Input Causes Panic: t"\400n"{}
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 657
- Avg merge
- 20h 36m
- Merged PRs (30d)
- 6
Description
I've found a crashing input in HCL as of d7400db7143f8e869812e50a53acd6c8d92af3b8. Here's an [SSCCE](http://www.sscce.org/) demonstrating the problem.
``` go
package main
import (
"github.com/hashicorp/hcl"
)
var (
data = "t\"\\400n\"{}"
)
func main() {
var out interface{}
hcl.Unmarshal([]byte(data), &out)
}
```
When run, this gives the following output:
```
panic: unquote "\400n" err: invalid syntax
goroutine 1 [running]:
panic(0x19b960, 0xc82000a5f0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/runtime/panic.go:481 +0x3e6
github.com/hashicorp/hcl/hcl/token.Token.Value(0x9, 0x0, 0x0, 0x1, 0x1, 0x2, 0xc82000a3b0, 0x7, 0x0, 0x0, ...)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/hcl/token/token.go:157 +0xc1c
github.com/hashicorp/hcl.(*decoder).decodeMap(0xc82008dd60, 0xc82000a5b0, 0x9, 0x3871c0, 0xc8200103e0, 0x19b160, 0xc82002e048, 0x195, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:349 +0x13e6
github.com/hashicorp/hcl.(*decoder).decode(0xc82008dd60, 0xc82000a5b0, 0x9, 0x3872f0, 0xc82005c180, 0x19b160, 0xc82002e048, 0x195, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:100 +0xcc6
github.com/hashicorp/hcl.(*decoder).decodeSlice(0xc82008dd60, 0xc82000a540, 0x6, 0x3871c0, 0xc8200102e0, 0x192ec0, 0xc820010360, 0x97, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:446 +0x7b1
github.com/hashicorp/hcl.(*decoder).decode(0xc82008dd60, 0xc82000a540, 0x6, 0x3871c0, 0xc8200102e0, 0x19a5a0, 0xc82000a560, 0x194, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:104 +0xe16
github.com/hashicorp/hcl.(*decoder).decodeInterface(0xc82008dd60, 0xc82000a540, 0x6, 0x3871c0, 0xc8200102e0, 0x19a5a0, 0xc82000a560, 0x194, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:284 +0x6de
github.com/hashicorp/hcl.(*decoder).decode(0xc82008dd60, 0xc82000a540, 0x6, 0x3871c0, 0xc8200102e0, 0x19a5a0, 0xc82000a560, 0x194, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:98 +0xc14
github.com/hashicorp/hcl.(*decoder).decodeMap(0xc82008dd60, 0x1fc790, 0x4, 0x3871c0, 0xc820010260, 0x19b160, 0xc820012360, 0x15, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:378 +0x1b91
github.com/hashicorp/hcl.(*decoder).decode(0xc82008dd60, 0x1fc790, 0x4, 0x3871c0, 0xc820010260, 0x19a5a0, 0xc82000a340, 0x194, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:100 +0xcc6
github.com/hashicorp/hcl.(*decoder).decodeInterface(0xc82008dd60, 0x1fc790, 0x4, 0x3871c0, 0xc820010260, 0x19a5a0, 0xc82000a340, 0x194, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:284 +0x6de
github.com/hashicorp/hcl.(*decoder).decode(0xc82008dd60, 0x1fc790, 0x4, 0x3871c0, 0xc820010260, 0x19a5a0, 0xc82000a340, 0x194, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:98 +0xc14
github.com/hashicorp/hcl.DecodeObject(0x18d2e0, 0xc82000a340, 0x3871c0, 0xc820010260, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:60 +0x409
github.com/hashicorp/hcl.Unmarshal(0x3d3000, 0xa, 0x200000, 0x18d2e0, 0xc82000a340, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/hashicorp/hcl/decoder.go:32 +0x192
github.com/BrianHicks/fuzz-hcl.ParseSafely(0x3d3000, 0xa, 0x200000, 0x0, 0x0, 0x0, 0x0)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/BrianHicks/fuzz-hcl/fuzz.go:20 +0xc1
github.com/BrianHicks/fuzz-hcl.Fuzz(0x3d3000, 0xa, 0x200000, 0xc82005c058)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/github.com/BrianHicks/fuzz-hcl/fuzz.go:11 +0x105
go-fuzz-dep.Main(0x23a3e8)
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/go-fuzz-dep/main.go:49 +0x14c
main.main()
/var/folders/f6/l26tk3xs5pjczcd5k5pcrmk00000gn/T/go-fuzz-build846495901/src/go.fuzz.main/main.go:10 +0x23
exit status 2
```
(and here it is when run through panicparse, for convenience)
```
panic: unquote "\400n" err: invalid syntax
exit status 2
To see all goroutines, visit https://github.com/maruel/panicparse#GOTRACEBACK
1: running
panic.go:481 panic(0x19b960, 0xc82000a5f0)
token token.go:157 Token.Value(0x9, 0, 0, 0x1, 0x1, 0x2, 0xc82000a3b0, 0x7, 0, 0, ...)
hcl decoder.go:349 (*decoder).decodeMap(#8, #4, 0x9, 0x3871c0, 0xc8200103e0, 0x19b160, #7, 0x195, 0, 0)
hcl decoder.go:100 (*decoder).decode(#8, #4, 0x9, 0x3872f0, 0xc82005c180, 0x19b160, #7, 0x195, 0, 0)
hcl decoder.go:446 (*decoder).decodeSlice(#8, #2, 0x6, 0x3871c0, #6, 0x192ec0, 0xc820010360, 0x97, 0, 0)
hcl decoder.go:104 (*decoder).decode(#8, #2, 0x6, 0x3871c0, #6, 0x19a5a0, #3, 0x194, 0, 0)
hcl decoder.go:284 (*decoder).decodeInterface(#8, #2, 0x6, 0x3871c0, #6, 0x19a5a0, #3, 0x194, 0, 0)
hcl decoder.go:98 (*decoder).decode(#8, #2, 0x6, 0x3871c0, #6, 0x19a5a0, #3, 0x194, 0, 0)
hcl decoder.go:378 (*decoder).decodeMap(#8, 0x1fc790, 0x4, 0x3871c0, #5, 0x19b160, 0xc820012360, 0x15, 0, 0)
hcl decoder.go:100 (*decoder).decode(#8, 0x1fc790, 0x4, 0x3871c0, #5, 0x19a5a0, #1, 0x194, 0, 0)
hcl decoder.go:284 (*decoder).decodeInterface(#8, 0x1fc790, 0x4, 0x3871c0, #5, 0x19a5a0, #1, 0x194, 0, 0)
hcl decoder.go:98 (*decoder).decode(#8, 0x1fc790, 0x4, 0x3871c0, #5, 0x19a5a0, #1, 0x194, 0, 0)
hcl decoder.go:60 DecodeObject(0x18d2e0, #1, 0x3871c0, #5, 0, 0)
hcl decoder.go:32 Unmarshal(0x3d3000, 0xa, 0x200000, 0x18d2e0, #1, 0, 0)
fuzz-hcl fuzz.go:20 ParseSafely(0x3d3000, 0xa, 0x200000, 0, 0, 0, 0)
fuzz-hcl fuzz.go:11 Fuzz(0x3d3000, 0xa, 0x200000, 0xc82005c058)
go-fuzz-dep main.go:49 Main(0x23a3e8)
main main.go:10 main()
```
Other inputs that create this same panic: https://gist.github.com/d4ce303aef94ae0036a17502189a7e63
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.