servo / servo/rust-url

Program Crash in fuzzing (assert failed in parse_path)

Open
#841 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.6k
Forks
406
PR merge metrics
No merged PRs in 30d

Description

  • Note that this crate implements the URL Standard not RFC 1738 or RFC 3986

Describe the bug
I have enhanced my testing tool and retested the library, only to find that the bug I previously reported has not been fully fixed. Moreover, there is a new test sequence that triggers the same assertion. Previous issue is here

version

[dependencies]
url = "2.4.0"

source code

fn main() {
    let _param0 = "\u{16}file:///11C//////\0";
    let _param2 = "..#fB????b\0\0\0?,\u{16}fil";
    let _param3 = "e\n//\u{1f}1\u{1e}01\n\n\n\n\n\n\n\n\n\n";
    let _param4 = "\n\n\n\n/:..#\u{10}o:/11;/k:";
    let _param5 = "..#,\u{16}\u{16}f\u{1f}Tl..\u{1b}, ??D@";
    /*println!(
        "_param0 = {:?}, _param2 = {:?}, _param3 = {:?}, _param4 = {:?}",
        _param0, _param2, _param3, _param4
    );*/
    let mut _local0 = if let Ok(x) = url::Url::parse(_param0) {
        x
    } else {
        use std::process;
        process::exit(0);
    };
    //let _ = url::quirks::domain_to_unicode(_param1);
    //let _ = url::Url::has_authority(&(_local0));
    let _ = url::quirks::set_pathname(&mut (_local0), _param2);
    let _ = url::quirks::username(&(_local0));
    let _ = url::quirks::pathname(&(_local0));
    let _ = url::quirks::set_hostname(&mut (_local0), _param3);
    let _ = url::quirks::host(&(_local0));
    let _ = url::quirks::set_pathname(&mut (_local0), _param4);
    let _ = url::Url::join(&(_local0), _param5);
}

error information

thread 'main' panicked at 'assertion failed: self.serialization.as_bytes()[segment_start - 1] == b\'/\'', /home/yxz/.cargo/registry/src/mirrors.ustc.edu.cn-61ef6e0cd06fb9b8/url-2.4.0/src/parser.rs:1236:21

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at src/parser.rs:1236 and reproduce the panic with the Rust program in the report, focusing on the quirks::set_pathname, quirks::set_hostname, and Url::join calls. Compare the failing path handling with the URL Standard and issue 838. Done means this sequence no longer triggers the assertion, with regression coverage for the reported input.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.