panic on invalid input to boa::parse, 'Could not convert to BigInt'

[alexanderkjall]

Describe the bug

Expected an Error, not a panic.

To Reproduce

Can be reproduced with this program

fn main() {
    let data: Vec<u8> = vec![0x30, 0x78, 0x6e, 0x3d, 0x3e, 0x78, 0x78]; // "0xn=>xx"
    if let Ok(s) = std::str::from_utf8(&data) {
        let _ = boa::parse(s);
    }
}

Expected behavior

An Error, not a panic

Build environment (please complete the following information):

• OS: Ubuntu 20.04
• Version: 0.10.0
• Target triple: [e.g. x86_64-unknown-linux-gnu]
• Rustc version: 1.48.0-nightly (d006f5734 2020-08-28)

Additional context
Full stacktrace:

thread 'main' panicked at 'Could not convert to BigInt', /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/Boa-0.10.0/src/syntax/lexer/number.rs:291:59
stack backtrace:
   0: rust_begin_unwind
             at /rustc/d006f5734f49625c34d6fc33bf6b9967243abca8/library/std/src/panicking.rs:483
   1: core::panicking::panic_fmt
             at /rustc/d006f5734f49625c34d6fc33bf6b9967243abca8/library/core/src/panicking.rs:85
   2: core::option::expect_failed
             at /rustc/d006f5734f49625c34d6fc33bf6b9967243abca8/library/core/src/option.rs:1213
   3: core::option::Option<T>::expect
             at /home/capitol/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/option.rs:333
   4: <boa::syntax::lexer::number::NumberLiteral as boa::syntax::lexer::Tokenizer<R>>::lex
             at /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/Boa-0.10.0/src/syntax/lexer/number.rs:291
   5: boa::syntax::lexer::Lexer<R>::next
             at /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/Boa-0.10.0/src/syntax/lexer/mod.rs:194
   6: boa::syntax::parser::cursor::buffered_lexer::BufferedLexer<R>::fill
             at /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/Boa-0.10.0/src/syntax/parser/cursor/buffered_lexer/mod.rs:116
   7: boa::syntax::parser::cursor::buffered_lexer::BufferedLexer<R>::peek
             at /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/Boa-0.10.0/src/syntax/parser/cursor/buffered_lexer/mod.rs:201
   8: boa::syntax::parser::cursor::Cursor<R>::peek
             at /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/Boa-0.10.0/src/syntax/parser/cursor/mod.rs:56
   9: <boa::syntax::parser::Script as boa::syntax::parser::TokenParser<R>>::parse
             at /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/Boa-0.10.0/src/syntax/parser/mod.rs:124
  10: boa::syntax::parser::Parser<R>::parse_all
             at /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/Boa-0.10.0/src/syntax/parser/mod.rs:104
  11: boa::parse
             at /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/Boa-0.10.0/src/lib.rs:73
  12: boa_reproduce::main
             at ./src/main.rs:4
  13: core::ops::function::FnOnce::call_once
             at /home/capitol/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:227

[HalidOdat]

Thanks for reporting these bugs @alexanderkjall , I'm curious are you using a fuzzer to generate these inputs?

I think I'll create an issue about stress testing the lexer/parser with fuzzed input, should catch these bugs.

[alexanderkjall]

Yeah, I saw the project on reddit thought it looked cool.

Here is the fuzzer code:

#[macro_use]
extern crate honggfuzz;

fn main() {
    loop {
        fuzz!(|data: &[u8]| {
            if let Ok(s) = std::str::from_utf8(data) {
                let _ = boa::parse(s);
            }
        });
    }
}

[HalidOdat]

Created the issue here #773 , nobody is assigned if you would like to take it :)