Skip to content

fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode #8996

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aakoshh merged 4 commits into from
Jun 24, 2025
Merged

fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode #8996

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
489b433
Avoid binary operations which can overflow when we are in no-dynamic …
aakoshh Jun 23, 2025
feba811
Add paretheses
aakoshh Jun 23, 2025
bd691c5
Merge branch 'master' into af/fix-fuzz-no-overflow-in-no-dynamic
aakoshh Jun 23, 2025
9367788
Merge branch 'master' into af/fix-fuzz-no-overflow-in-no-dynamic
aakoshh Jun 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions tooling/ast_fuzzer/src/program/func.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -737,11 +737,14 @@
max_depth: usize,
) -> arbitrary::Result<Option<TrackedExpression>> {
// Collect the operations can return the expected type.
// Avoid operations that can fail in no-dynamic mode, otherwise they will be considered non-constant indexes.
let ops = BinaryOp::iter()
.filter(|op| {
types::can_binary_op_return(op, typ)
&& (!self.ctx.config.avoid_overflow || !types::can_binary_op_overflow(op))
&& (!self.ctx.config.avoid_err_by_zero || !types::can_binary_op_err_by_zero(op))
&& (!(self.ctx.config.avoid_overflow || self.in_no_dynamic)
|| !types::can_binary_op_overflow(op))
&& (!(self.ctx.config.avoid_err_by_zero || self.in_no_dynamic)
|| !types::can_binary_op_err_by_zero(op))
})
.collect::<Vec<_>>();

Expand Down Expand Up @@ -1574,9 +1577,9 @@
ctx.config.max_loop_size = 10;
ctx.config.vary_loop_size = false;
ctx.gen_main_decl(&mut u);
let mut fctx = FunctionContext::new(&mut ctx, FuncId(0));

Check warning on line 1580 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
fctx.budget = 2;

Check warning on line 1581 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
let loop_code = format!("{}", fctx.gen_loop(&mut u).unwrap()).replace(" ", "");

Check warning on line 1582 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)

assert!(
loop_code.starts_with(
Expand All @@ -1599,8 +1602,8 @@
ctx.config.max_loop_size = 10;
ctx.config.vary_loop_size = false;
ctx.gen_main_decl(&mut u);
let mut fctx = FunctionContext::new(&mut ctx, FuncId(0));

Check warning on line 1605 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
fctx.budget = 2;

Check warning on line 1606 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
let while_code = format!("{}", fctx.gen_while(&mut u).unwrap()).replace(" ", "");

assert!(
Expand Down
Loading