Panic: Arithmetic Overflow in macros.rs
## Description
Hello, I discovered a panic in `pulldown-latex` while fuzzing.
The parser panics with "attempt to subtract with overflow" when processing a specific input. I attach the crashing input as a PoC file (`poc.bin`) to the issue.
## Crash Location
- `src/parser/macros.rs:61:64`
- Message: `attempt to subtract with overflow`
## Reproduction Code
```rust
use std::{env, fs};
use pulldown_latex::{mathml::push_mathml, Parser, Storage};
fn main() {
let path = env::args().nth(1).unwrap_or_else(|| {
eprintln!("usage: poc <path-to-poc-input>");
std::process::exit(2);
});
let data = fs::read(&path).unwrap_or_else(|e| {
eprintln!("failed to read {}: {}", path, e);
std::process::exit(2);
});
// PoC input is arbitrary bytes; convert lossily to a string.
let input = String::from_utf8_lossy(&data);
let storage = Storage::new();
let parser = Parser::new(&input, &storage);
let mut out = String::new();
let config = Default::default();
match push_mathml(&mut out, parser, config) {
Ok(()) => println!("OK (output_len={})", out.len()),
Err(e) => {
eprintln!("Error: {}", e);
std::process::exit(1);
}
}
}
```
[poc.zip](https://github.com/user-attachments/files/24142386/poc.zip)
## Stack Trace
```text
thread '<unnamed>' (2007804) panicked at /home/zx/pulldown-latex/src/parser/macros.rs:61:64:
attempt to subtract with overflow
stack backtrace:
0: __rustc::rust_begin_unwind
at /rustc/1aa9bab4ecbce4859eaad53000f78158ebe2be2c/library/std/src/panicking.rs:689:5
1: core::panicking::panic_fmt
at /rustc/1aa9bab4ecbce4859eaad53000f78158ebe2be2c/library/core/src/panicking.rs:80:14
2: core::panicking::panic_const::panic_const_sub_overflow
at /rustc/1aa9bab4ecbce4859eaad53000f78158ebe2be2c/library/core/src/panicking.rs:175:17
3: {closure#0}
at /home/zx/pulldown-latex/src/parser/macros.rs:61:64
4: and_then<char, u8, pulldown_latex::parser::macros::{impl#0}::define::{closure#0}::{closure_env#0}>
at /rustc/1aa9bab4ecbce4859eaad53000f78158ebe2be2c/library/core/src/option.rs:1546:24
5: {closure#0}
at /home/zx/pulldown-latex/src/parser/macros.rs:61:22
```
1 条评论