[BUG REPORT] Multiple panics found in different locations.

[xizheyin]

Description

I have identified 20 bugs using my fuzz testing tool, which are panics occurring in different parts of the code. Many of these bugs may require relatively complex interactions, such as long dependency sequences, to be triggered. The majority of these issues are related to arithmetic overflow. I have uploaded the replay files and inputs here. Please review them and let me know if any modifications are necessary. Thank you very much.

version

xi-core-lib = "=0.3.0"

Below are the corresponding error messages

bug1

thread 'main' panicked at 'attempt to subtract with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:299:21

bug2

thread 'main' panicked at 'slice index starts at 1 but ends at 0', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/selection.rs:135:10

bug3

thread 'main' panicked at 'attempt to add with overflow',
 /home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:267:30

bug4

thread 'main' panicked at 'attempt to subtract with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/editor.rs:191:9

bug5

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:111:21

bug6

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:109:48

bug7

thread 'main' panicked at 'attempt to subtract with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/selection.rs:186:44

bug8

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:270:32

bug9

thread 'main' panicked at 'index out of bounds: the len is 0 but the index is 0', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/selection.rs:71:33

bug10

thread 'main' panicked at 'attempt to subtract with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/view.rs:327:23

bug11

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:142:16

bug12

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:144:45

bug13

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:131:16

bug14

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:233:29

bug15

thread 'main' panicked at 'attempt to add with overflow',
 /home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:230:23

bug16

thread 'main' panicked at 'attempt to subtract with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/selection.rs:154:47

bug17

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:173:40

bug18

thread 'main' panicked at 'attempt to add with overflow',
 /home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:183:45

bug19

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:177:21

bug20

thread 'main' panicked at 'attempt to add with overflow', 
/home/yxz/.cargo/registry/src/github.com-1ecc6299db9ec823/xi-core-lib-0.3.0/src/line_cache_shadow.rs:156:24

[cmyr]

Thanks for this! This project is no longer under active development, so this probably won't get fixed. Taking a quick look through the results, all of the cases I see involve conditions that are unlikely to occur in use for several lifetimes, such as files containing a number of lines approaching 2**64. As storing such a file would take several thousands of petabytes, I overall find these results quite encouraging. :)

[xizheyin]

Thank you very much for your response! I truly appreciate your confirmation regarding these issues. I am a Ph.D. student from NJU SATE Lab, and we are conducting research on fuzz testing tools for Rust. Our testing tool automatically generates sequences for library APIs, which helped us discover these bugs. These bugs are triggered by various sequences and inputs, and there is a possibility that the API could be misused by unsuspecting users. Even though these bugs may not be fixed, I want to express my gratitude for your assistance and confirmation! We will continue to improve our tool!

[cmyr]

Thank you, good luck with your research!