Skip to content

Conversation

Mrmaxmeier
Copy link

@Mrmaxmeier Mrmaxmeier commented Sep 15, 2025

Hi,

this PR fixes a panic in the dense::DFA::from_bytes API. The validation step after loading a corrupted DFA currently panics in TransitionTable::validate due to an invalid MatchState. This PR fixes this by validating the MatchState first.

#[test]
fn regression_validation_order() {
    let mut dfa = DFA::new("abc").unwrap();
    dfa.ms = MatchStates {
        slices: vec![],
        pattern_ids: vec![],
        pattern_len: 1,
    };
    let (buf, _) = dfa.to_bytes_native_endian();
    DFA::from_bytes(&buf).unwrap_err();
}
thread 'dfa::dense::tests::regression_validation_order' (365737) panicked at regex-automata/src/dfa/dense.rs:4644:9:
index out of bounds: the len is 0 but the index is 1
stack backtrace:
   [...]
   3: regex_automata::dfa::dense::MatchStates<T>::pattern_len
             at ./src/dfa/dense.rs:4644:9
   4: regex_automata::dfa::dense::DFA<T>::match_pattern_len
             at ./src/dfa/dense.rs:3006:17
   5: <regex_automata::dfa::dense::DFA<T> as regex_automata::dfa::automaton::Automaton>::match_len
             at ./src/dfa/dense.rs:3220:14
   6: regex_automata::dfa::dense::TransitionTable<T>::validate
             at ./src/dfa/dense.rs:3629:28
   7: regex_automata::dfa::dense::DFA<&[u32]>::from_bytes
             at ./src/dfa/dense.rs:2343:16
   8: regex_automata::dfa::dense::tests::regression_validation_order
             at ./src/dfa/dense.rs:5244:9

I'm assuming that people are not using serialized automata with untrusted inputs, so I hope just opening a PR is fine 🙂

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant