yuin / goldmark

:trophy: A markdown parser written in Go. Easy to extend, standard(CommonMark) compliant, well structured.
MIT License
3.68k stars 255 forks source link

Fuzz crash on "0000000000000000000000000000000000000\n:\t```\n\t\t0" #213

Closed chibataiki closed 3 years ago

chibataiki commented 3 years ago

goldmark has https://github.com/yuin/goldmark/discussions in github. You should post only issues here. Feature requests and questions should be posted at discussions.

Please answer the following before submitting your issue:

  1. What version of goldmark are you using? : 1.3.3
  2. What version of Go are you using? : go1.13.8
  3. What operating system and processor architecture are you using? : ubuntu 20.04 amd64
  4. What did you do? : make fuzz
  5. What did you expect to see? : fine
  6. What did you see instead? :
goldmark/fuzz/crashers ‹master*› » cat 026e3dc9902bf39a6aba2a3c13b668f3ddf0fa32.quoted
    "00000000000000000000" +
    "00000000000000000\n:\t" +
    "```\n\t\t0"
cat 026e3dc9902bf39a6aba2a3c13b668f3ddf0fa32.output
panic: runtime error: slice bounds out of range [49:47]

goroutine 1 [running]:
github.com/yuin/goldmark/text.(*Segment).Value(0xc0002839f0, 0x7f192c2bb000, 0x2f, 0x2f, 0xc000013a08, 0x61f96c, 0xc0002a3038)
    /home/fuzz_target_go/goldmark/text/segment.go:48 +0x32d
github.com/yuin/goldmark/renderer/html.(*Renderer).writeLines(0xc0002a0200, 0x71c8a0, 0xc0001ff900, 0x7f192c2bb000, 0x2f, 0x2f, 0x71dd60, 0xc0002863c0)
    /home/fuzz_target_go/goldmark/renderer/html/html.go:193 +0x113
github.com/yuin/goldmark/renderer/html.(*Renderer).renderFencedCodeBlock(0xc0002a0200, 0x71c8a0, 0xc0001ff900, 0x7f192c2bb000, 0x2f, 0x2f, 0x71dd60, 0xc0002863c0, 0x1, 0xc000283b38, ...)
    /home/fuzz_target_go/goldmark/renderer/html/html.go:285 +0x19d
github.com/yuin/goldmark/renderer.(*renderer).Render.func2(0x71dd60, 0xc0002863c0, 0x1, 0x0, 0x0, 0x71c8a0)
    /home/fuzz_target_go/goldmark/renderer/renderer.go:166 +0x16a
github.com/yuin/goldmark/ast.walkHelper(0x71dd60, 0xc0002863c0, 0xc000283d28, 0x3, 0x0, 0x0)
    /home/fuzz_target_go/goldmark/ast/ast.go:492 +0x5b
github.com/yuin/goldmark/ast.walkHelper(0x71ec00, 0xc000200ea0, 0xc000283d28, 0x3, 0x0, 0x0)
    /home/fuzz_target_go/goldmark/ast/ast.go:498 +0x175
github.com/yuin/goldmark/ast.walkHelper(0x71ed20, 0xc000200e10, 0xc000283d28, 0x3, 0x0, 0x0)
    /home/fuzz_target_go/goldmark/ast/ast.go:498 +0x175
github.com/yuin/goldmark/ast.walkHelper(0x71db20, 0xc000200d80, 0xc000283d28, 0xc0001ff900, 0x0, 0xc000200d00)
    /home/fuzz_target_go/goldmark/ast/ast.go:498 +0x175
github.com/yuin/goldmark/ast.Walk(...)
    /home/fuzz_target_go/goldmark/ast/ast.go:487
github.com/yuin/goldmark/renderer.(*renderer).Render(0xc00013ca50, 0x71a020, 0xc00029a720, 0x7f192c2bb000, 0x2f, 0x2f, 0x71db20, 0xc000200d80, 0xc00013ca01, 0xc00029a720)
    /home/fuzz_target_go/goldmark/renderer/renderer.go:161 +0x1ac
github.com/yuin/goldmark.(*markdown).Convert(0xc0001ff340, 0x7f192c2bb000, 0x2f, 0x2f, 0x71a020, 0xc00029a720, 0x0, 0x0, 0x0, 0x9, ...)
    /home/fuzz_target_go/goldmark/markdown.go:117 +0xfb
github.com/yuin/goldmark/fuzz.Fuzz(0x7f192c2bb000, 0x2f, 0x2f, 0x3)
    /home/fuzz_target_go/goldmark/fuzz/fuzz.go:34 +0x43a
go-fuzz-dep.Main(0xc000283f48, 0x1, 0x1)
    go-fuzz-dep/main.go:36 +0x1ad
main.main()
    github.com/yuin/goldmark/fuzz/go.fuzz.main/main.go:15 +0x52
exit status 2%
  1. Did you confirm your output is different from CommonMark online demo or other official renderer correspond with an extension?: yes