title: Panic when parsing invalid messages in google.golang.org/protobuf
description: Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
problem types: CWE-125: Out-of-bounds Read
affected:
{
vendor: google.golang.org/protobuf
product: google.golang.org/protobuf/encoding/prototext
collectionURL: https://pkg.go.dev
packageName: google.golang.org/protobuf/encoding/prototext
versions:
version: 1.29.0, lessThan: 1.29.1, status: affected, versionType: semver
programRoutines:
name: UnmarshalOptions.unmarshal
name: Unmarshal
name: UnmarshalOptions.Unmarshal
defaultStatus: unaffected
}
{
vendor: google.golang.org/protobuf
product: google.golang.org/protobuf/internal/encoding/text
collectionURL: https://pkg.go.dev
packageName: google.golang.org/protobuf/internal/encoding/text
versions:
version: 1.29.0, lessThan: 1.29.1, status: affected, versionType: semver
programRoutines:
name: parseNumber
name: Decoder.Peek
name: Decoder.Read
defaultStatus: unaffected
}
