Skip to content

Fix issues in math implementation #883

Open
elichai wants to merge 6 commits intokaspanet:masterfrom
elichai:elichai/fix-bugs
Open

Fix issues in math implementation #883
elichai wants to merge 6 commits intokaspanet:masterfrom
elichai:elichai/fix-bugs

Conversation

@elichai
Copy link
Member

@elichai elichai commented Feb 23, 2026

None of these issues should affect consensus

  1. Incorrect overflow bit in Uint implementation (We don't use the overflowing_* variants, and the Mul trait impl ignores the overflow bit in release mode (it uses a debug_assert) so nothing should really be affected).
  2. Incorrect .size_hint() iterator impl for the iterator returned at .iter_be_bits() when combined with the overriden .nth() function.
  3. Incorrect as_f64 when used on Uint3072 on values above ~2^1024 (before it could return garbage values, now it will always return Inf in those cases)

First commit just makes the construct_macro work in the fuzzing infra again.

Second commit improves the tests and fuzzing to catch these errors:

Test Failures
failures:

---- tests::as_f64_u3072_saturates_to_positive_infinity stdout ----

thread 'tests::as_f64_u3072_saturates_to_positive_infinity' (15627144) panicked at math/src/lib.rs:205:9:
assertion `left == right` failed
  left: -inf
 right: inf
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

---- uint::tests::test_mul_overflow stdout ----

thread 'uint::tests::test_mul_overflow' (15627149) panicked at math/src/uint.rs:1207:9:
assertion `left == right` failed
  left: true
 right: false

---- uint::tests::test_iter_be_bits stdout ----

thread 'uint::tests::test_iter_be_bits' (15627147) panicked at math/src/uint.rs:1045:5:
attempt to subtract with overflow


failures:
    tests::as_f64_u3072_saturates_to_positive_infinity
    uint::tests::test_iter_be_bits
    uint::tests::test_mul_overflow

test result: FAILED. 7 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.52s
Fuzzing Failures
thread '<unnamed>' (15631338) panicked at fuzz_targets/u128.rs:73:5:
assertion `left == right` failed: native: 654229641859875823987855318113583104, native2: 254422585063317791287472979454197760
  left: false
 right: true
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
==87225== ERROR: libFuzzer: deadly signal
    #0 0x0001016c32f4 in __sanitizer_print_stack_trace+0x28 (librustc-nightly_rt.asan.dylib:arm64+0x872f4)
    #1 0x0001009e5860 in fuzzer::PrintStackTrace()+0x30 (u128:arm64+0x100571860)
    #2 0x0001009d9a6c in fuzzer::Fuzzer::CrashCallback()+0x54 (u128:arm64+0x100565a6c)
    #3 0x0001882f1760 in _sigtramp+0x34 (libsystem_platform.dylib:arm64e+0x3760)
    #4 0x0001882e7884 in pthread_kill+0x124 (libsystem_pthread.dylib:arm64e+0x6884)
    #5 0x0001881ec84c in abort+0x78 (libsystem_c.dylib:arm64e+0x7984c)
    #6 0x000100a3fca4 in _RNvNtNtNtCsdstvSoFip2a_3std3sys3pal4unix14abort_internal mod.rs:305
    #7 0x000100a3c724 in _RNvNtCsdstvSoFip2a_3std7process5abort process.rs:2533
    #8 0x000100a12b34 in _RNCNvCs1acPNacv4I9_13libfuzzer_sys10initialize0B3_ lib.rs:94
    #9 0x00010092f8d4 in _RNvXsv_NtCs7ZSLYPp39HD_5alloc5boxedINtB5_3BoxDG0_INtNtNtCsdMl2AJbG7IL_4core3ops8function2FnTRL1_INtNtCsdstvSoFip2a_3std5panic13PanicHookInfoL0_EEEp6OutputuNtNtBS_6marker4SyncNtB2v_4SendEL_EIBM_TRB1x_EE4callB1B_ boxed.rs:2264
    #10 0x00010092f8d4 in _RNvNtCsdstvSoFip2a_3std9panicking15panic_with_hook panicking.rs:833
    #11 0x00010094e960 in _RNCNvNtCsdstvSoFip2a_3std9panicking13panic_handler0B5_ panicking.rs:698
    #12 0x00010094e91c in _RINvNtNtCsdstvSoFip2a_3std3sys9backtrace26___rust_end_short_backtraceNCNvNtB6_9panicking13panic_handler0zEB6_ backtrace.rs:182
    #13 0x00010094efa4 in _RNvCscPXrf1V1aal_7___rustc17rust_begin_unwind panicking.rs:689
    #14 0x000100a0d17c in _RNvNtCsdMl2AJbG7IL_4core9panicking9panic_fmt panicking.rs:80
    #15 0x000100a0d154 in _RNvNtCsdMl2AJbG7IL_4core9panicking19assert_failed_inner panicking.rs
    #16 0x000100a4b9b8 in _RINvNtCsdMl2AJbG7IL_4core9panicking13assert_failedbbECs5gxNaq7wCLv_5tokio panicking.rs:394
    #17 0x000100479e14 in assert_op_with_overflow<fn(u128::Uint128, u128::Uint128) -> (u128::Uint128, bool), fn(u128, u128) -> (u128, bool)> u128.rs:58
    #18 0x000100479e14 in _RNvNvCs6kb0rnmNY2n_4u1281__19___libfuzzer_sys_run u128.rs:73
    #19 0x000100480620 in rust_fuzzer_test_input lib.rs:276
    #20 0x000100519918 in {closure#0} lib.rs:62
    #21 0x000100519918 in _RINvNvNtCsdstvSoFip2a_3std9panicking12catch_unwind7do_callNCNvCs1acPNacv4I9_13libfuzzer_sys15test_input_wrap0lEBY_ panicking.rs:581
    #22 0x000100519844 in __rust_try.7824+0x18 (u128:arm64+0x1000a5844)
    #23 0x00010051adc4 in catch_unwind<i32, libfuzzer_sys::test_input_wrap::{closure_env#0}> panicking.rs:544
    #24 0x00010051adc4 in catch_unwind<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32> panic.rs:359
    #25 0x00010051adc4 in LLVMFuzzerTestOneInput lib.rs:60
    #26 0x0001009db314 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long)+0x150 (u128:arm64+0x100567314)
    #27 0x0001009da9c0 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*)+0x48 (u128:arm64+0x1005669c0)
    #28 0x0001009dcb5c in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__1::vector<fuzzer::SizedFile, std::__1::allocator<fuzzer::SizedFile>>&)+0x818 (u128:arm64+0x100568b5c)
    #29 0x0001009dccf4 in fuzzer::Fuzzer::Loop(std::__1::vector<fuzzer::SizedFile, std::__1::allocator<fuzzer::SizedFile>>&)+0x88 (u128:arm64+0x100568cf4)
    #30 0x0001009fb8d4 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long))+0x1abc (u128:arm64+0x1005878d4)
    #31 0x000100a08338 in main+0x24 (u128:arm6

The rest of the commits fix those issues

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant