bson-rust: Bugs in decoder found by fuzzing

Found the following:

  • “thread ‘<unnamed>’ panicked at ‘No such local time’” From: chrono-0.2.25/src/offset/mod.rs:151 via src/decoder/mod.rs:172
  • “thread ‘<unnamed>’ panicked at ‘attempt to multiply with overflow’” - src/decoder/mod.rs:172
  • “thread ‘<unnamed>’ panicked at ‘attempt to subtract with overflow’” src/decoder/mod.rs:45
  • “AddressSanitizer failed to allocate 0xffffffff93000000 bytes” (whatever that means in real life)

Full logs: https://gist.github.com/killercup/5e8623e0d8b0fe9868b45eb223ef51d8 (See last few lines for inputs used, in bytes or base64)

See https://github.com/rust-fuzz/targets/pull/51 for sources, I ran it with

$ env ASAN_OPTIONS="detect_odr_violation=0 allocator_may_return_null=1" ./run-fuzzer.sh bson read_bson

cc https://github.com/rust-fuzz/targets/issues/39

About this issue

  • Original URL
  • State: closed
  • Created 7 years ago
  • Comments: 17 (13 by maintainers)

Commits related to this issue

Most upvoted comments

@zonyitoo note that mgo is neither an official MongoDB driver nor actively maintained; the official (albeit pre-stable) Go driver is here

Great investigations, thanks @zonyitoo + @neosilky!