bug(stat): Parser Edge Cases (--format option) (Fuzzing Part 1)

Closed

#15,348 opened on Oct 14, 2026 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@Franklin-Qi is already working on this.

Since Oct 16, 2026.

#15352 by @ozenyunus35 — closed without merging
#15411 by @Franklin-Qi — open

Assessment

Difficulty: 3/5
Estimated time: Half a day
Newbie friendliness: 22/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Active
Tech stack: rust
Domain: cli

Research direction

Start by reproducing the stat --format cases in the issue against the built binary and comparing them with GNU stat's invalid directive errors. Pull request #15352 is already open against this issue, so read it first to see what it covers. Done means the malformed directives in the report fail with an invalid-directive error like GNU's, and the reproduction cases match GNU output.

Written by the indexing model from the issue text.

Description

U - stat

Hi, uutils mainteners, i hope everything good

we fuzzed the stat parser for edge cases via manual fuzzing ourselves and we discovered as for now one edge case

relunsec@relunsec:~/software/coreutils/target/debug$ ./stat --format='%++-+%1212x' /
?1212x
relunsec@relunsec:~/software/coreutils/target/debug$ gnustat --format='%++-+%1212x' /
gnustat: ‘%++-+%’: invalid directive
relunsec@relunsec:~/software/coreutils/target/debug$

same for

relunsec@relunsec:~/software/coreutils/target/debug$ ./stat --format=$'%++-+-s%1212x' / 
+28                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         2026-10-14 04:31:58.902392402 -0400
relunsec@relunsec:~/software/coreutils/target/debug$ gnustat --format=$'%++-+-s%1212x' / 
28                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         2026-10-14 04:31:58.902392402 -0400
relunsec@relunsec:~/software/coreutils/target/debug$

also we discovered

relunsec@relunsec:~/software/coreutils/target/debug$ ./stat --format=$'%+-%%ss%1212x' / 
?28s                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         2026-10-14 04:31:58.902392402 -0400
relunsec@relunsec:~/software/coreutils/target/debug$ gnustat --format=$'%+-%%ss%1212x' / 
gnustat: ‘%+-%’: invalid directive
relunsec@relunsec:~/software/coreutils/target/debug$

can be with just

same as

relunsec@relunsec:~/software/coreutils/target/debug$ ./stat --format=$'%s%0%%' / 
28?%
relunsec@relunsec:~/software/coreutils/target/debug$ gnustat --format=$'%s%0%%' / 
28gnustat: ‘%0%’: invalid directive
relunsec@relunsec:~/software/coreutils/target/debug$

relunsec@relunsec:~/software/coreutils/target/debug$ ./stat --format=$'%-%s1212x' / 
?s1212x
relunsec@relunsec:~/software/coreutils/target/debug$ gnustat --format=$'%-%s1212x' / 
gnustat: ‘%-%’: invalid directive
relunsec@relunsec:~/software/coreutils/target/debug$

reproduces this issue
seems similar as below but with different input

same as

relunsec@relunsec:~/software/coreutils/target/debug$ ./stat --format '%#%d' --file-system /
?d
relunsec@relunsec:~/software/coreutils/target/debug$ gnustat --format '%#%d' --file-system /
gnustat: ‘%#%’: invalid directive

as i see gnu errors out, uutils no for invalid directive

and then same for

relunsec@relunsec:~/software/coreutils/target/debug$ ./stat --format '%s%#%#b' --file-system /
131072?#b
relunsec@relunsec:~/software/coreutils/target/debug$ gnustat --format '%s%#%#b' --file-system /
131072gnustat: ‘%#%’: invalid directive
relunsec@relunsec:~/software/coreutils/target/debug$

Dominant language: Rust
Stars: 24.3k
Forks: 2.1k
Avg merge: 1d 16h
Merged PRs (30d): 310

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

No Dockerfile or Docker Compose file
No pull request template
Read the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

More from uutils/coreutils

minorbug(mv): invalid mode errors not quoted
Possibly taken @henrimarconni claimed this 2 days ago. Open
- Is something wrong?
U - mv

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

uutils/coreutils#15350 · Opened Oct 14, 2026

Maintainers usually reply within 1 day
ptx: break file missing path in error message
Possibly taken @Franklin-Qi claimed this 2 days ago. Open
- Is something wrong?
U - ptx

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

uutils/coreutils#15307 · 1 comment · Opened Oct 13, 2026

Maintainers usually reply within 1 day
minorbug(stat): os errno not stripped when failing to flush stdout
Possibly taken @cestercian claimed this 9 days ago. Open
- Is something wrong?
U - stat

Difficulty 2/5 1-3 hours Newbie friendliness 67/100

uutils/coreutils#15200 · 3 comments · Opened Oct 8, 2026

Maintainers usually reply within 1 day
stty: support B460800 and B921600 baud rates
Possibly taken @oech3 claimed this 4 days ago. Open
- Is something wrong?
awaiting upstream U - stty

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

uutils/coreutils#14989 · Opened Sep 30, 2026

Maintainers usually reply within 1 day
du_all_wide_tree benchmark has high variance
Open
- Is something wrong?
B - high priority U - du

Difficulty 1/5 Under an hour Newbie friendliness 82/100

uutils/coreutils#14984 · 1 comment · Opened Sep 30, 2026

Maintainers usually reply within 1 day

All issues in uutils/coreutils

Similar issues

The book has a Nix install section that chelis.ch lacks, and it names two of the three systems
Open
- Is something wrong?
area:ecosystem documentation

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

Chelis-Lang/chelis#3866 · Opened Oct 18, 2026

Maintainers usually reply within 1 day
Commit 9caa2a17 says it adds `docs/261`, but the tree has no such file — and `docs/250` still says its criteria are pending
Open
- Is something wrong?
bug documentation sev-0

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

FujoJTOP/loment#725 · Opened Oct 18, 2026
SignalStream::filter adopts the new owner from any NameOwnerChanged-shaped signal, without checking its sender or name
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 86/100

z-galaxy/zbus#2063 · Opened Oct 18, 2026

Maintainers usually reply within 1 day
fix(output): Code Climate bands negative MI as minor
Open
- Is something wrong?
bug

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

dekobon/big-code-analysis#1620 · Opened Oct 18, 2026

Maintainers usually reply within 3 days
outram-mc-libs: correlated_angle_vs_openmc fails (not skips) in a worktree without reference-data/ace
Open
- Is something wrong?
bug

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

theodoreOnzGit/outram-park-backend#956 · Opened Oct 18, 2026

More Rust issues

bug(stat): Parser Edge Cases (--format option) (Fuzzing Part 1)

Is something wrong?

Assessment

Research direction

Description

Getting set up

First steps

More from uutils/coreutils

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Similar issues

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Get new issues in your inbox