Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: Parser panics when max_string_size set #776

Closed
nathaniel-brough opened this issue Nov 5, 2023 · 2 comments
Closed

Bug: Parser panics when max_string_size set #776

nathaniel-brough opened this issue Nov 5, 2023 · 2 comments
Labels

Comments

@nathaniel-brough
Copy link
Contributor

This bug was found using the fuzz harness in #774. Essentially it reaches "unreachable" code and panics.

Steps to reproduce;

const SCRIPT: &str = "//! This script simulates object-oriented programming (OOP) techniques using closures.\n\n// Externaprotectedl variable that will be captured.\nlet last_value = ();\n\n// Define object\nlet obj1 = #{\n    _data: 42,                                  // data field\n    get_data: || this._data,                    // property getter\n    action: || print(`Data=${thi                // call method\n} else {\n    print(\"we have a probhlme ere\");\n}\n\n// Define another object based on the first object\nlet obj2 = #{\n    _data:7777777777777777777777777777777777777777777777777777777777777777777777777777777 0,                                   // data field - new value\n    update: |x| {                               // property setter - another function\n        this._data = x * 2;\n        last_value = this._data;                // capture 'last_value'\n        this.action();\n    }\n};\nobj2.fill_with(obj1);                          ANSWER = 78_498;\nconst MAX_NUMBER_TO_CHECK = 1_000_000;\n\nlet prime_mask = [];\nprime_mask.pad(MAX_NUMBER_TO_CHECK + 1, true);\n\nprime_mask[0] = false;\nprime_mask[1] = false;\n\nlet total_primes_found = 0;\n\nfor p in 2..=MAX_NUMBER_TO_CHECK {\n    if !prime_mask[p] { continue; }\n\n    //print(p);\n\n    total_primes_found += 1;\n\n    for i in range(2 * p, MAX_NUMBER_TO_CHECK + 1, p) {\n        prime_mask[i] = false;\n    }\n}\n\np  // add all other fields from obj1\n\nif obj2.get_data() > 0 {               ";

use rhai::{Engine, EvalAltResult};

pub fn main() -> Result<(), Box<EvalAltResult>> {
    let mut engine = Engine::new();
    engine.set_max_string_size(1000);
    engine.set_max_array_size(500);
    engine.set_max_map_size(500);
    engine.set_max_variables(1000);
    engine.set_max_modules(1000);
    engine.set_max_call_levels(10);
    engine.set_max_expr_depths(50, 5);
    engine.set_optimization_level(rhai::OptimizationLevel::None);
    let engine = engine;
    engine.run(SCRIPT)?;
    Ok(())
}

Backtrace

thread 'main' panicked at src/parser.rs:1597:40:
internal error: entered unreachable code: string within an interpolated string literal expected but gets LexError(StringTooLong(1000))
stack backtrace:
   0: rust_begin_unwind
             at /rustc/2f1bd0729b74787f55d4cbc7818cfd787cd43a99/library/std/src/panicking.rs:597:5
   1: core::panicking::panic_fmt
             at /rustc/2f1bd0729b74787f55d4cbc7818cfd787cd43a99/library/core/src/panicking.rs:72:14
   2: rhai::parser::<impl rhai::engine::Engine>::parse_primary
             at ./src/parser.rs:1597:40
   3: rhai::parser::<impl rhai::engine::Engine>::parse_unary
             at ./src/parser.rs:2041:18
   4: rhai::parser::<impl rhai::engine::Engine>::parse_expr
             at ./src/parser.rs:2682:19
   5: rhai::parser::<impl rhai::engine::Engine>::parse_fn_call
             at ./src/parser.rs:720:32
   6: rhai::parser::<impl rhai::engine::Engine>::parse_postfix
             at ./src/parser.rs:1822:21
   7: rhai::parser::<impl rhai::engine::Engine>::parse_primary
             at ./src/parser.rs:1747:9
   8: rhai::parser::<impl rhai::engine::Engine>::parse_unary
             at ./src/parser.rs:2041:18
   9: rhai::parser::<impl rhai::engine::Engine>::parse_expr
             at ./src/parser.rs:2682:19
  10: rhai::parser::<impl rhai::engine::Engine>::parse_expr_stmt
             at ./src/parser.rs:3225:20
  11: rhai::parser::<impl rhai::engine::Engine>::parse_stmt
             at ./src/parser.rs:3516:18
  12: rhai::parser::<impl rhai::engine::Engine>::parse_anon_fn
             at ./src/parser.rs:3844:20
  13: rhai::parser::<impl rhai::engine::Engine>::parse_primary
             at ./src/parser.rs:1517:21
  14: rhai::parser::<impl rhai::engine::Engine>::parse_unary
             at ./src/parser.rs:2041:18
  15: rhai::parser::<impl rhai::engine::Engine>::parse_expr
             at ./src/parser.rs:2682:19
  16: rhai::parser::<impl rhai::engine::Engine>::parse_map_literal
             at ./src/parser.rs:1110:24
  17: rhai::parser::<impl rhai::engine::Engine>::parse_primary
             at ./src/parser.rs:1620:32
  18: rhai::parser::<impl rhai::engine::Engine>::parse_unary
             at ./src/parser.rs:2041:18
  19: rhai::parser::<impl rhai::engine::Engine>::parse_expr
             at ./src/parser.rs:2682:19
  20: rhai::parser::<impl rhai::engine::Engine>::parse_let
             at ./src/parser.rs:2954:13
  21: rhai::parser::<impl rhai::engine::Engine>::parse_stmt
             at ./src/parser.rs:3500:27
  22: rhai::parser::<impl rhai::engine::Engine>::parse_global_level
             at ./src/parser.rs:3979:24
  23: rhai::parser::<impl rhai::engine::Engine>::parse
             at ./src/parser.rs:4025:34
  24: rhai::api::run::<impl rhai::engine::Engine>::run_with_scope
             at ./src/api/run.rs:76:13
  25: rhai::api::run::<impl rhai::engine::Engine>::run
             at ./src/api/run.rs:29:9
  26: bug::main
             at ./examples/bug.rs:16:5
  27: core::ops::function::FnOnce::call_once
             at /rustc/2f1bd0729b74787f55d4cbc7818cfd787cd43a99/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
@schungx schungx added the bug label Nov 6, 2023
@schungx
Copy link
Collaborator

schungx commented Nov 6, 2023

Great catch. I'll take a look at this when I get back to my desk.

@schungx
Copy link
Collaborator

schungx commented Nov 12, 2023

This is fixed and will go into the next release. Useful stuff, fuzzing is.

@schungx schungx closed this as completed Nov 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants