index out of range in vm.go:342

[swirsz]

Bug discovered while running libFuzzer:

Running: crash-f81.txt
data len 31, offset is 27, input starts at 30
panic in thread &vm.thread{pc:5, matched:false, matches:map[int][]string{0:[]string(nil)}, time:time.Time{wall:0x0, ext:0, loc:(*time.Location)(nil)}, stack:[]interface {}{}} at instr "{neg 2}": runtime error: index out of range [-1]
panic: runtime error: index out of range [-1] [recovered]
panic: runtime error: index out of range [-1]

goroutine 17 [running, locked to thread]:
github.com/google/mtail/internal/runtime/vm.(*VM).execute.func1()
github.com/google/mtail/internal/runtime/vm/vm.go:342 +0x2b4
panic({0xa79b40, 0xc000146000})
runtime/panic.go:1047 +0x266
github.com/google/mtail/internal/runtime/vm.(*thread).Pop(...)
github.com/google/mtail/internal/runtime/vm/vm.go:91
github.com/google/mtail/internal/runtime/vm.(*thread).PopInt(0xa38fa0)
github.com/google/mtail/internal/runtime/vm/vm.go:132 +0x407
github.com/google/mtail/internal/runtime/vm.(*VM).execute(0xc000142000, 0xc0001123c0, {0x1, {0x0, 0x0}, 0x28})
github.com/google/mtail/internal/runtime/vm/vm.go:721 +0x4306
github.com/google/mtail/internal/runtime/vm.(*VM).ProcessLogLine(0xc000142000, {0x94c234, 0x0}, 0xc00012bad0)
github.com/google/mtail/internal/runtime/vm/vm.go:982 +0x2f3
github.com/google/mtail/internal/runtime.Fuzz({0x17e8fd0, 0x1b, 0x1b})
github.com/google/mtail/internal/runtime/fuzz.go:57 +0x69a
main.LLVMFuzzerTestOneInput(...)
github.com/google/mtail/internal/runtime/main.853133030.go:21
==3759516== ERROR: libFuzzer: deadly signal
#0 0x4b2104 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/ubsan/ubsan_diag_standalone.cpp:31:3
#1 0x457268 in fuzzer::PrintStackTrace() cxa_noexception.cpp
#2 0x43c1e3 in fuzzer::Fuzzer::CrashCallback() cxa_noexception.cpp
#3 0x7f92db2e53bf (/lib/x86_64-linux-gnu/libpthread.so.0+0x153bf)
#4 0x519680 in runtime.raise.abi0 runtime/sys_linux_amd64.s:164

NOTE: libFuzzer has rudimentary signal handlers.
Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal

crash-f81.txt

[jaqx0r]

Yeah I'm aware of this failure and it's tricky to fix without a lot of reengineering of the compiler with better type inference. I have some identical bugs stored in the OSS-Fuzz project tracking this.