Closed
Description
Reproducer
I tried this code:
#![no_main]
use libfuzzer_sys::{fuzz_target, Corpus};
use lofty::file::AudioFile;
use lofty::file::{FileType, TaggedFileExt};
use lofty::probe::Probe;
const ALL_FILE_TYPES: &[FileType] = &[
FileType::Aac,
FileType::Aiff,
FileType::Ape,
FileType::Flac,
FileType::Mpeg,
FileType::Mp4,
FileType::Mpc,
FileType::Opus,
FileType::Vorbis,
FileType::Speex,
FileType::Wav,
FileType::WavPack,
];
fuzz_target!(|data: &[u8]| -> Corpus {
let mut corpus = Corpus::Reject;
for i in ALL_FILE_TYPES {
let s = std::io::Cursor::new(data);
let tagged_file = match Probe::with_file_type(s, *i).read() {
Ok(t) => t,
Err(_e) => {
continue;
}
};
corpus = Corpus::Keep;
tagged_file.properties();
tagged_file.tags();
tagged_file.primary_tag();
}
corpus
});
Summary
thread 'main' panicked at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/440cae8/lofty/src/wavpack/properties.rs:348:53:
index out of bounds: the len is 2 but the index is 2
stack backtrace:
0: rust_begin_unwind
at /rustc/b8c8287a229cd79604aa84c25e1235fc78cd5f2e/library/std/src/panicking.rs:665:5
1: core::panicking::panic_fmt
at /rustc/b8c8287a229cd79604aa84c25e1235fc78cd5f2e/library/core/src/panicking.rs:75:14
2: core::panicking::panic_bounds_check
at /rustc/b8c8287a229cd79604aa84c25e1235fc78cd5f2e/library/core/src/panicking.rs:285:5
3: lofty::wavpack::properties::get_extended_meta_info
4: lofty::wavpack::properties::read_properties
at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/440cae8/lofty/src/wavpack/properties.rs:158:20
5: lofty::wavpack::read::read_from
at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/440cae8/lofty/src/wavpack/read.rs:56:4
6: <lofty::wavpack::WavPackFile as lofty::file::audio_file::AudioFile>::read_from
at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/440cae8/lofty/src/wavpack/mod.rs:14:10
7: lofty::probe::Probe<R>::read
at /home/runner/.cargo/git/checkouts/lofty-rs-f5e48f8219b271cf/440cae8/lofty/src/probe.rs:479:26
8: lofty::check_file
at /home/runner/work/Automated-Fuzzer/Automated-Fuzzer/src/crates/lofty/src/main.rs:42:33
9: lofty::main
at /home/runner/work/Automated-Fuzzer/Automated-Fuzzer/src/crates/lofty/src/main.rs:26:9
10: core::ops::function::FnOnce::call_once
at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
Expected behavior
No response
Assets
crash-96407368cf46fbf0ef1285c4d84fbd39a919ef2b_minimized.zip