goccy / go-yaml

YAML support for the Go language
MIT License
1.12k stars 129 forks source link

Fuzz `yaml.Unmarshal` #466

Open mx-psi opened 1 month ago

mx-psi commented 1 month ago

Is your feature request related to a problem? Please describe.

On issues like #439, #373 and #191 we can see this library has some panics on invalid data. I would like the library to never panic during unmarshaling and instead return an error.

Describe the solution you'd like

Fix existing panics (that can be tracked in their respective issues), add Go fuzzing targets for yaml.Unmarshal that tries to find instances where the library panics.

Describe alternatives you've considered

None really, I don't think this library is usable for certain use cases unless it can safely handle arbitrary data.