Fuzzing Crash: VortexError in array_ops

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: fuzz/fuzz_targets/array_ops.rs:33:assert_scalar_eq

Error Message:

Other error: Scalar mismatch: expected decimal256(-9325974731449401347985743821231004394369252106531348369837707016991776552051, precision=76, scale=21), got null in step 0

Stack Trace

stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:689:5
   1: core::panicking::panic_fmt
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:80:14
   2: panic_display<vortex_error::VortexError>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:259:5
   3: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:33:19
   4: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:363:60
   5: {closure#0}
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:62:9
   6: do_call<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:581:40
   7: __rust_try
   8: catch_unwind<i32, libfuzzer_sys::test_input_wrap::{closure_env#0}>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:544:19
   9: catch_unwind<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panic.rs:359:14
  10: test_input_wrap
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:60:22
  11: _ZN6fuzzer6Fuzzer15ExecuteCallbackEPKhm
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:619:13
  12: _ZN6fuzzer10RunOneTestEPNS_6FuzzerEPKcm
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:335:6
  13: _ZN6fuzzer12FuzzerDriverEPiPPPcPFiPKhmE
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:871:9
  14: main
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerMain.cpp:20:10
  15: <unknown>
  16: __libc_start_main
  17: _start

Summary

• Target: array_ops
• Crash File: crash-5ec872c846544cdb8e7496db0f8e4fde78cb4bfd
• Branch: develop
• Commit: c91d833
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/24827813294/artifacts/6599204676

Reproduce

cargo +nightly fuzz run -D --sanitizer=none array_ops ./fuzz/artifacts/array_ops/crash-5ec872c846544cdb8e7496db0f8e4fde78cb4bfd -- -rss_limit_mb=0

Reproduction Steps

1. Download the crash artifact: https://github.com/vortex-data/vortex/actions/runs/24827813294/artifacts/6599204676

2. Assuming you download the zipfile to ~/Downloads, and your working directory is the repository root:

# Create the artifacts directory if you haven't already.
mkdir -p ./fuzz/artifacts

# Move the zipfile.
mv ~/Downloads/array_ops-crash-artifacts.zip ./fuzz/artifacts/

# Unzip the zipfile.
unzip ./fuzz/artifacts/array_ops-crash-artifacts.zip -d ./fuzz/artifacts/

# You can remove the zipfile now if you want to.
rm ./fuzz/artifacts/array_ops-crash-artifacts.zip

3. Reproduce the crash:

cargo +nightly fuzz run -D --sanitizer=none array_ops ./fuzz/artifacts/array_ops/crash-5ec872c846544cdb8e7496db0f8e4fde78cb4bfd -- -rss_limit_mb=0

If you want a backtrace:

RUST_BACKTRACE=1 cargo +nightly fuzz run -D --sanitizer=none array_ops ./fuzz/artifacts/array_ops/crash-5ec872c846544cdb8e7496db0f8e4fde78cb4bfd -- -rss_limit_mb=0

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops ./fuzz/artifacts/array_ops/crash-5ec872c846544cdb8e7496db0f8e4fde78cb4bfd -- -rss_limit_mb=0

Single command to get a backtrace

mkdir -p ./fuzz/artifacts
mv ~/Downloads/array_ops-crash-artifacts.zip ./fuzz/artifacts/
unzip ./fuzz/artifacts/array_ops-crash-artifacts.zip -d ./fuzz/artifacts/
rm ./fuzz/artifacts/array_ops-crash-artifacts.zip
RUST_BACKTRACE=1 cargo +nightly fuzz run -D --sanitizer=none array_ops ./fuzz/artifacts/array_ops/crash-5ec872c846544cdb8e7496db0f8e4fde78cb4bfd -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow

[connortsui20]

I'll be surprised if it's not this (or something related to this) again: #5820

[github-actions]

Seen 1 time

[connortsui20]

This one specifically hits the null because of an overflow somewhere (I think):

Details

Running: ./fuzz/artifacts/array_ops/crash-5ec872c846544cdb8e7496db0f8e4fde78cb4bfd
[fuzz/fuzz_targets/array_ops.rs:30:5] &fuzz_action = FuzzArrayAction {
    array: ArrayInner {
        encoding: Id("vortex.chunked"),
        dtype: Decimal(
            DecimalDType {
                precision: 76,
                scale: 21,
            },
            Nullable,
        ),
        len: 25,
        inner: ChunkedData {
            chunk_offsets: [
                0,
                13,
                25,
            ],
        },
        slots: [
            Some(
                ArrayInner {
                    encoding: Id("vortex.primitive"),
                    dtype: Primitive(
                        U64,
                        NonNullable,
                    ),
                    len: 3,
                    inner: PrimitiveData {
                        ptype: U64,
                        buffer: BufferHandle(
                            Host(
                                Buffer<u8> {
                                    length: 24,
                                    alignment: Alignment(
                                        8,
                                    ),
                                    as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 13, 0, 0, 0, 0, 0, 0, 0, ...],
                                },
                            ),
                        ),
                    },
                    slots: [
                        None,
                    ],
                },
            ),
            Some(
                ArrayInner {
                    encoding: Id("vortex.decimal"),
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 21,
                        },
                        Nullable,
                    ),
                    len: 13,
                    inner: DecimalData {
                        decimal_dtype: DecimalDType {
                            precision: 76,
                            scale: 21,
                        },
                        values: BufferHandle(
                            Host(
                                Buffer<u8> {
                                    length: 416,
                                    alignment: Alignment(
                                        16,
                                    ),
                                    as_slice: [100, 97, 97, 97, 97, 0, 2, 243, 83, 195, 105, 32, 156, 21, 7, 254, ...],
                                },
                            ),
                        ),
                        values_type: I256,
                    },
                    slots: [
                        None,
                    ],
                },
            ),
            Some(
                ArrayInner {
                    encoding: Id("vortex.decimal"),
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 21,
                        },
                        Nullable,
                    ),
                    len: 12,
                    inner: DecimalData {
                        decimal_dtype: DecimalDType {
                            precision: 76,
                            scale: 21,
                        },
                        values: BufferHandle(
                            Host(
                                Buffer<u8> {
                                    length: 384,
                                    alignment: Alignment(
                                        16,
                                    ),
                                    as_slice: [3, 0, 248, 255, 255, 255, 255, 255, 255, 143, 236, 228, 101, 118, 200, 187, ...],
                                },
                            ),
                        ),
                        values_type: I256,
                    },
                    slots: [
                        Some(
                            ArrayInner {
                                encoding: Id("vortex.bool"),
                                dtype: Bool(
                                    NonNullable,
                                ),
                                len: 12,
                                inner: BoolData {
                                    bits: BufferHandle(
                                        Host(
                                            Buffer<u8> {
                                                length: 2,
                                                alignment: Alignment(
                                                    1,
                                                ),
                                                as_slice: [223, 7],
                                            },
                                        ),
                                    ),
                                    offset: 0,
                                },
                                slots: [
                                    None,
                                ],
                            },
                        ),
                    ],
                },
            ),
        ],
    },
    actions: [
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 21,
                        },
                        Nullable,
                    ),
                    value: Some(
                        Decimal(
                            I256(
                                i256(
                                    -9325974731449401347985743821231004394369252106531348369837707016991776552051,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
    ],
}

thread '<unnamed>' (32031) panicked at fuzz/fuzz_targets/array_ops.rs:34:19:
Other error: Scalar mismatch: expected decimal256(-9325974731449401347985743821231004394369252106531348369837707016991776552051, precision=76, scale=21), got null in step 0
Backtrace:
   0: vortex_fuzz::array::assert_scalar_eq
             at ./fuzz/src/array/mod.rs:764:13
   1: vortex_fuzz::array::run_fuzz_action
             at ./fuzz/src/array/mod.rs:655:17
   2: array_ops::_::__libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:31:11
   3: rust_fuzzer_test_input
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:363:60
   4: libfuzzer_sys::test_input_wrap::{closure#0}
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:62:9
   5: std::panicking::catch_unwind::do_call::<libfuzzer_sys::test_input_wrap::{closure#0}, i32>
             at /rustc/7c61a357e3c91b8a3c02dc63b7744d942d572a9a/library/std/src/panicking.rs:581:40
   6: __rust_try
   7: std::panicking::catch_unwind::<i32, libfuzzer_sys::test_input_wrap::{closure#0}>
             at /rustc/7c61a357e3c91b8a3c02dc63b7744d942d572a9a/library/std/src/panicking.rs:544:19
   8: std::panic::catch_unwind::<libfuzzer_sys::test_input_wrap::{closure#0}, i32>
             at /rustc/7c61a357e3c91b8a3c02dc63b7744d942d572a9a/library/std/src/panic.rs:359:14
   9: LLVMFuzzerTestOneInput
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:60:22
  10: _ZN6fuzzer6Fuzzer15ExecuteCallbackEPKhm
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:619:15
  11: _ZN6fuzzer10RunOneTestEPNS_6FuzzerEPKcm
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:335:21
  12: _ZN6fuzzer12FuzzerDriverEPiPPPcPFiPKhmE
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:871:19
  13: main
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerMain.cpp:20:30
  14: <unknown>
  15: __libc_start_main
  16: _start

Backtrace:
   0: array_ops::_::__libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:34:19
   1: rust_fuzzer_test_input
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:363:60
   2: libfuzzer_sys::test_input_wrap::{closure#0}
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:62:9
   3: std::panicking::catch_unwind::do_call::<libfuzzer_sys::test_input_wrap::{closure#0}, i32>
             at /rustc/7c61a357e3c91b8a3c02dc63b7744d942d572a9a/library/std/src/panicking.rs:581:40
   4: __rust_try
   5: std::panicking::catch_unwind::<i32, libfuzzer_sys::test_input_wrap::{closure#0}>
             at /rustc/7c61a357e3c91b8a3c02dc63b7744d942d572a9a/library/std/src/panicking.rs:544:19
   6: std::panic::catch_unwind::<libfuzzer_sys::test_input_wrap::{closure#0}, i32>
             at /rustc/7c61a357e3c91b8a3c02dc63b7744d942d572a9a/library/std/src/panic.rs:359:14
   7: LLVMFuzzerTestOneInput
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:60:22
   8: _ZN6fuzzer6Fuzzer15ExecuteCallbackEPKhm
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:619:15
   9: _ZN6fuzzer10RunOneTestEPNS_6FuzzerEPKcm
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:335:21
  10: _ZN6fuzzer12FuzzerDriverEPiPPPcPFiPKhmE
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:871:19
  11: main
             at /home/connor/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerMain.cpp:20:30
  12: <unknown>
  13: __libc_start_main
  14: _start