goccy / go-yaml

YAML support for the Go language
MIT License
1.18k stars 133 forks source link

Panics from fuzzing #540

Open bep opened 2 hours ago

bep commented 2 hours ago

This fuzz test could possibly be a starting point for #466:

package yaml_test

import (
    "strings"
    "testing"

    "github.com/goccy/go-yaml"
)

func FuzzUnmarshalToMap(f *testing.F) {
    const validYAML = `
id: 1
message: Hello, World
verified: true
`

    invalidYAML := []string{
        "0::",
        "{0",
        "*-0",
        ">\n>",
        "&{0",
        "0_",
        "0\n:",
        "0\n-",
        "0\n0",
        "0\n0\n",
        "0\n0\n0",
        "0\n0\n0\n",
        "0\n0\n0\n0",
        "0\n0\n0\n0\n",
        "0\n0\n0\n0\n0",
        "0\n0\n0\n0\n0\n",
        "0\n0\n0\n0\n0\n0",
        "0\n0\n0\n0\n0\n0\n",
        "",
    }

    f.Add([]byte(validYAML))
    for _, s := range invalidYAML {
        f.Add([]byte(s))
        f.Add([]byte(validYAML + s))
        f.Add([]byte(s + validYAML))
        f.Add([]byte(s + validYAML + s))
        f.Add([]byte(strings.Repeat(s, 3)))
    }

    f.Fuzz(func(t *testing.T, src []byte) {
        v := map[string]any{}
        _ = yaml.Unmarshal(src, &v)
    })
}

Some example panics:

---
# reflect.Value.SetMapIndex: value of type bool is not assignable to type string
true :
---
# reflect.Value.SetMapIndex: value of type float64 is not assignable to type string
10.:
---
# runtime error: invalid memory address or nil pointer dereference
{? {? 
---
# slice bounds out of range
|0#��0�����0�������0�������0�����0�����0��������������������0���������������0�����0�������0��0��������00����0�����������0�������������0����0����0���
���0����0����������
�������0���������0����������0�������0����������0����0��0����
������00����
���������0�����0��������0��������������������0����0��0���0�����0�����������������������00���������0���0����
---
# index out of range
>1
 ����
0
---
# reflect.Value.SetMapIndex: value of type map[string]interface {} is not assignable to type string
{? {jui�l��U4��7�{�K%�dv���(I�B�F�D����$���T�E}Yd�|��ѐ2�K�Y��eʞ���M��i}#BTx�]��{V[�1 �m��L�/�? {? {%
goccy commented 2 hours ago

@bep

Thank you for your reports ! I'm currently working on fixing the parser using the yaml-test-suite( ref #465 ). I will also incorporate this test case. Thank you !