Skip to content

automata: Fix crash in dense::DFA::from_bytes validation logic#1295

Closed
Mrmaxmeier wants to merge 2 commits intorust-lang:masterfrom
Mrmaxmeier:fix-dense-dfa-from-bytes-crash
Closed

automata: Fix crash in dense::DFA::from_bytes validation logic#1295
Mrmaxmeier wants to merge 2 commits intorust-lang:masterfrom
Mrmaxmeier:fix-dense-dfa-from-bytes-crash

Conversation

@Mrmaxmeier
Copy link
Copy Markdown
Contributor

@Mrmaxmeier Mrmaxmeier commented Sep 15, 2025

Hi,

this PR fixes a panic in the dense::DFA::from_bytes API. The validation step after loading a corrupted DFA currently panics in TransitionTable::validate due to an invalid MatchState. This PR fixes this by validating the MatchState first.

#[test]
fn regression_validation_order() {
    let mut dfa = DFA::new("abc").unwrap();
    dfa.ms = MatchStates {
        slices: vec![],
        pattern_ids: vec![],
        pattern_len: 1,
    };
    let (buf, _) = dfa.to_bytes_native_endian();
    DFA::from_bytes(&buf).unwrap_err();
}
thread 'dfa::dense::tests::regression_validation_order' (365737) panicked at regex-automata/src/dfa/dense.rs:4644:9:
index out of bounds: the len is 0 but the index is 1
stack backtrace:
   [...]
   3: regex_automata::dfa::dense::MatchStates<T>::pattern_len
             at ./src/dfa/dense.rs:4644:9
   4: regex_automata::dfa::dense::DFA<T>::match_pattern_len
             at ./src/dfa/dense.rs:3006:17
   5: <regex_automata::dfa::dense::DFA<T> as regex_automata::dfa::automaton::Automaton>::match_len
             at ./src/dfa/dense.rs:3220:14
   6: regex_automata::dfa::dense::TransitionTable<T>::validate
             at ./src/dfa/dense.rs:3629:28
   7: regex_automata::dfa::dense::DFA<&[u32]>::from_bytes
             at ./src/dfa/dense.rs:2343:16
   8: regex_automata::dfa::dense::tests::regression_validation_order
             at ./src/dfa/dense.rs:5244:9

I'm assuming that people are not using serialized automata with untrusted inputs, so I hope just opening a PR is fine 🙂

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant