Fuzzing Crash: Integer overflow in list_view_zctl with empty sizes array

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: vortex-array/src/arrow/executor/list.rs:122 in the list_view_zctl function

Error Message:

attempt to subtract with overflow

Stack Trace:

   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic_const::panic_const_sub_overflow
   3: list_view_zctl<i32>
             at ./vortex-array/src/arrow/executor/list.rs:122:20
   4: to_arrow_list<i32>
             at ./vortex-array/src/arrow/executor/list.rs:51:24
   5: execute_arrow
             at ./vortex-array/src/arrow/executor/mod.rs:124:47
   6: list_view_zctl<i32>
             at ./vortex-array/src/arrow/executor/list.rs:151:29
   7: to_arrow_list<i32>
             at ./vortex-array/src/arrow/executor/list.rs:51:24
   8: execute_arrow
             at ./vortex-array/src/arrow/executor/mod.rs:124:47
   9: into_arrow
             at ./vortex-array/src/arrow/mod.rs:45:14
  10: arrow_compare
             at ./vortex-array/src/compute/compare.rs:371:35

Root Cause:

The fuzzer discovered an integer overflow panic in the Arrow executor when converting a nested ListViewArray to an Arrow array. The crash occurs at line 122 in list_view_zctl:

let final_size = sizes
    .scalar_at(sizes.len() - 1)  // Line 122 - panics when sizes.len() == 0
    .cast(&DType::Primitive(O::PTYPE, Nullability::NonNullable))?;

When sizes.len() is 0, the expression sizes.len() - 1 causes an integer underflow panic in debug/fuzz builds.

The crash path:

1. A nested List(List(Utf8)) structure with empty arrays is created
2. During a compare operation, the arrays are converted to Arrow format
3. The outer ListViewArray calls list_view_zctl
4. The inner ListViewArray also calls list_view_zctl
5. The inner call has an empty sizes array (length 0)
6. Attempting sizes.len() - 1 when len() == 0 causes integer overflow

The debug output shows the structure:

• Outer ListViewArray with 2 elements (offsets: [0, 0], sizes: [0, 0])
• Inner ListViewArray with 0 elements (offsets: empty, sizes: empty)
• Elements are VarBinViewArray with 0 views

This indicates a valid edge case where nested empty lists should be handled, but the current code assumes sizes.len() >= 1.

Debug Output

FuzzFileAction {
    array: ListViewArray {
        dtype: List(
            List(
                Utf8(
                    Nullable,
                ),
                Nullable,
            ),
            Nullable,
        ),
        elements: ListViewArray {
            dtype: List(
                Utf8(
                    Nullable,
                ),
                Nullable,
            ),
            elements: VarBinViewArray {
                dtype: Utf8(
                    Nullable,
                ),
                buffers: [],
                views: Buffer<vortex_vector::binaryview::view::BinaryView> {
                    length: 0,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [],
                },
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            offsets: PrimitiveArray {
                dtype: Primitive(
                    U64,
                    NonNullable,
                ),
                buffer: BufferHandle(
                    Host(
                        Buffer<u8> {
                            length: 0,
                            alignment: Alignment(
                                8,
                            ),
                            as_slice: [],
                        },
                    ),
                ),
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [
                                (
                                    IsSorted,
                                    Exact(
                                        ScalarValue(
                                            Bool(
                                                true,
                                            ),
                                        ),
                                    ),
                                ),
                            ],
                        },
                    },
                },
            },
            sizes: PrimitiveArray {
                dtype: Primitive(
                    U64,
                    NonNullable,
                ),
                buffer: BufferHandle(
                    Host(
                        Buffer<u8> {
                            length: 0,
                            alignment: Alignment(
                                8,
                            ),
                            as_slice: [],
                        },
                    ),
                ),
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            is_zero_copy_to_list: true,
            validity: AllValid,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        offsets: PrimitiveArray {
            dtype: Primitive(
                I32,
                NonNullable,
            ),
            buffer: BufferHandle(
                Host(
                    Buffer<u8> {
                        length: 8,
                        alignment: Alignment(
                            4,
                        ),
                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0],
                    },
                ),
            ),
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [
                            (
                                IsSorted,
                                Exact(
                                    ScalarValue(
                                        Bool(
                                            true,
                                        ),
                                    ),
                                ),
                            ),
                        ],
                    },
                },
            },
        },
        sizes: PrimitiveArray {
            dtype: Primitive(
                I32,
                NonNullable,
            ),
            buffer: BufferHandle(
                Host(
                    Buffer<u8> {
                        length: 8,
                        alignment: Alignment(
                            4,
                        ),
                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0],
                    },
                ),
            ),
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        is_zero_copy_to_list: true,
        validity: AllValid,
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    projection_expr: None,
    filter_expr: None,
    compressor_strategy: Compact,
}

Summary

• Target: file_io
• Crash File: crash-f59d24f0d4e13cdb621ff55a229aa3153a9eaeb0
• Branch: $BRANCH
• Commit: $COMMIT
• Crash Artifact: $ARTIFACT_URL

Reproduction

1. Download the crash artifact:

   • Direct download: $ARTIFACT_URL
   • Or find $ARTIFACT_NAME at: $WORKFLOW_RUN
   • Extract the zip file

2. Reproduce locally:

# The artifact contains file_io/crash-f59d24f0d4e13cdb621ff55a229aa3153a9eaeb0
cargo +nightly fuzz run -D --sanitizer=none file_io file_io/crash-f59d24f0d4e13cdb621ff55a229aa3153a9eaeb0 -- -rss_limit_mb=0

3. Get full backtrace:

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none file_io file_io/crash-f59d24f0d4e13cdb621ff55a229aa3153a9eaeb0 -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the file_io target.

Crash Details

Crash Location: vortex-array/src/arrow/executor/list.rs:129 in the list_view_zctl function

Error Message:

attempt to subtract with overflow

Stack Trace:

   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic_const::panic_const_sub_overflow
   3: list_view_zctl<i32>
             at ./vortex-array/src/arrow/executor/list.rs:129:20
   4: to_arrow_list<i32>
             at ./vortex-array/src/arrow/executor/list.rs:52:24
   5: execute_arrow
             at ./vortex-array/src/arrow/executor/mod.rs:124:47
   6: list_view_zctl<i32>
             at ./vortex-array/src/arrow/executor/list.rs:158:29
   7: to_arrow_list<i32>
             at ./vortex-array/src/arrow/executor/list.rs:52:24

Similarities to Original Issue:

• Same file: vortex-array/src/arrow/executor/list.rs
• Same function: list_view_zctl
• Same error: integer overflow from sizes.len() - 1 when sizes.len() == 0
• Same nested List structure with empty arrays
• Same call path through Arrow conversion

Differences:

• Line 129 vs line 122 in original (likely due to code changes between commits c655272 and the original crash commit)
• Different outer list type: List(List(Binary)) vs List(List(Utf8))
• Different offset type parameter in stack trace: i32 vs original

These differences are superficial - this is clearly the same root cause where the code assumes sizes.len() >= 1 but receives an empty sizes array.

Debug Output

FuzzFileAction {
    array: ChunkedArray {
        dtype: List(
            List(
                Binary(
                    NonNullable,
                ),
                NonNullable,
            ),
            NonNullable,
        ),
        len: 6,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: BufferHandle(
                Host(
                    Buffer<u8> {
                        length: 24,
                        alignment: Alignment(
                            8,
                        ),
                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 6, 0, 0, 0, 0, 0, 0, 0, ...],
                    },
                ),
            ),
            validity: NonNullable,
            stats_set: ArrayStats { ... },
        },
        chunks: [
            ListViewArray {
                dtype: List(List(Binary(NonNullable), NonNullable), NonNullable),
                elements: ListViewArray {
                    dtype: List(Binary(NonNullable), NonNullable),
                    elements: VarBinViewArray { views: length 0, ... },
                    offsets: PrimitiveArray { length: 0, ... },
                    sizes: PrimitiveArray { length: 0, ... },  // EMPTY - causes crash
                    is_zero_copy_to_list: true,
                    validity: NonNullable,
                },
                offsets: PrimitiveArray { length: 48, dtype: I64, ... },
                sizes: PrimitiveArray { length: 48, dtype: I64, ... },
                is_zero_copy_to_list: true,
                validity: NonNullable,
            },
            ListViewArray {
                dtype: List(List(Binary(NonNullable), NonNullable), NonNullable),
                elements: ListViewArray {
                    dtype: List(Binary(NonNullable), NonNullable),
                    elements: VarBinViewArray { views: length 0, ... },
                    offsets: PrimitiveArray { length: 0, ... },
                    sizes: PrimitiveArray { length: 0, ... },  // EMPTY - causes crash
                    is_zero_copy_to_list: true,
                    validity: NonNullable,
                },
                offsets: PrimitiveArray { length: 0, dtype: I16, ... },
                sizes: PrimitiveArray { length: 0, dtype: I16, ... },
                is_zero_copy_to_list: true,
                validity: NonNullable,
            },
        ],
    },
    projection_expr: None,
    filter_expr: None,
    compressor_strategy: Compact,
}

Occurrence Details

• Crash File: crash-9f90e12abfab52a713da6b9e55298cb7d1a0b7cf
• Branch: develop
• Commit: c655272
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs//artifacts/

Reproduction

cargo +nightly fuzz run -D --sanitizer=none file_io file_io/crash-9f90e12abfab52a713da6b9e55298cb7d1a0b7cf -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the file_io target.

Crash Details

Crash Location: vortex-array/src/arrow/executor/list.rs:129:20 in list_view_zctl function

Error Message:

attempt to subtract with overflow

Stack Trace:

   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic_const::panic_const_sub_overflow
   3: list_view_zctl<i32>
             at ./vortex-array/src/arrow/executor/list.rs:129:20
   4: to_arrow_list<i32>
             at ./vortex-array/src/arrow/executor/list.rs:52:24
   5: execute_arrow
             at ./vortex-array/src/arrow/executor/mod.rs:124:47
   6: list_view_zctl<i32>
             at ./vortex-array/src/arrow/executor/list.rs:158:29
   7: to_arrow_list<i32>
             at ./vortex-array/src/arrow/executor/list.rs:52:24

Similarities to Original Issue:

• Same function: list_view_zctl
• Same error: attempt to subtract with overflow
• Same root cause: sizes.len() - 1 when sizes.len() == 0
• Same scenario: Nested List(List(Binary)) structure with empty sizes arrays

Differences:

• Line number: 129 vs 122 (likely due to recent code changes)
• Offset types: Using I64 offsets in outer list, I16 in inner list (vs I32 in both)
• Element type: Binary vs Utf8
• Note: These differences are superficial - the root cause is identical

Debug Output

FuzzFileAction {
    array: ChunkedArray {
        dtype: List(
            List(
                Binary(
                    NonNullable,
                ),
                NonNullable,
            ),
            NonNullable,
        ),
        len: 6,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: BufferHandle(
                Host(
                    Buffer<u8> {
                        length: 24,
                        alignment: Alignment(
                            8,
                        ),
                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 6, 0, 0, 0, 0, 0, 0, 0, ...],
                    },
                ),
            ),
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        chunks: [
            ListViewArray {
                dtype: List(
                    List(
                        Binary(
                            NonNullable,
                        ),
                        NonNullable,
                    ),
                    NonNullable,
                ),
                elements: ListViewArray {
                    dtype: List(
                        Binary(
                            NonNullable,
                        ),
                        NonNullable,
                    ),
                    elements: VarBinViewArray {
                        dtype: Binary(
                            NonNullable,
                        ),
                        buffers: [],
                        views: Buffer<vortex_vector::binaryview::view::BinaryView> {
                            length: 0,
                            alignment: Alignment(
                                16,
                            ),
                            as_slice: [],
                        },
                        validity: NonNullable,
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                    offsets: PrimitiveArray {
                        dtype: Primitive(
                            U64,
                            NonNullable,
                        ),
                        buffer: BufferHandle(
                            Host(
                                Buffer<u8> {
                                    length: 0,
                                    alignment: Alignment(
                                        8,
                                    ),
                                    as_slice: [],
                                },
                            ),
                        ),
                        validity: NonNullable,
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [
                                        (
                                            IsSorted,
                                            Exact(
                                                ScalarValue(
                                                    Bool(
                                                        true,
                                                    ),
                                                ),
                                            ),
                                        ),
                                    ],
                                },
                            },
                        },
                    },
                    sizes: PrimitiveArray {
                        dtype: Primitive(
                            U64,
                            NonNullable,
                        ),
                        buffer: BufferHandle(
                            Host(
                                Buffer<u8> {
                                    length: 0,
                                    alignment: Alignment(
                                        8,
                                    ),
                                    as_slice: [],
                                },
                            ),
                        ),
                        validity: NonNullable,
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                    is_zero_copy_to_list: true,
                    validity: NonNullable,
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [],
                            },
                        },
                    },
                },
                offsets: PrimitiveArray {
                    dtype: Primitive(
                        I64,
                        NonNullable,
                    ),
                    buffer: BufferHandle(
                        Host(
                            Buffer<u8> {
                                length: 48,
                                alignment: Alignment(
                                    8,
                                ),
                                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ...],
                            },
                        ),
                    ),
                    validity: NonNullable,
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [
                                    (
                                        IsSorted,
                                        Exact(
                                            ScalarValue(
                                                Bool(
                                                    true,
                                                ),
                                            ),
                                        ),
                                    ),
                                ],
                            },
                        },
                    },
                },
                sizes: PrimitiveArray {
                    dtype: Primitive(
                        I64,
                        NonNullable,
                    ),
                    buffer: BufferHandle(
                        Host(
                            Buffer<u8> {
                                length: 48,
                                alignment: Alignment(
                                    8,
                                ),
                                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ...],
                            },
                        ),
                    ),
                    validity: NonNullable,
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [],
                            },
                        },
                    },
                },
                is_zero_copy_to_list: true,
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            ListViewArray {
                dtype: List(
                    List(
                        Binary(
                            NonNullable,
                        ),
                        NonNullable,
                    ),
                    NonNullable,
                ),
                elements: ListViewArray {
                    dtype: List(
                        Binary(
                            NonNullable,
                        ),
                        NonNullable,
                    ),
                    elements: VarBinViewArray {
                        dtype: Binary(
                            NonNullable,
                        ),
                        buffers: [],
                        views: Buffer<vortex_vector::binaryview::view::BinaryView> {
                            length: 0,
                            alignment: Alignment(
                                16,
                            ),
                            as_slice: [],
                        },
                        validity: NonNullable,
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                    offsets: PrimitiveArray {
                        dtype: Primitive(
                            U64,
                            NonNullable,
                        ),
                        buffer: BufferHandle(
                            Host(
                                Buffer<u8> {
                                    length: 0,
                                    alignment: Alignment(
                                        8,
                                    ),
                                    as_slice: [],
                                },
                            ),
                        ),
                        validity: NonNullable,
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [
                                        (
                                            IsSorted,
                                            Exact(
                                                ScalarValue(
                                                    Bool(
                                                        true,
                                                    ),
                                                ),
                                            ),
                                        ),
                                    ],
                                },
                            },
                        },
                    },
                    sizes: PrimitiveArray {
                        dtype: Primitive(
                            U64,
                            NonNullable,
                        ),
                        buffer: BufferHandle(
                            Host(
                                Buffer<u8> {
                                    length: 0,
                                    alignment: Alignment(
                                        8,
                                    ),
                                    as_slice: [],
                                },
                            ),
                        ),
                        validity: NonNullable,
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                    is_zero_copy_to_list: true,
                    validity: NonNullable,
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [],
                            },
                        },
                    },
                },
                offsets: PrimitiveArray {
                    dtype: Primitive(
                        I16,
                        NonNullable,
                    ),
                    buffer: BufferHandle(
                        Host(
                            Buffer<u8> {
                                length: 0,
                                alignment: Alignment(
                                    2,
                                ),
                                as_slice: [],
                            },
                        ),
                    ),
                    validity: NonNullable,
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [
                                    (
                                        IsSorted,
                                        Exact(
                                            ScalarValue(
                                                Bool(
                                                    true,
                                                ),
                                            ),
                                        ),
                                    ),
                                ],
                            },
                        },
                    },
                },
                sizes: PrimitiveArray {
                    dtype: Primitive(
                        I16,
                        NonNullable,
                    ),
                    buffer: BufferHandle(
                        Host(
                            Buffer<u8> {
                                length: 0,
                                alignment: Alignment(
                                    2,
                                ),
                                as_slice: [],
                            },
                        ),
                    ),
                    validity: NonNullable,
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [],
                            },
                        },
                    },
                },
                is_zero_copy_to_list: true,
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ],
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    projection_expr: None,
    filter_expr: None,
    compressor_strategy: Compact,
}

Occurrence Details

• Crash File: crash-9f90e12abfab52a713da6b9e55298cb7d1a0b7cf
• Branch: develop
• Commit: 308efaa
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs//artifacts/

Reproduction

cargo +nightly fuzz run -D --sanitizer=none file_io file_io/crash-9f90e12abfab52a713da6b9e55298cb7d1a0b7cf -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis