Skip to content

fix(labels): decode non-ASCII identifiers in Rust v0 symbols - #252

Open
r0ny123 wants to merge 1 commit into
danielplohmann:masterfrom
r0ny123:fix/rust-demangle-punycode
Open

fix(labels): decode non-ASCII identifiers in Rust v0 symbols#252
r0ny123 wants to merge 1 commit into
danielplohmann:masterfrom
r0ny123:fix/rust-demangle-punycode

Conversation

@r0ny123

@r0ny123 r0ny123 commented Aug 15, 2026

Copy link
Copy Markdown
Contributor

Fixes #251.

A Rust v0 symbol carrying a punycode-encoded identifier came back with a placeholder where the identifier should be:

_RNqCs4fqI2P2rA04_11utf8_identsu30____7hkackfecea1cbdathfdh9hlq6y

before : utf8_idents::punycode{__-7hkackfecea1cbdathfdh9hlq6y}
after  : utf8_idents::საჭმელად_გემრიელი_სადილი

That is worse than leaving the symbol mangled, because the reported name matches neither the mangled spelling nor the real one, so it cannot be looked up either way.

Root cause

The decoder was never broken. Running it on that identifier fills its output buffer with the correct text — the failure is purely in how it reports having done so.

punycode_decode() leaves its loop through a bare return when the input is exhausted, which yields None. Each of its seven failure paths also returns None. try_small_punycode_decode() then tests if r is None and cannot distinguish a completed decode from a rejected one, so every decode — successful or not — took the placeholder branch in Ident.display().

The -> Optional[None] annotation says the same thing in the signature: the function had no way to express success.

The fix is to return True on completion and widen the annotation. A decode that genuinely fails still falls back to the placeholder, which now has its own test so the fallback is not lost to a later simplification.

A second defect the fix made reachable

While every decode was being discarded, a second divergence from the reference was unobservable: the code point is built with chr(), which accepts the surrogate range U+D800..U+DFFF, where Rust's char::from_u32 refuses it. _RNvCu4_ib9b4main decoded to a name holding a lone surrogate, and such a name cannot be encoded as UTF-8 by whatever consumes the report — SmdaReport itself survives because json.dumps escapes it, but the name is handed to every downstream consumer as a str.

Non-scalar values are now rejected explicitly, and the fuzz target encodes every result it gets so the class stays closed rather than resting on this one case.

Scope of the sweep

The class is a success path returning the value the failure paths use as their sentinel. An AST pass over src/smda/** for functions mixing a bare return with an explicit return None finds no other instance, and no other Optional[None] annotation remains in the tree.

Validation

Cross-checked against the 18 mangled symbols in rustc-demangle 0.1.28's own test corpus:

before after
match exactly 8 9
raise, keeping the mangled name 9 9
disagree 1 0

The nine that raise are the #[splat] grammar, which this port does not implement; raising is the safe outcome there, since the caller then keeps the name the binary gave it.

Separately, on 147 real _R symbols read out of a rust-lld/MSVC x64 image, 146 match the reference byte for byte and the remaining one is the unrelated ABI spacing bug fixed in #249 — nothing regressed here.

python -m pytest tests/ -q                  1184 passed, 1 skipped
make lint                                   clean
make typecheck                              exit 0, no new diagnostics

Independent of #249; the two touch different parts of the same file and both are needed for the output to match the reference exactly.

A v0 symbol carrying a punycode-encoded identifier was reported with a
placeholder in place of the identifier:

  utf8_idents::punycode{__-7hkackfecea1cbdathfdh9hlq6y}

rather than utf8_idents::<the Georgian text it encodes>. That is worse
than leaving the symbol mangled, because the reported name matches
neither the mangled spelling nor the real one.

The decoder was working the whole time. Its success path fell out of the
loop through a bare `return`, which yields None -- exactly what each of
its seven failure paths returns -- so the caller could not tell a
finished decode from a rejected one and always took the placeholder
branch. The `Optional[None]` return annotation records the same thing:
the function had no way to say that it had succeeded.

Return True on completion and widen the annotation. A decode that
genuinely fails still falls back to the placeholder, which is covered by
its own test.

Making the decoded text reachable also made a second defect reachable,
which had been unobservable while every decode was discarded: the code
point was built with chr(), which accepts the surrogate range, where
Rust's char::from_u32 refuses it. _RNvCu4_ib9b4main decoded to a name
holding U+D800, and a lone surrogate cannot be encoded as UTF-8 by
whatever consumes the report. Reject non-scalar values explicitly, and
have the fuzz target encode every result so the class stays closed.

A tree-wide sweep for the first defect -- a success path returning the
same value the failure paths use as their sentinel -- found no other
instance, and no other Optional[None] annotation remains.

Cross-checked against the 18 mangled symbols in rustc-demangle 0.1.28's
own test corpus: 9 now match exactly, 9 raise on the splat grammar this
port does not implement and so keep the name the binary gave them, and
none disagree.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rust v0: non-ASCII identifiers render as a punycode placeholder

1 participant