neuzz icon indicating copy to clipboard operation
neuzz copied to clipboard

Infinite loop in splice_seed

Open moyix opened this issue 4 years ago • 0 comments

If fl1 is two bytes or less, splice_seed will loop infinitely, because (l_diff - f_diff) >= 2 will never be true. To demonstrate the issue I pulled out the splice_seed function into its own file (attached) and then ran:

$ dd if=/dev/zero of=file1 bs=1 count=2 # Create a two-byte file
$ for i in `seq 2 100` ; do dd if=/dev/urandom of=file$i bs=1 count=$[ $RANDOM % 521 ] ; done # Create a bunch of other files with random data
$ python3 splice.py file1 file{2..100}
3 splice.py file1 file* | head
0 0
0 1
0 1
0 1
[...]

This does actually come up in practice, as I found when trying to reproduce the harfbuzz results:

moyix@isabella:~/git/neuzz/programs/harfbuzz$ ls -Sl seeds/ | tail
-rw------- 1 moyix moyix   41 Oct 17 17:39 id_0_000696
-rw------- 1 moyix moyix   30 Oct 17 17:47 id_0_001100
-rw------- 1 moyix moyix   16 Oct 17 17:44 id_0_000968
-rw------- 1 moyix moyix   15 Oct 17 17:53 id_0_001270
-rw------- 1 moyix moyix    8 Oct 17 18:36 id_1_001848_cov
-rw------- 1 moyix moyix    7 Oct 17 18:06 id_0_001567
-rw------- 1 moyix moyix    6 Oct 17 18:36 id_1_001849
-rw------- 1 moyix moyix    4 Oct 17 19:35 id_1_002991
-rw------- 1 moyix moyix    3 Oct 17 19:38 id_1_003024_cov
-rw------- 1 moyix moyix    2 Oct 17 21:01 id_2_003989

moyix avatar Oct 18 '20 18:10 moyix