Repository navigation
fix: v5→v6 migration hang on large page_count (fuzz timeout #272) - #272
Merged
Merged
Conversation
…hang When migrating a v5 file whose header.page_count is a large fuzz-crafted value (e.g. 3,604,123,350), migrate_v5_to_v6 passed that value as the start page for build_btree. build_btree then wrote a leaf at a ~14 TB offset in a sparse file, and compute_page_checksum looped over 3.6 billion zero-filled sparse pages (read_exact returns zeros on sparse regions — no error), hanging the process and triggering libFuzzer's 60-second per-execution timeout. Fix: derive next_free from the actual number of validated fact pages (1 + validated_num_fact_pages) instead of from the untrusted header field. Adds a regression test reproducing the exact fuzz artifact bytes, and adds seed_v5_large_page_count.bin to the file_header corpus so this class of input is exercised on every future fuzz run. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
The
file_headerfuzz target produced this timeout artifact:In
migrate_v5_to_v6(line 721):build_btreewrote a leaf page at offset3,604,123,350 × 4096 ≈ 14 TBin a sparse file. Thencompute_page_checksumlooped over3.6 billionpages — eachread_exactreturned zeros (sparse regions, no EOF error) — hanging the process and triggering libFuzzer's 60-second per-execution timeout.Fix
Replace the untrusted
header.page_countwith the actual end of fact data:save()already uses this pattern correctly (index_start = 1 + new_total_fact_pages); this bringsmigrate_v5_to_v6in line.Changes
migrate_v5_to_v6: use1 + validated_num_fact_pagesas B-tree startseed_v5_large_page_count.binto thefile_headercorpusTest plan
cargo test test_v5_migration_large_page_count_does_not_hangpassesfile_headertarget manually after merge to confirm no timeout🤖 Generated with Claude Code