🏆 Trophy Case 🏆

A showcase of bugs found via fuzz testing Rust codebases. It serves multiple purposes:

• Help the community see what issues are common in Rust codebases (useful when e.g. designing APIs)
• Increase visibility of effective fuzz testing targets so people can reuse testing strategies
• Provide insight into common issues they can expect to find if they use a certain fuzzer

These bugs aren't nearly as serious as the memory-safety issues afl has discovered in C and C++ projects. That's because Rust is memory-safe by default! Have you fuzzed Rust code and found a bug? Please consider adding it to this table via a pull request!

Security issues are marked with a ❗️ in the "Security?" column. Denial of service, including panics and out-of-memory, are not considered security issues.

Crate	Information	Fuzzer	Category	Security?
alloy-json-abi	Stack Overflow in JsonAbi::parse	libfuzzer	so
artichoke	infinite loop in bison-generated C code	libfuzzer	loop
asn1	#32	afl	oom
async-h1	non-ASCII input to method	libfuzzer	panic
bcrypt	indexing on non-utf8 boundry	libfuzzer	utf-8
bincode	invalid system time panic	libfuzzer	panic
bincode	invalid duration panic	libfuzzer	panic
bmfont	panic on unwrapping	libfuzzer	panic
boa	invalid spans	honggfuzz	logic
boa	Could not convert to BigInt	honggfuzz	logic
boa	invalid utf16	honggfuzz	logic
boa	assignment to number	honggfuzz	logic
boa	division by zero	honggfuzz	arith
boa	assertion failure	libfuzzer	panic
brotli-rs	#10	afl	panic
brotli-rs	#11	afl	panic
brotli-rs	#12	afl	panic
brotli-rs	#2	afl	panic
brotli-rs	#3	afl	panic
brotli-rs	#4	afl	panic
brotli-rs	#5	afl	oor
brotli-rs	#6	afl	arith
brotli-rs	#7	afl	oor
brotli-rs	#8	afl	arith
brotli-rs	#9	afl	arith
bson	#116	libfuzzer	oom
bson	multiple bugs, including arithmetic overflow	libfuzzer	arith, other, unwrap
bson	arithmetic overflow leading to out of memory	libfuzzer	arith, oom
capnproto-rust	Multiple bugs, including a memory safety bug	libfuzzer		❗️
capnproto-rust	reddit, e72746c	libfuzzer	logic
capnproto-rust	Out-of-bounds read	libfuzzer	oor	❗️
chrono	overflow in date arithmetic	libfuzzer	arith
chrono	panic in checked_add_days	libfuzzer + bolero	panic
clap	issue/2264	afl	utf-8
claxon	0fd8815	libfuzzer	unwrap
claxon	21b1db4	libfuzzer	oor
claxon	875c3b2	libfuzzer	logic
claxon	c036944	libfuzzer	logic
claxon	Massive slowdown on malformed input	libfuzzer	other
claxon	Memory disclosure on malformed input	afl + libdiffuzz	uninit	❗️
comrak	#65	libfuzzer	oor
cookie	indexing on non-utf8 boundry	libfuzzer	utf-8
cpp_demangle	Multiple panics	afl	unwrap, arith
cranelift	#418	libfuzzer	logic
csscolorparser	indexing on non-utf8 boundry	libfuzzer	utf-8
cssparser	floating-point parsing imprecision	libfuzzer	logic
cursive	grapheme boundary correctness	libfuzzer	utf-8
deflate-rs	#40	afl	logic
deflate-rs	#42	afl	logic
der	arithmetic overflow leading to index out of bounds	libfuzzer	arith
der-parser	arithmetic overflow	libfuzzer	arith
dhcp4r	#6	libfuzzer	oor
encoding_rs	#44	afl	logic
exmex	#8	honggfuzz	arith, logic
exmex	#13	libfuzzer	utf-8
fatfs	arithmetic overflow	libfuzzer	arith
flac	#3	afl	oom
flac	index out of bounds	libfuzzer	oor
flatgeobuf	#85	libfuzzer	oom
flatgeobuf	#86	libfuzzer	oor
flif	#26	libfuzzer	oom
fontdue	arithmetic overflow	libfuzzer	arith
fontdue	slow parsing	libfuzzer	other
geo	#531	libfuzzer	logic
geo	#536	libfuzzer	logic
goblin	memory exhaustion	afl	oom
goblin	memory exhaustion	libfuzzer	oom
h2	#260	honggfuzz	oor
h2	#261	honggfuzz	panic
h2	#262	honggfuzz	panic
h2	assertion failure	libfuzzer	panic
handlebars	index out of bounds	libfuzzer	oor
handlebars	unwrap panic	libfuzzer	unwrap
hjson-rust	invalid utf8	libfuzzer	utf-8
hjson-rust	subtract with overflow	libfuzzer	arith
hjson-rust	removal index (is 0) should be < len	libfuzzer	logic
hjson-rust	panics on ParseIntError	libfuzzer	arith
httparse	#9	afl	arith
httpdate	accepted dates like "May 35"	libfuzzer	logic, arith
httpdate	panic on "no character boundary"	libfuzzer	utf-8
human-name	several panics	libfuzzer	logic, arith
hyper	arithmetic overflow	libfuzzer	arith
image	#1238	afl	oor
image	#414	afl	logic
image	#473	afl	arith
image	#474	afl	unwrap
image	#477	afl	oor
image	#622	libfuzzer	oom
image	#623	libfuzzer	oom
image	#624	libfuzzer	oom
image	#625	libfuzzer	oor
image	#876	afl	oor
image	#877	afl	arith
image	#878	afl	oor
image	Failed to break on an EOF	afl	oor
image	arithmetic overflow	libfuzzer	arith
image-gif	infinite loop	libfuzzer	loop
inflate	arithmetic overflow	libfuzzer	arith
ipfix	index out of bounds	libfuzzer	oor
jpeg-decoder	#38	afl	unwrap
jpeg-decoder	#50	afl	oom
jpeg-decoder	arithmetic overflow	libfuzzer	arith
jpeg-decoder	180	libfuzzer	logic
jpeg-decoder	arithmetic overflow	libfuzzer	arith
json-rust	arithmetic overflow	afl	arith
json-rust	issue/193	afl	panic
jsonschema	issue/253	libfuzzer	oor
juniper	panic on "no character boundary"	libfuzzer	utf-8
just	#363	libfuzzer	logic
kalker	index out of bounds	libfuzzer	oor
lewton	enormous CPU and memory consumption on crafted input	afl	other
lewton	index out of bounds	honggfuzz	oor
lewton	index out of bounds	afl	oor
lewton	index out of bounds	afl	oor
lewton	index out of bounds	afl	oor
lewton	infinite loop	afl	loop
lewton	large CPU and memory consumption on crafted input	afl	other
lewton	memory exhaustion due to integer underflow	afl	arith, oom
lewton	memory exhaustion	afl	oom
lexical	arithmetic overflow	libfuzzer	arith
lexical	arithmetic overflow	libfuzzer	arith
lexical	Out-of-bounds read in unsafe code	libfuzzer	oor
libflate	258cf44	honggfuzz	oor
libflate	6157daa	honggfuzz	panic
libflate	dc77163	honggfuzz	unwrap
libflate	Out-of-bounds read in unsafe code	afl	oor
libflate	internal assertion failure	libfuzzer	panic
libpnet	arithmetic overflow	libfuzzer	arith
libstd	overflow in range bounds calculation on Vec::drain	rutenspitz	arith
lodepng-rust	memory leak	libfuzzer	oom
lopdf	arithmetic overflow	libfuzzer	arith
lz-fear	index out of bounds	libfuzzer	oor
lz-fear	index out of bounds	libfuzzer	oor
lz-fear	memory exhaustion	libfuzzer	oom
lz4_flex	memcpy-param-overlap	libfuzzer	other
lz4_flex	heap-buffer-overflow	libfuzzer	oor	❗️
lzma-rs	behavior mismatch with reference implementation	libfuzzer	logic
matchit	invalid utf-8	libfuzzer	utf-8
minidump	#7	libfuzzer	panic
minidump	unbounded allocation	libfuzzer	oom
minidump	slicing out of bounds	libfuzzer	oor
minidump	creating backwards ranges	libfuzzer	panic
minidump	add with overflow #413	libfuzzer	arith
minidump	add with overflow #422	libfuzzer	arith
minidump	add with overflow #425	libfuzzer	arith
minidump	infinitely extending vec OOM	libfuzzer	oom
minidump	subtract with overflow #439	libfuzzer	arith
minidump	index OOB	libfuzzer	oor
miniz_oxide	Infinite loop exhausting memory	libfuzzer	loop, oom
miniz_oxide	Infinite loop	libfuzzer	loop
Molten	#41	libfuzzer	utf-8
Molten	#42	libfuzzer	oor
mongo_driver	#55	libfuzzer	unwrap
mp3-metadata	Multiple panics	afl	oor
mp4ameta	unbounded allocation	libfuzzer	oom
mp4parse-rust	#2	afl	panic
mp4parse-rust	#4	afl	panic
mp4parse-rust	#5	afl	panic
mp4parse-rust	#6	afl	panic
msgpack-rust	#151	afl	oom
naga	slicing not on a character boundary	libfuzzer	utf-8
ncurses-rs	string with \0	libfuzzer	unwrap
nifti	out of bounds array slicing	libfuzzer	oor
nom	arithmetic overflow	libfuzzer	arith
npy-rs	arithmetic overflow due to incorrect parameter declaration	libfuzzer	arith, logic
ntfs	multiply with overflow	libfuzzer	arith
ntfs	index OOB	libfuzzer	oor
ntp	panic caused by unwrap on invalid input	libfuzzer	unwrap
num	panic on BigInt parsing	libfuzzer	unwrap
pancurses	string with \0	libfuzzer	unwrap
parity	panic on BasicDecoder unchecked addition	libfuzzer	arith
pcapng	arithmetic overflow	libfuzzer	arith
pdf	index out of bounds	libfuzzer	oor
pdf	infinite loop	libfuzzer	loop
pdf	stack overflow (unbounded recursion)	libfuzzer	so
pdf	stack overflow (unbounded recursion)	libfuzzer	so
pdf	stack overflow (unbounded recursion)	libfuzzer	so
pdf	stack overflow (unbounded recursion)	libfuzzer	so
pdf	index out of bounds #122	libfuzzer	oor
pdf	index out of bounds #123	libfuzzer	oor
pdf	index out of bounds #124	libfuzzer	oor
pdf	index out of bounds #126	libfuzzer	oor
pgp	subtract with overflow	libfuzzer	arith
phonenumber	internal unwrap	libfuzzer	unwrap
picky	#10	libfuzzer	unwrap
picky-asn1-der	#10	libfuzzer	arith, oom, oor
plist	arithmetic overflow	libfuzzer	arith
png	crash on malformed input	afl	oom
png	incorrect buffer size due to integer overflow	afl	arith, oom
png	infinite loop on crafted input	libfuzzer	loop
png	panic on malformed input	libfuzzer	oor
png	panic on malformed input	libfuzzer	unwrap
png	panic on malformed input	libfuzzer	oor
png	panic on malformed input	afl	unwrap, logic
prettytable-rs	subtract with overflow	libfuzzer	arith
proc-macro2	#54	afl	utf-8
proc-macro2	#55	afl	so
prost	Stack overflow	afl	so
pulldown-cmark	arithmetic overflow	libfuzzer	arith
pulldown-cmark	Overflow ParseIntError	libfuzzer	unwrap
pulldown-cmark	Panics and infinite loop	libfuzzer	loop, utf-8, oor
pulldown-cmark	string slice out of bounds	libfuzzer	oor
pulldown-cmark	beginning more than end slice index	libfuzzer	oor
pulldown-cmark	option unwrap parsing heading attributes	libfuzzer	unwrap
quick-xml	arithmetic overflow	libfuzzer	arith
quick-xml	arithmetic overflow	libfuzzer	arith
quick-xml	index out of bounds	libfuzzer	oor
quick-xml	internal unreachable panic	libfuzzer	panic
rasn	failed round trip	libfuzzer	logic
rawloader	abort on huge memory allocation	afl	oom
rav1e	Invalid assertion in rate control	libfuzzer	panic
rav1e	LRF crash when encoding tiny frames	libfuzzer	panic
rav1e	CDEF UV direction mismatch for 4:2:2	libfuzzer	logic
rav1e	Safe wrappers for-sys dav1d	libfuzzer	logic
rav1e	Crash with 4 tiles for 1080p 4:2:2	libfuzzer	logic
rav1e	Buffer underflow in CDEF pad_into_tmp16	libfuzzer	so
rav1e	Tiling mismatch for 4:2:2	libfuzzer	logic
rav1e	Encode-decode mismatch	libfuzzer	logic
rav1e	Crash on width or height of 1	libfuzzer	panic
rav1e	Encoder admits invalid color configuration	libfuzzer	logic
redis	Multiplication overflow panics in the parser	afl	arith
regex	#417	afl	utf-8
regex	#84	afl	unwrap
regex	called Option::unwrap() on a None value	honggfuzz	unwrap
regex	index out of bounds	honggfuzz	oor
regex	regex parsing panics with blog post	libfuzzer	unwrap
regex	Unexpected match branch	honggfuzz	logic
regex	issue/738	afl	arith, oor, utf-8
risuto	server DoS on user input date out of range	libfuzzer + bolero	panic
risuto	server DoS on user input date during a timezone change	libfuzzer + bolero	panic
rmpv	Unchecked vector pre-allocation	afl	oom
ron	stack overflow (unbounded recursion)	libfuzzer	so
ron	Maps are wrapped in a sequence	libfuzzer	logic
roughenough	handle truncated message	afl	oor
roughenough	incorrect range check fix	libfuzzer	logic
roughenough	reject messages with zero tags	afl	logic, oor
roughenough	reject short single tag messages	afl	logic, oor
roughenough	return Error instead of panicking	afl	panic
roughenough	validate tag offset not past end of message	afl	logic
roughenough	validate value offset not pass end of message	afl	logic
rust-ini	invalid codepoint	libfuzzer	utf-8
rustc	#24275	afl	other
rustc	#50577	prog-fuzz	logic
rustc	#50582	prog-fuzz	logic
rustc	#50585	prog-fuzz	logic
rustc	#50600	prog-fuzz	logic
rustc	#50637	prog-fuzz	loop
rustc	#51070	prog-fuzz	logic
rustc	#62524 #62546 #62554 #62863 #62881 #62894 #62895 #62913 #62973 #63116 #63135 #66473 #68629 #68730 #68890 #69130 #69310 #69378 #69396 #69401 #69600 #69602 #70549 #70552 #70594 #70608 #70677 #70724 #70736 #70763 #70813 #70942 #71297 #71471 #71798 #72410 #84104 #84117 #84148 #84149 #86895 #88770 #92267	fuzz-rustc	utf-8, panic, oom, loop, oor, unwrap
rustc-demangle	multiply with overflow	libfuzzer	arith
rustc-serialize	#109	afl	arith
rustc-serialize	#110	afl	panic
semver	logic error	libfuzzer	logic
semver	issue/227	afl	unwrap
Sequoia-PGP	#514	libfuzzer	arith
Sequoia-PGP	#515	libfuzzer	utf-8
Sequoia-PGP	#516	libfuzzer	oor
Sequoia-PGP	#516	libfuzzer	oor
serde	#75	afl	arith
serde	#77	afl	arith
serde	#82	afl	so
serde-yaml	#49	libfuzzer	so
serde-yaml	#88	libfuzzer	logic
simple_asn1	#9	libfuzzer	arith, oor
sleep-parser	#3	honggfuzz	oor, utf-8
smoltcp	arithmetic underflow	libfuzzer	arith
smoltcp	index out of bounds	libfuzzer	oor
smoltcp	index out of bounds	libfuzzer	oor
smoltcp	index out of bounds	libfuzzer	oor
smoltcp	index out of bounds	libfuzzer	oor
smoltcp	index out of bounds	libfuzzer	oor
smoltcp	index out of bounds	libfuzzer	oor
smoltcp	index out of bounds	libfuzzer	oor
snap	#12	libfuzzer	oor
snmp-parser	panic on unwrapping	libfuzzer	unwrap
soroban-env	incorrect comparison functions	libfuzzer	logic
soroban-env	incorrect comparison functions	libfuzzer	logic
soroban-env	incorrect conversion	libfuzzer	logic
sqlformat	panic on unwrapping error due to failure to parse int	libfuzzer	unwrap
sqlparser	stack overflow (unbounded recursion)	libfuzzer	so
ssh-keys	#3	afl	oor
ssh-keys	panic on slice indexing	libfuzzer	oor
ssh-parser	arithmetic overflow	libfuzzer	arith
stellar-xdr	incorrect comparison functions	libfuzzer	logic
svgparser	arithmetic overflow, bound checking panic, incorrect result	libfuzzer	arith, oor, logic
svgparser	endless loop	libfuzzer	loop
swf-parser	#23	libfuzzer	logic
sxd-document	use after free	libfuzzer	uaf	❗️
symbolic-demangle	extremely slow demangling, OOM	libfuzzer	oom
symbolic-minidump	segfault in exposed C++ library	libfuzzer	segfault	❗️
symbolic-unreal	unbounded allocation	libfuzzer	oom
symphonia	panic on unwrapping	libfuzzer	unwrap
syn	Unrecognized literal	libfuzzer	logic
syn	panic when parsing impl	libfuzzer	logic
tar-rs	#23	afl	arith
tera	#396	libfuzzer	arith, logic
tera	unimplemented panic	libfuzzer	panic
tf-demo-parser	arithmetic overflow leading to out of memory	libfuzzer	arith, oom
tiff	index out of bounds	afl	oor
tiff	infinite loop on malformed input	afl	loop
tiff	memory exhaustion on malformed input	afl	oom
tiff	panic on attempt to divide by zero	afl	arith
time	issue/309	afl	panic, arith
tinytemplate	beginning more than end on string slicing	libfuzzer	oor
tinyvec	arithmetic underflow	rutenspitz	arith
tinyvec	resize() could set incorrect size for inline storage	rutenspitz	logic
tinyvec	swap_remove() for last element worked incorrectly	rutenspitz	logic
todotxt.rs	index out of bounds	libfuzzer	oor
tokei	panic	libfuzzer	oor
tokei	consistency #725	libfuzzer	logic
toml	#178	libfuzzer	logic
toml	#179	libfuzzer	logic
toml	#180	libfuzzer	logic
toml	#181	libfuzzer	logic
toml	#185	libfuzzer	logic
toml	#186	libfuzzer	logic
toml	stack overflow (unbounded recursion)	libfuzzer	so
toml_edit	stack overflow (unbounded recursion)	libfuzzer	so
trust-dns-proto	Incorrect length check in Encoding	libfuzzer	logic
trust-dns-proto	ZERO resouce records are mis-parsed	libfuzzer	logic
trust-dns-proto	Incorrect handling of escapes	libfuzzer	logic
ttf-parser	infinite loop	libfuzzer	loop
ttf-parser	assertion failure	libfuzzer	panic
tui	issue/446	afl	arith
ubyte	multiply with overflow when parsing fractional number	libfuzzer	arith
unicode-segmentation	grapheme boundary correctness	libfuzzer	logic
unicode-segmentation	word boundary correctness	libfuzzer	logic
unified-diff	lines before 1, with no context	libFuzzer	logic
url	#108	afl	oor
url	infinite loop	libfuzzer	loop
url	slicing error	afl	oor
url	out of index	afl	oor
url	failed round trip parse	libfuzzer	logic
uuid	index out of bounds	libfuzzer	oor
v_escape	heap buffer overflow	libfuzzer	oor	❗️
vial	arithmetic overflow	libfuzzer	arith
vosub	arithmetic overflow	libfuzzer	arith
vosub	invalid slice	libfuzzer	oor
vosub	invalid slice	libfuzzer	oor
vosub	invalid slice	libfuzzer	panic
vosub	shift overflow	libfuzzer	arith
wasmparser.rs	arithmetic overflow	libfuzzer	arith
wayland-rs	#187	libfuzzer	oor
ws-rs	arithmetic overflow	libfuzzer	arith
xi-editor	issue/1303	afl	arith
xml-rs	#93	afl	utf-8
xml-rs	arithmetic overflow	libfuzzer	arith
yaxpeax-x86	#12 arithmetic overflow	libfuzzer	arith
yaxpeax-x86	#13 arithmetic overflow	libfuzzer	arith
yaxpeax-x86	#15 arithmetic overflow	libfuzzer	arith
zip-rs	arithmetic overflow	libfuzzer	arith
zip-rs	arithmetic overflow	libfuzzer	arith
zune-jpeg	heap buffer overflow	libfuzzer	oor	❗️

Description of categories:

• arith: Arithmetic error, eg. overflows
• logic: Logic bug
• loop: Infinite loop
• oom: Out of memory
• oor: Out of range access
• segfault: Program segfaulted
• so: Stack overflow
• uaf: Use after free
• uninit: Program discloses contents of uninitialized memory
• unwrap: Call to unwrap on None or Err(_)
• utf-8: Problem with UTF-8 strings handling, eg. get a char not at a char boundary
• panic: A panic not covered by any of the above
• other: Anything that does not fit in another category, or unclear what the problem is