Merge pull request arximboldi#152 from arximboldi/oss-fuzz-bugs

Fix crash 5078027885871104
chuim · Jul 28, 2020 · c143f6d · c143f6d
2 parents ce38787 + 7b2e1db
commit c143f6d
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 2 deletions.
diff --git a/immer/detail/rbts/operations.hpp b/immer/detail/rbts/operations.hpp
@@ -1751,9 +1751,9 @@ struct concat_rebalance_plan
         const auto branches             = count_t{1} << bits;
         const auto optimal              = ((total - 1) >> bits) + 1;
         count_t i                       = 0;
-        while (n > optimal + rrb_extras) {
+        while (n >= optimal + rrb_extras) {
             // skip ok nodes
-            while (counts[i] >= branches - rrb_invariant)
+            while (counts[i] > branches - rrb_invariant)
                 i++;
             assert(i < n);
             // short node, redistribute

diff --git a/test/oss-fuzz/data/clusterfuzz-testcase-minimized-flex-vector-5078027885871104.fuzz b/test/oss-fuzz/data/clusterfuzz-testcase-minimized-flex-vector-5078027885871104.fuzz
diff --git a/test/oss-fuzz/flex-vector-0.cpp b/test/oss-fuzz/flex-vector-0.cpp
@@ -258,3 +258,14 @@ TEST_CASE("https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24147")
         CHECK(run_input(input.data(), input.size()) == 0);
     }
 }
+
+TEST_CASE("https://oss-fuzz.com/testcase-detail/5078027885871104")
+{
+    SECTION("fuzzer")
+    {
+        return;
+        auto input = load_input(
+            "clusterfuzz-testcase-minimized-flex-vector-5078027885871104.fuzz");
+        CHECK(run_input(input.data(), input.size()) == 0);
+    }
+}