fmt: `--tab-width`/`-T` has no upper bound — arithmetic overflow aborts at multiple sites (exit 134)
Open
Nobody has claimed this yet.
U - fmt
- Dominant language
- Rust
- Stars
- 24.1k
- Forks
- 2k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 365
Description
fmt validates --width against MAX_WIDTH (2500) but applies no upper bound to --tab-width/-T. A large -T makes compute_width return a value near usize::MAX, and every arithmetic consumer of it then overflows.
Steps to reproduce
Overflow-checks build (RUSTFLAGS="-C overflow-checks=on"):
$ printf '\thello world' | fmt -T 18446744073709551615
thread 'main' panicked at src/uu/fmt/src/linebreak.rs:59:22:
attempt to add with overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Aborted (core dumped)
$ echo $?
134
| site | overflow | reproducer |
|---|---|---|
linebreak.rs:32:28 |
multiply | printf '\ta\tb\tc\n' | fmt -q -T 9223372036854775808 |
linebreak.rs:59:22 |
add | printf 'aa\n\tbb\n' | fmt -T 18446744073709551615 |
linebreak.rs:114:16 |
add | printf 'a\tbb\n' | fmt -q -T 18446744073709551615 |
linebreak.rs:123:8 |
add | printf 'a\tb\n' | fmt -q -T 18446744073709551615 |
linebreak.rs:126:13 |
add | printf 'aa\n\tbb\n' | fmt -q -c -w 1 -T 18446744073709551615 |
linebreak.rs:281:21 |
subtract | printf '\ta\tb\tc\n' | fmt -T 9223372036854775807 |
linebreak.rs:300:33 |
add | printf 'aa\n\tbb\n' | fmt -c -w 1 -T 18446744073709551615 |
linebreak.rs:307:24 |
add | printf 'a\tb\n' | fmt -T 18446744073709551615 |
linebreak.rs:485:23 |
subtract | printf 'a\tb\n' | fmt -T 9223372036854775807 |
parasplit.rs:234:30 |
multiply | printf '\t\t\tx\n' | fmt -T 9223372036854775807 |
parasplit.rs:459:25 |
add | printf '\ta\tb\tc\n' | fmt -t -T 18446744073709551615 |
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with fmt's --tab-width/-T validation and compute_width, then inspect the arithmetic sites listed in src/uu/fmt/src/linebreak.rs and src/uu/fmt/src/parasplit.rs. Run the provided reproducers with overflow checks enabled; done means oversized tab widths are rejected or handled without arithmetic overflow or aborting.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100