{"action":"closed","issue":{"url":"https://api.github.com/repos/francoispqt/gojay/issues/27","repository_url":"https://api.github.com/repos/francoispqt/gojay","labels_url":"https://api.github.com/repos/francoispqt/gojay/issues/27/labels{/name}","comments_url":"https://api.github.com/repos/francoispqt/gojay/issues/27/comments","events_url":"https://api.github.com/repos/francoispqt/gojay/issues/27/events","html_url":"https://github.com/francoispqt/gojay/issues/27","id":324745934,"number":27,"title":"Panic on malformed integers","user":{"login":"stevenjohnstone","id":6546704,"avatar_url":"https://avatars1.githubusercontent.com/u/6546704?v=4","gravatar_id":"","url":"https://api.github.com/users/stevenjohnstone","html_url":"https://github.com/stevenjohnstone","followers_url":"https://api.github.com/users/stevenjohnstone/followers","following_url":"https://api.github.com/users/stevenjohnstone/following{/other_user}","gists_url":"https://api.github.com/users/stevenjohnstone/gists{/gist_id}","starred_url":"https://api.github.com/users/stevenjohnstone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevenjohnstone/subscriptions","organizations_url":"https://api.github.com/users/stevenjohnstone/orgs","repos_url":"https://api.github.com/users/stevenjohnstone/repos","events_url":"https://api.github.com/users/stevenjohnstone/events{/privacy}","received_events_url":"https://api.github.com/users/stevenjohnstone/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-05-20T21:55:12Z","updated_at":"2018-05-21T15:55:42Z","closed_at":"2018-05-21T15:55:42Z","author_association":"NONE","body":"Ran go-fuzz with the following fuzzer (based on an example in the README):\r\n```\r\npackage fuzz\r\n\r\nimport (\r\n\t\"github.com/francoispqt/gojay\"\r\n)\r\n\r\ntype user struct {\r\n\tid    int\r\n\tname  string\r\n\temail string\r\n}\r\n\r\n// implement gojay.UnmarshalerJSONObject\r\nfunc (u *user) UnmarshalJSONObject(dec *gojay.Decoder, key string) error {\r\n\tswitch key {\r\n\tcase \"id\":\r\n\t\treturn dec.Int(&u.id)\r\n\tcase \"name\":\r\n\t\treturn dec.String(&u.name)\r\n\tcase \"email\":\r\n\t\treturn dec.String(&u.email)\r\n\t}\r\n\treturn nil\r\n}\r\nfunc (u *user) NKeys() int {\r\n\treturn 3\r\n}\r\n\r\nfunc Fuzz(input []byte) int {\r\n\tu := &user{}\r\n\terr := gojay.UnmarshalJSONObject(input, u)\r\n\tif err != nil {\r\n\t\treturn 0\r\n\t}\r\n\treturn 1\r\n}\r\n```\r\n\r\nThis is meant to reflect a deployment where the input JSON comes from an untrusted source.\r\n\r\nAfter a few minutes, the fuzzer found issues like the following:\r\nthis\r\n```\r\n{\\\"id\\\":0.E----\r\n```\r\ncauses\r\n```\r\npanic: runtime error: index out of range\r\n\r\ngoroutine 1 [running]:\r\ngithub.com/francoispqt/gojay.(*Decoder).atoi64(0xc42005a060, 0xc, 0xc, 0x0)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode_number_int.go:673 +0x485\r\ngithub.com/francoispqt/gojay.(*Decoder).getExponent(0xc42005a060, 0x0)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode_number.go:105 +0x260\r\ngithub.com/francoispqt/gojay.(*Decoder).getExponent(0xc42005a060, 0x0)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode_number.go:91 +0x1ab\r\ngithub.com/francoispqt/gojay.(*Decoder).getExponent(0xc42005a060, 0x568880)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode_number.go:91 +0x1ab\r\ngithub.com/francoispqt/gojay.(*Decoder).getExponent(0xc42005a060, 0x8)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode_number.go:91 +0x1ab\r\ngithub.com/francoispqt/gojay.(*Decoder).getInt64(0xc42005a060, 0x300000030, 0xc420000180, 0xc420047d80, 0x42f089)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode_number_int.go:611 +0x618\r\ngithub.com/francoispqt/gojay.(*Decoder).decodeInt(0xc42005a060, 0xc42007a750, 0x5, 0x0)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode_number_int.go:24 +0x4d1\r\ngithub.com/francoispqt/gojay.(*Decoder).Int(0xc42005a060, 0xc42007a750, 0x2, 0xa)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode.go:332 +0x51\r\ngithub.com/francoispqt/gojay/fuzz.(*user).UnmarshalJSONObject(0xc42007a750, 0xc42005a060, 0xc4200140e2, 0x2, 0x0, 0x0)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/fuzz/fuzz.go:17 +0x1a2\r\ngithub.com/francoispqt/gojay.(*Decoder).decodeObject(0xc42005a060, 0x4f54a0, 0xc42007a750, 0xc4200140e0, 0xc, 0xc)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode_object.go:58 +0x6df\r\ngithub.com/francoispqt/gojay.UnmarshalJSONObject(0x7f54c5bc5000, 0xc, 0x200000, 0x4f54a0, 0xc42007a750, 0x0, 0x0)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/decode.go:43 +0x128\r\ngithub.com/francoispqt/gojay/fuzz.Fuzz(0x7f54c5bc5000, 0xc, 0x200000, 0x4ac3e7)\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/fuzz/fuzz.go:31 +0x81\r\ngo-fuzz-dep.Main(0x4e9598)\r\n\t/tmp/go-fuzz-build108984608/goroot/src/go-fuzz-dep/main.go:49 +0xad\r\nmain.main()\r\n\t/tmp/go-fuzz-build108984608/gopath/src/github.com/francoispqt/gojay/fuzz/go.fuzz.main/main.go:10 +0x2d\r\n\r\n```\r\n\r\nThe problem here seems to be Decoder's Int() method isn't robust against this input? I'd expect the method to fail with a error indicating that the input isn't a well-formed string representation of an integer."}}
{"actor":{"display_login":"francoispqt"}}