ITADN

Panic: Arithmetic Overflow in macros.rs

#44OpenYomihay-qut 创建于 2025-12-13
Y
Yomihay-qutcommented
## Description Hello, I discovered a panic in `pulldown-latex` while fuzzing. The parser panics with "attempt to subtract with overflow" when processing a specific input. I attach the crashing input as a PoC file (`poc.bin`) to the issue. ## Crash Location - `src/parser/macros.rs:61:64` - Message: `attempt to subtract with overflow` ## Reproduction Code ```rust use std::{env, fs}; use pulldown_latex::{mathml::push_mathml, Parser, Storage}; fn main() { let path = env::args().nth(1).unwrap_or_else(|| { eprintln!("usage: poc <path-to-poc-input>"); std::process::exit(2); }); let data = fs::read(&path).unwrap_or_else(|e| { eprintln!("failed to read {}: {}", path, e); std::process::exit(2); }); // PoC input is arbitrary bytes; convert lossily to a string. let input = String::from_utf8_lossy(&data); let storage = Storage::new(); let parser = Parser::new(&input, &storage); let mut out = String::new(); let config = Default::default(); match push_mathml(&mut out, parser, config) { Ok(()) => println!("OK (output_len={})", out.len()), Err(e) => { eprintln!("Error: {}", e); std::process::exit(1); } } } ``` [poc.zip](https://github.com/user-attachments/files/24142386/poc.zip) ## Stack Trace ```text thread '<unnamed>' (2007804) panicked at /home/zx/pulldown-latex/src/parser/macros.rs:61:64: attempt to subtract with overflow stack backtrace: 0: __rustc::rust_begin_unwind at /rustc/1aa9bab4ecbce4859eaad53000f78158ebe2be2c/library/std/src/panicking.rs:689:5 1: core::panicking::panic_fmt at /rustc/1aa9bab4ecbce4859eaad53000f78158ebe2be2c/library/core/src/panicking.rs:80:14 2: core::panicking::panic_const::panic_const_sub_overflow at /rustc/1aa9bab4ecbce4859eaad53000f78158ebe2be2c/library/core/src/panicking.rs:175:17 3: {closure#0} at /home/zx/pulldown-latex/src/parser/macros.rs:61:64 4: and_then<char, u8, pulldown_latex::parser::macros::{impl#0}::define::{closure#0}::{closure_env#0}> at /rustc/1aa9bab4ecbce4859eaad53000f78158ebe2be2c/library/core/src/option.rs:1546:24 5: {closure#0} at /home/zx/pulldown-latex/src/parser/macros.rs:61:22 ```
1 条评论