coreutils icon indicating copy to clipboard operation
coreutils copied to clipboard

Panic in `timeout` with some multi-byte characters when parsing duration (instead of error)

Open fwip opened this issue 2 years ago • 0 comments

Reproduction: First, build timeout. Then run: ./target/debug/timeout 10€ echo "this will panic"

thread 'main' panicked at 'byte index 4 is not a char boundary; it is inside '€' (bytes 2..5) of `10€`', src/uucore/src/lib/parser/parse_time.rs:54:18
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

This comes from uucore's parse_time: https://github.com/uutils/coreutils/blob/main/src/uucore/src/lib/parser/parse_time.rs#L54 A similar panic might be present in sleep or du, as they also call parse_time. A fix could be to switch from bracket-slicing to string.get(..len-1) and then handle the None case explicitly. Alternately, you could use the approach used in parse_time, where you loop through the leading ascii numbers and then check the remainder of the string.

Related: I found this bug via cargo-fuzz, it looks like there's been some activity in #1147 about this.

fwip avatar Feb 13 '23 01:02 fwip