Fuzzing Crash: Decimal Sum Overflow in ChunkedArray

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: fuzz/src/array/mod.rs:assert_scalar_eq

Error Message:

Scalar mismatch: expected decimal256(27897708223554751832957193840191214563962497566384571035819434488814200889077, precision=76, scale=75), got null in step 1

Stack Trace:

   3: assert_scalar_eq
             at ./fuzz/src/array/mod.rs:705:13
   4: run_fuzz_action
             at ./fuzz/src/array/mod.rs:587:17
   5: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:14:11
   6: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.10/src/lib.rs:363:60
   7: {closure#0}
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.10/src/lib.rs:62:9

Root Cause:

The fuzzer discovered a case where summing decimal values in a ChunkedArray results in an i256 overflow. When this happens, the sum implementation correctly returns null (as documented in vortex-array/src/compute/sum.rs:44 and tested in vortex-array/src/arrays/decimal/compute/sum.rs:363-377). However, the fuzzer's expectation logic doesn't account for this overflow behavior, causing a mismatch between the expected decimal value and the actual null result.

The issue occurs when:

1. A ChunkedArray contains DecimalArray chunks with very large i256 values
2. Multiple Sum operations are performed sequentially
3. The accumulated sum exceeds i256::MAX, causing CheckedAdd to return None
4. The sum function correctly returns Scalar::null() on overflow
5. The fuzzer expects the computed sum but gets null instead

This is a test infrastructure issue rather than a bug in the sum implementation. The fuzzer should either:

• Detect when overflow would occur and adjust expectations
• Verify that null is returned when overflow happens
• Generate input values that won't overflow

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Decimal(
            DecimalDType {
                precision: 76,
                scale: 75,
            },
            Nullable,
        ),
        len: 12,
        chunks: [
            DecimalArray { ... values_type: I256, validity: AllValid ... },
            DecimalArray { ... values_type: I256, validity: AllValid ... }
        ]
    },
    actions: [
        (Sum, Scalar { value: decimal256(27897708223554751832957193840191214563962497566384571035819434488814200889077, precision=76, scale=75) }),
        (Sum, Scalar { value: decimal256(27897708223554751832957193840191214563962497566384571035819434488814200889077, precision=76, scale=75) }),
        (Sum, Scalar { value: decimal256(27897708223554751832957193840191214563962497566384571035819434488814200889077, precision=76, scale=75) }),
        (Sum, Scalar { value: decimal256(27897708223554751832957193840191214563962497566384571035819434488814200889077, precision=76, scale=75) })
    ]
}

Summary

• Target: array_ops
• Crash File: crash-0171cbd8eede2afdec81571443c1aa8ff4e52032
• Branch: develop
• Commit: 265f29a
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/20425809503/artifacts/4941338081

Reproduction

1. Download the crash artifact:

   • Direct download: https://github.com/vortex-data/vortex/actions/runs/20425809503/artifacts/4941338081
   • Or find operations-fuzzing-crash-artifacts at: https://github.com/vortex-data/vortex/actions/runs/20425809503
   • Extract the zip file

2. Reproduce locally:

# The artifact contains array_ops/crash-0171cbd8eede2afdec81571443c1aa8ff4e52032
cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-0171cbd8eede2afdec81571443c1aa8ff4e52032 -- -rss_limit_mb=0

3. Get full backtrace:

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-0171cbd8eede2afdec81571443c1aa8ff4e52032 -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: fuzz/src/array/mod.rs:705:13 in assert_scalar_eq

Error Message:

Scalar mismatch: expected decimal256(10335731459288881875449326843340756734051447447459996202947475384727173595149, precision=76, scale=75), got null in step 2

Stack Trace:

   3: assert_scalar_eq
             at ./fuzz/src/array/mod.rs:705:13
   4: run_fuzz_action
             at ./fuzz/src/array/mod.rs:587:17
   5: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:14:11

Similarities to Original Issue:

• Same crash location: fuzz/src/array/mod.rs:705:13 in assert_scalar_eq
• Same error pattern: Sum operation on decimal256 ChunkedArray returns null instead of expected value
• Same component: Decimal sum operations with i256 overflow behavior
• Same root cause: Fuzzer expectations don't account for i256 overflow returning null

Differences:

• Current crash occurs at step 2 (after Mask operation, then Sum), while original was at step 1
• Different decimal value expected: 10335731459288881875449326843340756734051447447459996202947475384727173595149 vs original 27897708223554751832957193840191214563962497566384571035819434488814200889077
• Operation sequence includes Mask before Sum operations

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Decimal(
            DecimalDType {
                precision: 76,
                scale: 75,
            },
            Nullable,
        ),
        len: 12,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 24,
                alignment: Alignment(
                    8,
                ),
                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        chunks: [
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 128,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 256,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [1, 0, 0, 0, 0, 0, 0, 0, 0, 208, 64, 171, 43, 14, 159, 225, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ],
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    actions: [
        (
            Mask(
                Values(
                    MaskValues {
                        buffer: BitBuffer {
                            buffer: Buffer<u8> {
                                length: 2,
                                alignment: Alignment(
                                    1,
                                ),
                                as_slice: [248, 15],
                            },
                            offset: 0,
                            len: 12,
                        },
                        indices: OnceLock(
                            <uninit>,
                        ),
                        slices: OnceLock(
                            <uninit>,
                        ),
                        true_count: 9,
                        density: 0.75,
                    },
                ),
            ),
            Array(
                DecimalArray {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    values: Buffer<u8> {
                        length: 384,
                        alignment: Alignment(
                            16,
                        ),
                        as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                    },
                    values_type: I256,
                    validity: Array(
                        BoolArray {
                            dtype: Bool(
                                NonNullable,
                            ),
                            bits: BitBuffer {
                                buffer: Buffer<u8> {
                                    length: 2,
                                    alignment: Alignment(
                                        1,
                                    ),
                                    as_slice: [7, 240],
                                },
                                offset: 0,
                                len: 12,
                            },
                            validity: NonNullable,
                            stats_set: ArrayStats {
                                inner: RwLock {
                                    data: StatsSet {
                                        values: [
                                            (
                                                Sum,
                                                Exact(
                                                    ScalarValue(
                                                        Primitive(
                                                            U64(
                                                                3,
                                                            ),
                                                        ),
                                                    ),
                                                ),
                                            ),
                                        ],
                                    },
                                },
                            },
                        },
                    ),
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [],
                            },
                        },
                    },
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    10335731459288881875449326843340756734051447447459996202947475384727173595149,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    10335731459288881875449326843340756734051447447459996202947475384727173595149,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
    ],
}

Occurrence Details

• Crash File: crash-5cfde2ab95fefd556db99b91e278d1a8287db26f
• Branch: develop
• Commit: 265f29a
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/20425809503/artifacts/4941338081

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-5cfde2ab95fefd556db99b91e278d1a8287db26f -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target, but affecting Primitive I64 arrays instead of Decimal arrays.

Crash Details

Crash Location: fuzz/src/array/mod.rs:assert_scalar_eq

Error Message:

Scalar mismatch: expected 7988861491824505383i64, got null in step 2

Stack Trace:

   3: assert_scalar_eq
             at ./fuzz/src/array/mod.rs:705:13
   4: run_fuzz_action
             at ./fuzz/src/array/mod.rs:587:17
   5: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:14:11

Similarities to Original Issue:

• Same symptom: Sum operation returns null when a non-null value is expected
• Same root cause: Likely i64 overflow in ChunkedArray sum operation
• Same pattern: Overflow causes sum to return null instead of the expected value

Differences:

• Data type: Primitive I64 (NonNullable) vs Decimal256 (Nullable)
• Step: Occurs at step 2 vs step 1
• Operation sequence:
  1. Step 0: Sum on ChunkedArray → returns null (likely overflow)
  2. Step 1: Slice(2..5) → produces array with expected sum = 7988861491824505383
  3. Step 2: Sum on sliced array → returns null instead of expected value

The debug output shows a ChunkedArray with 5 I64 elements split into 2 chunks. The first sum returns null (suggesting overflow), but after slicing to range 2..5, the fuzzer expects the sum of those 3 elements to be valid. However, the sum still returns null, which could indicate:

1. The overflow flag/state is being propagated incorrectly after slicing
2. The sliced array still contains values that overflow when summed
3. A bug in how ChunkedArray handles sum after slicing

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Primitive(
            I64,
            NonNullable,
        ),
        len: 5,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 24,
                alignment: Alignment(
                    8,
                ),
                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, ...],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        chunks: [
            PrimitiveArray {
                dtype: Primitive(
                    I64,
                    NonNullable,
                ),
                buffer: Buffer<u8> {
                    length: 16,
                    alignment: Alignment(
                        8,
                    ),
                    as_slice: [59, 126, 145, 145, 200, 220, 255, 255, 255, 38, 233, 255, 255, 255, 255, 59],
                },
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            PrimitiveArray {
                dtype: Primitive(
                    I64,
                    NonNullable,
                ),
                buffer: Buffer<u8> {
                    length: 24,
                    alignment: Alignment(
                        8,
                    ),
                    as_slice: [40, 255, 255, 255, 255, 255, 8, 255, 255, 255, 255, 51, 51, 35, 213, 51, ...],
                },
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ],
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    actions: [
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Primitive(
                        I64,
                        Nullable,
                    ),
                    value: ScalarValue(
                        Null,
                    ),
                },
            ),
        ),
        (
            Slice(
                2..5,
            ),
            Array(
                PrimitiveArray {
                    dtype: Primitive(
                        I64,
                        NonNullable,
                    ),
                    buffer: Buffer<u8> {
                        length: 24,
                        alignment: Alignment(
                            8,
                        ),
                        as_slice: [40, 255, 255, 255, 255, 255, 8, 255, 255, 255, 255, 51, 51, 35, 213, 51, ...],
                    },
                    validity: NonNullable,
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [
                                    (
                                        Sum,
                                        Exact(
                                            ScalarValue(
                                                Primitive(
                                                    I64(
                                                        7988861491824505383,
                                                    ),
                                                ),
                                            ),
                                        ),
                                    ),
                                ],
                            },
                        },
                    },
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Primitive(
                        I64,
                        Nullable,
                    ),
                    value: ScalarValue(
                        Primitive(
                            I64(
                                7988861491824505383,
                            ),
                        ),
                    ),
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Primitive(
                        I64,
                        Nullable,
                    ),
                    value: ScalarValue(
                        Primitive(
                            I64(
                                7988861491824505383,
                            ),
                        ),
                    ),
                },
            ),
        ),
    ],
}

Occurrence Details

• Crash File: crash-491d2a05d019c49e609745380763afd4d7b80602
• Branch: develop
• Commit: adf2182
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/20460350217/artifacts/4952799950

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-491d2a05d019c49e609745380763afd4d7b80602 -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: fuzz/src/array/mod.rs:assert_scalar_eq

Error Message:

Scalar mismatch: expected decimal256(10335731459288881875449326843340756734051447447459996202947475384727173595149, precision=76, scale=75), got null in step 2

Stack Trace:

   3: assert_scalar_eq
             at ./fuzz/src/array/mod.rs:721:13
   4: run_fuzz_action
             at ./fuzz/src/array/mod.rs:600:17
   5: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:14:11
   6: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.10/src/lib.rs:363:60
   7: {closure#0}
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.10/src/lib.rs:62:9

Similarities to Original Issue:

• Same crash location (fuzz/src/array/mod.rs:assert_scalar_eq)
• Same error pattern: decimal256 sum overflow returning null instead of expected value
• Same decimal dtype: precision=76, scale=75
• Same array structure: ChunkedArray with 2 DecimalArray chunks (I256 values)
• Same root cause: i256 overflow in decimal sum operations

Differences:

• This crash occurs at step 2 (after a Mask operation), original at step 1
• This crash involves a Mask action before the Sum operations
• Different specific expected decimal value (but both are large i256 values that overflow)
• Note: These differences may indicate the same root cause manifesting differently

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Decimal(
            DecimalDType {
                precision: 76,
                scale: 75,
            },
            Nullable,
        ),
        len: 12,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 24,
                alignment: Alignment(
                    8,
                ),
                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        chunks: [
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 128,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 256,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [1, 0, 0, 0, 0, 0, 0, 0, 0, 208, 64, 171, 43, 14, 159, 225, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ],
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    actions: [
        (
            Mask(
                Values(
                    MaskValues {
                        buffer: BitBuffer {
                            buffer: Buffer<u8> {
                                length: 2,
                                alignment: Alignment(
                                    1,
                                ),
                                as_slice: [248, 15],
                            },
                            offset: 0,
                            len: 12,
                        },
                        indices: OnceLock(
                            <uninit>,
                        ),
                        slices: OnceLock(
                            <uninit>,
                        ),
                        true_count: 9,
                        density: 0.75,
                    },
                ),
            ),
            Array(
                DecimalArray {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    values: Buffer<u8> {
                        length: 384,
                        alignment: Alignment(
                            16,
                        ),
                        as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                    },
                    values_type: I256,
                    validity: Array(
                        BoolArray {
                            dtype: Bool(
                                NonNullable,
                            ),
                            bits: BitBuffer {
                                buffer: Buffer<u8> {
                                    length: 2,
                                    alignment: Alignment(
                                        1,
                                    ),
                                    as_slice: [7, 240],
                                },
                                offset: 0,
                                len: 12,
                            },
                            validity: NonNullable,
                            stats_set: ArrayStats {
                                inner: RwLock {
                                    data: StatsSet {
                                        values: [
                                            (
                                                Sum,
                                                Exact(
                                                    ScalarValue(
                                                        Primitive(
                                                            U64(
                                                                3,
                                                            ),
                                                        ),
                                                    ),
                                                ),
                                            ),
                                        ],
                                    },
                                },
                            },
                        },
                    ),
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [],
                            },
                        },
                    },
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    10335731459288881875449326843340756734051447447459996202947475384727173595149,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
    ],
}

Occurrence Details

• Crash File: crash-0d8aeb14963da4afc4401079e49875e553965561
• Branch: develop
• Commit: c7b0ef9
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/20472062659/artifacts/4956871043

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-0d8aeb14963da4afc4401079e49875e553965561 -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis