Check arity before printing a fileref in its special spelling (Covered by dco/Brian_Egge.md)

A "fileref" type applied to one argument is printed as "t@?" and to two
as "t@off". showFileRef (lang/type.C) read targs[0] as soon as the
applied constructor was the "fileref" primitive, and only consulted the
arity afterwards to pick between those spellings. The compiler never
builds a fileref with any other arity, but the binary type decoder
builds a TApp from whatever the buffer says (decodeTApp), and nothing in
the encoding obliges a peer to supply an argument. Indexing the empty
argument vector binds a reference through its null data pointer, and the
show call through it is the null read OSS-Fuzz reports:

  https://issues.oss-fuzz.com/issues/550998929 - hobbes::showFileRef
  (fuzz-type-decode, null-dereference READ at 0x0)

The harness only calls hobbes::decode, so show() is reached without
leaving the decoder: the record layout validation rejects the
reproducer's record for an offset mismatch, and that diagnostic renders
the record it rejects, member types and all --

  decodeRecord -> Record::make -> withResolvedMemoryLayout
    -> "Actual/calculated member offset mismatch ... in record:"
    -> showRecord -> Variant::show -> showFull -> TApp::show
    -> showFileRef -> targs[0]

sizeOf's "Can't determine size of monotype" diagnostic shows the type
the same way. The bug is not confined to those messages, though: a
no-argument fileref decodes successfully, so any later rendering of a
decoded type reaches it, and the RPC layer (ipc/net.C) does render them
-- both sides feed peer-supplied type descriptions through the
typechecker, whose errors print the types involved, and Client::show
prints the decoded result types directly.

Old bug, not a regression: showFileRef is unchanged since the initial
import (f81d016, 2017), so every release carries it. The layout
diagnostics that let a bare decode() trip over it are recent (d45c864),
but the RPC path could always reach it by showing a decoded type. The
sibling special-case printer, Constraint::show, does not share the
defect -- it checks mts.size() before indexing; showFileRef was the only
unguarded one.

The fix: use the special spelling only when the arity fits it -- one or
two arguments -- and otherwise fall through to the generic constructor
form, so a no-argument application prints as "(fileref)". This also
corrects the over-applied case, which used to print "t@" and silently
drop the extra arguments.

TypeInf/ShowToleratesFileRefWithoutArguments drives everything through
hobbes::decode on encoded bytes, the surface the harness and the RPC
layer consume: a no-argument application shows in constructor form, an
over-applied one shows all its arguments, a record shaped like the
reproducer (a variant member carrying the no-argument application, at a
rejected offset) throws cleanly instead of crashing while the rejection
message is built, and the one- and two-argument spellings are unchanged.
It fails with the fix reverted (SIGSEGV). The minimized reproducer joins
the fuzz seed corpus in fuzz/corpus/type-decode/, which
oss-fuzz-build.sh now packages like the other corpora.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019Cf5Cv9r1wqa2YcgCWoLC3

Author: brianegge

fuzz/corpus/type-decode/fileref_no_args.bin

@@ -102,3 +102,7 @@ fi
 if [ -d "$SRCDIR/fuzz/corpus/fregion-reader" ]; then
   zip -jq "$OUT/fuzz-fregion-reader_seed_corpus.zip" "$SRCDIR/fuzz/corpus/fregion-reader/"*
 fi
+
+if [ -d "$SRCDIR/fuzz/corpus/type-decode" ]; then
+  zip -jq "$OUT/fuzz-type-decode_seed_corpus.zip" "$SRCDIR/fuzz/corpus/type-decode/"*
+fi

fuzz/oss-fuzz-build.sh

@@ -676,12 +676,14 @@ const MonoTypePtr& TAbs::body() const { return this->b; }
 // TODO: come up with a nicer way to generically print types in constructor form
 bool showFileRef(const MonoTypePtr& f, const MonoTypes& targs, std::ostream& out) {
   if (const Prim* fn = is<Prim>(f)) {
-    if (fn->name() == "fileref") {
+    // a decoded type description can apply "fileref" to any number of
+    // arguments, not just the one or two this spelling has slots for
+    if (fn->name() == "fileref" && (targs.size() == 1 || targs.size() == 2)) {
       targs[0]->show(out);
       out << "@";
       if (targs.size() == 1) {
         out << "?";
-      } else if (targs.size() == 2) {
+      } else {
         targs[1]->show(out);
       }
       return true;

lib/hobbes/lang/type.C

@@ -411,6 +411,69 @@ TEST(TypeInf, DecodeRejectsNonPrimitiveSwitchSelector) {
   EXPECT_TRUE(*rt == *sw);
 }
 
+TEST(TypeInf, ShowToleratesFileRefWithoutArguments) {
+  // "fileref" applied to one or two arguments is printed in a special spelling
+  // ("t@?", "t@off"), and showFileRef read its first argument before asking how
+  // many there were. The compiler only ever applies "fileref" to one or two
+  // arguments, but the binary decoder builds a TApp from whatever the buffer
+  // says, and nothing in the encoding obliges a peer to supply any -- so a
+  // decoded application of "fileref" to nothing indexed an empty vector.
+  //
+  // OSS-Fuzz 550998929 reaches show() without leaving the decoder: the record
+  // layout diagnostics added with SizeAndLayoutRejectUnrepresentableTypes above
+  // render the record they reject, member types and all. But any rendering of a
+  // decoded type gets there too, e.g. a type error against a peer-supplied
+  // type description (ipc/net.C feeds both sides' decoded types to the
+  // typechecker, whose errors print them).
+
+  // an application of "fileref" to no arguments, arriving as encoded bytes the
+  // way the fuzz harness and the RPC layer receive it, falls back to the
+  // generic constructor spelling instead of reading absent arguments
+  std::vector<unsigned char> noargs;
+  encode(MonoTypePtr(TApp::make(primty("fileref"), MonoTypes())), &noargs);
+  EXPECT_EQ(show(decode(noargs)), "(fileref)");
+
+  // more arguments than the spelling has slots for fall back the same way
+  // (before, the extras were silently dropped rather than shown)
+  std::vector<unsigned char> extra;
+  encode(MonoTypePtr(TApp::make(primty("fileref"), list(primty("int"), primty("long"), primty("char")))), &extra);
+  EXPECT_EQ(show(decode(extra)), "(fileref int long char)");
+
+  // the reproducer's own shape: a record whose member -- a variant carrying the
+  // no-argument application -- has an offset the layout check rejects, where
+  // the rejection message renders the record; it must throw, not crash
+  const MonoTypePtr payload(TApp::make(primty("fileref"), MonoTypes()));
+  Variant::Members vms;
+  vms.push_back(Variant::Member(".f0", payload, 0));
+
+  std::vector<unsigned char> rec;
+  auto put = [&](const void* p, size_t n) {
+    const auto* b = static_cast<const unsigned char*>(p);
+    rec.insert(rec.end(), b, b + n);
+  };
+  const int          tcode  = Record::type_case_id;
+  const size_t       nmems  = 1;
+  const size_t       namesz = 1;
+  const unsigned int offset = 2; // calculated offset is 0; mismatch is rejected
+  put(&tcode,  sizeof(tcode));
+  put(&nmems,  sizeof(nmems));
+  put(&namesz, sizeof(namesz));
+  put("a", 1);
+  put(&offset, sizeof(offset));
+  encode(MonoTypePtr(Variant::make(vms)), &rec);
+
+  bool threw = false;
+  try { decode(rec); } catch (const std::exception&) { threw = true; }
+  EXPECT_TRUE(threw);
+
+  // the spellings for one and two arguments are unchanged
+  std::vector<unsigned char> one, two;
+  encode(fileRefTy(primty("int")), &one);
+  EXPECT_EQ(show(decode(one)), "int@?");
+  encode(fileRefTy(primty("int"), tlong(42)), &two);
+  EXPECT_EQ(show(decode(two)), "int@42L");
+}
+
 TEST(TypeInf, SubstitutionTerminatesOnCyclicSubstitutions) {
   // substitution is applied to its fixed point, which only exists while no variable
   // stands for a type that mentions it -- unification maintains that, but a