Panic: `index out of range [0] with length 0`

[rgmz]

This was discovered while using rardecode > mholt/archiver > trufflehog.

The problematic line is below, although the reason for the failure is unclear.

https://github.com/nwaples/rardecode/blob/434b4a38896d211779c5cc5e5933c9da424a5a21/ppm_model.go#L453

panic: runtime error: index out of range [0] with length 0

goroutine 2147 [running]:
github.com/nwaples/rardecode/v2.(*subAllocator).contextSetNumStates(...)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/ppm_model.go:453
github.com/nwaples/rardecode/v2.(*subAllocator).newContextSize(0xc0020b6050, 0x100)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/ppm_model.go:444 +0xda
github.com/nwaples/rardecode/v2.(*model).restart(0xc0020b6008)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/ppm_model.go:583 +0x125
github.com/nwaples/rardecode/v2.(*model).ReadByte(0xc0020b6008)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/ppm_model.go:1030 +0x25
github.com/nwaples/rardecode/v2.(*ppm29Decoder).fill(0xc0020b6008, 0xc0020b4000)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/decode29_ppm.go:93 +0x3f
github.com/nwaples/rardecode/v2.(*decoder29).fill(0xc0020a0360, 0xc0020b4000)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/decode29.go:239 +0x85
github.com/nwaples/rardecode/v2.(*decodeReader).fill(0xc0020b4000)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/decode_reader.go:188 +0x7e
github.com/nwaples/rardecode/v2.(*decodeReader).bytes(0xc0020b4000)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/decode_reader.go:255 +0x2e
github.com/nwaples/rardecode/v2.(*limitedReader).bytes(0xc0020a27e0)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/reader.go:269 +0x23
github.com/nwaples/rardecode/v2.(*checksumReader).bytes(0xc0020a2810)
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/reader.go:319 +0x27
github.com/nwaples/rardecode/v2.(*Reader).WriteTo(0xc001d38820, {0x470c660, 0xc00117ef80})
        /home/user/go/pkg/mod/github.com/nwaples/rardecode/v2@v2.0.0-beta.2/reader.go:358 +0x46
io.nopCloserWriterTo.WriteTo(...)
        /home/user/sdk/go1.22.1/src/io/io.go:702
io.copyBuffer({0x470c660, 0xc00117ef80}, {0x7f527436c158, 0xc001120bc0}, {0x0, 0x0, 0x0})
        /home/user/sdk/go1.22.1/src/io/io.go:411 +0x9d
io.Copy(...)
        /home/user/sdk/go1.22.1/src/io/io.go:388
github.com/trufflesecurity/trufflehog/v3/pkg/writers/buffered_file_writer.NewFromReader({0x7f527436c158, 0xc001120bc0}, {0x0, 0x411d3f?, 0x0})
        /tmp/trufflehog/pkg/writers/buffered_file_writer/bufferedfilewriter.go:125 +0xf1
github.com/trufflesecurity/trufflehog/v3/pkg/readers.NewBufferedFileReader({0x7f527436c158?, 0xc001120bc0?})
        /tmp/trufflehog/pkg/readers/bufferedfilereader.go:27 +0x28
github.com/trufflesecurity/trufflehog/v3/pkg/handlers.newFileReader({0xc0014a40b0, 0x9}, {0x4715ff0?, 0xc001120bc0?})
        /tmp/trufflehog/pkg/handlers/handlers.go:52 +0xfb
github.com/trufflesecurity/trufflehog/v3/pkg/handlers.(*archiveHandler).openArchive.(*archiveHandler).extractorHandler.func1({0x7f52647e15d0, 0xc001e94240}, {{0x473fc28, 0xc0001c4aa0}, {0x36585c0, 0xc0001c4aa0}, {0xc0014a40b0, 0x9}, {0x0, 0x0}, ...})
        /tmp/trufflehog/pkg/handlers/archive.go:196 +0x645
github.com/mholt/archiver/v4.Rar.Extract({0xe0?, {0x0?, 0x3809980?}}, {0x7f52647e15d0, 0xc001e94240}, {0x4702b00?, 0xc0011b6030?}, {0x0, 0x0, 0x0}, ...)
        /home/user/go/pkg/mod/github.com/mholt/archiver/v4@v4.0.0-alpha.8/rar.go:108 +0x49c
github.com/trufflesecurity/trufflehog/v3/pkg/handlers.(*archiveHandler).openArchive(0xc0014a6038, {0x473b5e0, 0xc001e941b0}, 0x0, {{0x4717b28, 0xc002a1e660}, {0x3cca2c5, 0x4}, 0xc0011b6030, 0x1}, ...)
        /tmp/trufflehog/pkg/handlers/archive.go:98 +0x926
github.com/trufflesecurity/trufflehog/v3/pkg/handlers.(*archiveHandler).HandleFile.func1()
        /tmp/trufflehog/pkg/handlers/archive.go:65 +0x1ac
created by github.com/trufflesecurity/trufflehog/v3/pkg/handlers.(*archiveHandler).HandleFile in goroutine 2146
        /tmp/trufflehog/pkg/handlers/archive.go:51 +0xfb

Reproducers

This can be reproduced with the following files:

• https://github.com/microsoft/RecursiveExtractor/blob/8084d0f24331e13fbc175ee9fdf14537e9901cb8/RecursiveExtractor.Tests/TestData/TestDataArchives/EncryptedWithPlainNames.rar4
• https://github.com/operasoftware/desktop/blob/1ee5113/lgpl/sources/chromium/src/chrome/test/data/safe_browsing/rar/passwd.rar

[davidnewhall]

A number of bugs and panics were fixed in master but not in the experimental branch. Suggest trying that instead.

[nwaples]

I think I fixed the bug. I can decode the first file. The second im unsure what the password is, but it no longer panics. Ive tagged a new beta.

[rgmz]

Thanks @nwaples, I'll check it out.

I'm not sure what the password is for the second file. It's a public test file so I'll see if I can locate it, and if the issue can still be reproduced.