Open catenacyber opened 2 years ago
@nigeltao @robpike image/png is choking on fuzz, not sure what's the best plan here.
"Decoding some (possibly valid) PNGs can require a lot of memory" is a duplicate of #53778 (which is itself arguably a duplicate of #5050).
If we wanted image/png
(in the standard library, obviously) to catch out-of-memory panics and convert them to a nicer error
, then we'd probably want a number of stdlib packages to do similarly, which sounds like a broader discussion (maybe on the golang-dev
mailing list??).
The problem is not a out of memory here, it is panic: runtime error: makeslice: len out of range
;-)
@nigeltao The general goal here is #47653.
We can discuss the general issue on golang-dev if you like.
What version of Go are you using (
go version
)?Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (
go env
)?go env
OutputWhat did you do?
Run https://go.dev/play/p/JNfieKSukyI?v=gotip
What did you expect to see?
The program finishing and printing Hello with an appropriate error
What did you see instead?
Found by https://github.com/catenacyber/ngolo-fuzzing on oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50234
I know that the result of DecodeConfig should be checked before calling Decode, but I think that in this case, the error should be a bit nicer