fix(vm): Guard builtins against non-heap args, oversized allocations and fuzz.yml script initialization.

Author: dylan-sutton-chavez

.github/workflows/fuzzer.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Seeds and instrumented build
         working-directory: compiler/fuzz-afl
         run: |
-          ./seeds.sh
+          bash ./seeds.sh
           cargo afl build
 
       - name: Fuzz on all cores

compiler/src/modules/vm/builtins/bytes_helpers.rs

@@ -35,12 +35,12 @@ impl<'a> VM<'a> {
     pub fn call_int_from_bytes(&mut self) -> Result<(), VmErr> {
         let order = self.pop()?;
         let v = self.pop()?;
-        let buf = match self.heap.get(v) {
-            HeapObj::Bytes(b) => b.clone(),
+        let buf = match self.heap.try_get(v) {
+            Some(HeapObj::Bytes(b)) => b.clone(),
             _ => return Err(cold_type("int_from_bytes() first arg must be bytes")),
         };
-        let order_s = match self.heap.get(order) {
-            HeapObj::Str(s) => s.clone(),
+        let order_s = match self.heap.try_get(order) {
+            Some(HeapObj::Str(s)) => s.clone(),
             _ => return Err(cold_type("int_from_bytes() byteorder must be 'big' or 'little'")),
         };
         if buf.len() > 8 { return Err(cold_overflow()); }
@@ -71,8 +71,8 @@ impl<'a> VM<'a> {
         let length = length.as_int() as usize;
         if length > 8 { return Err(cold_value("int_to_bytes() length must be <= 8")); }
         if n_i128 < 0 { return Err(cold_value("int_to_bytes() requires a non-negative int")); }
-        let order_s = match self.heap.get(order) {
-            HeapObj::Str(s) => s.clone(),
+        let order_s = match self.heap.try_get(order) {
+            Some(HeapObj::Str(s)) => s.clone(),
             _ => return Err(cold_type("int_to_bytes() byteorder must be 'big' or 'little'")),
         };
         let big = match order_s.as_str() {

compiler/src/modules/vm/builtins/container.rs

@@ -149,6 +149,8 @@ impl<'a> VM<'a> {
                 if a.is_int() {
                     let n = a.as_int();
                     if n < 0 { return Err(cold_value("negative count")); }
+                    // Length is user-controlled; cap it against the heap budget so a huge count errors instead of aborting in the allocator.
+                    if n as usize > self.heap.limit() { return Err(cold_heap()); }
                     alloc::vec![0u8; n as usize]
                 } else if a.is_heap() {
                     if let HeapObj::Bytes(b) = self.heap.get(a) {

compiler/src/modules/vm/handlers/builtin_methods/prelude.rs

@@ -8,5 +8,5 @@ pub(super) use super::super::methods_helpers::{
     list_clone, list_mut, dict_entries, dict_mut, set_clone, set_mut,
     iter_to_vec, capitalize_first, title_case,
 };
-pub(super) use crate::modules::vm::types::{cold_type, cold_value, eq_vals_with_heap};
+pub(super) use crate::modules::vm::types::{cold_type, cold_value, cold_heap, eq_vals_with_heap};
 pub(super) use alloc::{string::{String, ToString}, vec, vec::Vec};

compiler/src/modules/vm/handlers/builtin_methods/string.rs

@@ -236,6 +236,8 @@ pub fn center(vm: &mut VM, recv: Val, pos: &[Val]) -> Result<(), VmErr> {
     let s = recv_str(vm, recv)?;
     if !pos[0].is_int() { return Err(cold_type("center() width must be an integer")); }
     let width = pos[0].as_int().max(0) as usize;
+    // User-controlled width drives the output size; cap it so a huge value errors instead of aborting in the allocator.
+    if width > vm.heap.limit() { return Err(cold_heap()); }
     let fill = if pos.len() > 1 {
         val_to_str(vm, pos[1])?.chars().next().unwrap_or(' ')
     } else { ' ' };
@@ -252,6 +254,8 @@ pub fn zfill(vm: &mut VM, recv: Val, pos: &[Val]) -> Result<(), VmErr> {
     if !pos[0].is_int() { return Err(cold_type("zfill() requires an integer argument")); }
     let s = recv_str(vm, recv)?;
     let width = pos[0].as_int().max(0) as usize;
+    // User-controlled width drives the output size; cap it so a huge value errors instead of aborting in the allocator.
+    if width > vm.heap.limit() { return Err(cold_heap()); }
     let nchars = s.chars().count();
     let out = if nchars >= width {
         s

compiler/tests/cases/vm.json

@@ -600,6 +600,8 @@
   {"src": "print(int_to_bytes(258, 2, 'big'))", "output": ["b'\\x01\\x02'"]},
   {"src": "print(int_to_bytes(513, 2, 'little'))", "output": ["b'\\x01\\x02'"]},
   {"src": "n = 0xCAFEBABE\nprint(int_from_bytes(int_to_bytes(n, 4, 'big'), 'big'))", "output": ["3405691582"]},
+  {"src": "print(int_from_bytes(5, 'big'))", "output": [], "error": "int_from_bytes() first arg must be bytes"},
+  {"src": "print(int_to_bytes(508, 4, -1))", "output": [], "error": "int_to_bytes() byteorder must be 'big' or 'little'"},
   {"src": "print(frozenset())", "output": ["frozenset()"]},
   {"src": "print(sorted(frozenset([1,2,3,2,1])))", "output": ["[1, 2, 3]"]},
   {"src": "fs = frozenset([1,2,3])\nprint(2 in fs)\nprint(5 in fs)", "output": ["True", "False"]},
@@ -1803,6 +1805,9 @@
   {"src": "print('a' * 20000000)", "output": [], "error": "MemoryError"},
   {"src": "print([0] * 20000000)", "output": [], "error": "MemoryError"},
   {"src": "print(list(range(20000000)))", "output": [], "error": "MemoryError"},
+  {"src": "print(bytes(999999999995))", "output": [], "error": "MemoryError"},
+  {"src": "print('a'.center(999999999995))", "output": [], "error": "MemoryError"},
+  {"src": "print('a'.zfill(999999999995))", "output": [], "error": "MemoryError"},
   {"src": "print(format(5, '20000001d'))", "output": [], "error": "format width exceeds limit"},
   {"src": "print(format(5, '.20000001f'))", "output": [], "error": "format precision exceeds limit"},
   {"src": "def f():\n    sleep(0)\n    return f()\nprint(f())", "output": [], "error": "RecursionError"},