dtolnay / dtolnay/syn

Found slow units on syn::parse_str using cargofuzz

Open
#1,864 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
3.4k
Forks
374
Avg merge
1d 5h
Merged PRs (30d)
2

Description

Some slow parsing behaviors observed during fuzz testing. **Not a crash or a critical bug**, but addressing these cases can help improve the robustness and efficiency of the parsing logic.

---
**Test on version: v2.0.100**

---
**Harness**
```rust
#![no_main]
extern crate libfuzzer_sys;
extern crate syn;

use libfuzzer_sys::fuzz_target;
use syn::spanned::Spanned;
use syn::parse_str;

fuzz_target!(|data: &str| {
if let Ok(value) = parse_str::(data) {
let _ = value.span();
}
});
```

---
Problematic input 1
```
tb|kP--&t*..4|kP--&t&t*..4|kP--&t*..4|q-&t*..4P
|*..4|q-&t*..4P
|kq-&tb|kP--&t*..4|kP--&t&t*..4|kP--&t*..4|q-&t*..4P
|*..4|q-&t*..4P
|kq-&t*..t*..4|q-&t*..4P
|*..4|q-&t*..4P
|kq-&tb|kP--&t*..4|kP--&t&t*..4|kP--&t*..4|q-&t*..4P
|*..4|kP--&t*..4|q-&t*..4P
|*..4|q-&t*..4P
|kq-&t*..t*..4|qkHPk=1%0|s
```

Execution Output:
```
Executed fuzz/artifacts_cluster/syn_span2_fuzz/slow-unit-1da6724f047297669763f0d258c9b27c6b92c037 in 162148 ms
```

----
Problematic input 2

```
tb|kP--&t*..4|kP--&t&t*..4|kP--&t*..4|q-&t*..4|kP--&t&t*..4|kP--&t*..4|q-&t*..4P
|*..4|q-&t*..4P
|kq-&tb|kP--&t*..4|kP--&t&t*..4|kP--&t*..4|q-&t*..4P
|*..4|q-&t*..4P
|kqt*..4P
|*..4|q-&t*..4P
|kq-&tb|kP--&t*..4|kP--&t&t*..4|kP--&t*..4|q-&t*..4P
|*..4|q-&t*..4P
|kq-&t*..-&tkHPk=1%0|t*..-&tkHPk=1%0|s
```
Execution output:

```
Executed fuzz/artifacts_cluster/syn_span2_fuzz/slow-unit-e02f19b7534f6d394c94700f5038d5f0f3cfa945 in 30809 ms
```

----

Environment:
- OS: macOS (aarch64-apple-darwin)
- Rust Version: rustc 1.83.0-nightly

---
The pattern repetition and inclusion of non-printable characters likely cause the syn parser to repeatedly attempt matching.
The combination of nested patterns and malformed syntax may be triggering deep recursion or inefficient parsing paths.

possibly originated from this recursion: [src/macros.rs](https://github.com/dtolnay/syn/blob/4ae637a80e069b669e60e1d760803dbb11adc17c/src/macros.rs#L100)
```rust
generate_to_tokens!(
($($arms)* $(#[cfg $cfg_attr])* $name::$variant(_e) => _e.to_tokens($tokens),)
```

---

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.