Skip to content

fix(fuzz): Avoid overflow in gen_unary #9024

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aakoshh merged 1 commit into from
Jun 26, 2025
Merged

fix(fuzz): Avoid overflow in gen_unary #9024

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions tooling/ast_fuzzer/src/program/func.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -715,12 +715,17 @@
typ: &Type,
max_depth: usize,
) -> arbitrary::Result<Option<TrackedExpression>> {
// Negation can cause overflow: for example `-1*i8::MIN` does not fit into `i8`, because `i8` is [-128, 127].
let avoid_overflow = self.ctx.config.avoid_overflow || self.in_no_dynamic;

let mut make_unary = |op| {
self.gen_expr(u, typ, max_depth.saturating_sub(1), Flags::NESTED)
.map(|(rhs, is_dyn)| Some((expr::unary(op, rhs, typ.clone()), is_dyn)))
};
if types::is_numeric(typ) {
// Assume we already checked with `can_unary_return` that it's signed.

if matches!(typ, Type::Field)
|| matches!(typ, Type::Integer(Signedness::Signed, _)) && !avoid_overflow
{
make_unary(UnaryOp::Minus)
} else if types::is_bool(typ) {
make_unary(UnaryOp::Not)
Expand Down Expand Up @@ -1577,9 +1582,9 @@
ctx.config.max_loop_size = 10;
ctx.config.vary_loop_size = false;
ctx.gen_main_decl(&mut u);
let mut fctx = FunctionContext::new(&mut ctx, FuncId(0));

Check warning on line 1585 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
fctx.budget = 2;

Check warning on line 1586 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
let loop_code = format!("{}", fctx.gen_loop(&mut u).unwrap()).replace(" ", "");

Check warning on line 1587 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)

assert!(
loop_code.starts_with(
Expand All @@ -1602,8 +1607,8 @@
ctx.config.max_loop_size = 10;
ctx.config.vary_loop_size = false;
ctx.gen_main_decl(&mut u);
let mut fctx = FunctionContext::new(&mut ctx, FuncId(0));

Check warning on line 1610 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
fctx.budget = 2;

Check warning on line 1611 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
let while_code = format!("{}", fctx.gen_while(&mut u).unwrap()).replace(" ", "");

assert!(
Expand Down
Loading