields::from_fields
   1: vortex_array::dtype::serde::flatbuffers::<impl core::convert::TryFrom<vortex_array::dtype::serde::flatbuffers::ViewedDType> for vortex_array::dtype::DType>::try_from
   2: vortex_array::dtype::serde::flatbuffers::<impl vortex_array::dtype::DType>::from_flatbuffer
   3: vortex_file::footer::deserializer::FooterDeserializer::deserialize
   4: vortex_file::open::VortexOpenOptions::open::{{closure}}
   5: vortex_file::open::VortexOpenOptions::open_path::{{closure}}
   6: vortex_tui::inspect::VortexInspector::read_footer::{{closure}}
   7: vortex_tui::inspect::exec_inspect::{{closure}}
   8: vortex_tui::native_cli::launch_from::{{closure}}
   9: vx::main::{{closure}}
  10: vx::main
  11: std::sys::backtrace::__rust_begin_short_backtrace
  12: std::rt::lang_start::{{closure}}
  13: std::rt::lang_start_internal
  14: main
  15: __libc_start_call_main
             at ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
  16: __libc_start_main_impl
             at ./csu/../csu/libc-start.c:360:3
  17: _start

Steps to reproduce

https://4z2.de/fuzz_dtype_2.vortex sha256sum: 6ce37d27ecd1642ea12d9b0211b5643c12b848b68ff2969ded65e0a79d9933d9

Environment

develop as of c5e075ab7f9babffd32f9592e8e35a1981c5cd49. vx inspect does the trick

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugA bug issue

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions