Check well-formedness of data from MarshalCBOR

decode.go

@@ -790,9 +790,9 @@ func (dm *decMode) Unmarshal(data []byte, v interface{}) error {
 	d := decoder{data: data, dm: dm}
 
 	// Check well-formedness.
-	off := d.off               // Save offset before data validation
-	err := d.wellformed(false) // don't allow any extra data after valid data item.
-	d.off = off                // Restore offset
+	off := d.off                      // Save offset before data validation
+	err := d.wellformed(false, false) // don't allow any extra data after valid data item.
+	d.off = off                       // Restore offset
 	if err != nil {
 		return err
 	}
@@ -810,9 +810,9 @@ func (dm *decMode) UnmarshalFirst(data []byte, v interface{}) (rest []byte, err
 	d := decoder{data: data, dm: dm}
 
 	// check well-formedness.
-	off := d.off             // Save offset before data validation
-	err = d.wellformed(true) // allow extra data after well-formed data item
-	d.off = off              // Restore offset
+	off := d.off                    // Save offset before data validation
+	err = d.wellformed(true, false) // allow extra data after well-formed data item
+	d.off = off                     // Restore offset
 
 	// If it is well-formed, parse the value. This is structured like this to allow
 	// better test coverage
@@ -853,7 +853,7 @@ func (dm *decMode) Valid(data []byte) error {
 // an ExtraneousDataError is returned.
 func (dm *decMode) Wellformed(data []byte) error {
 	d := decoder{data: data, dm: dm}
-	return d.wellformed(false)
+	return d.wellformed(false, false)
 }
 
 // NewDecoder returns a new decoder that reads from r using dm DecMode.

diagnose.go

@@ -235,7 +235,7 @@ func (di *diagnose) diagFirst() (string, []byte, error) {
 
 func (di *diagnose) wellformed(allowExtraData bool) error {
 	off := di.d.off
-	err := di.d.wellformed(allowExtraData)
+	err := di.d.wellformed(allowExtraData, false)
 	di.d.off = off
 	return err
 }

encode.go

@@ -100,6 +100,23 @@ type Marshaler interface {
 	MarshalCBOR() ([]byte, error)
 }
 
+// MarshalerError represents error from checking encoded CBOR data item
+// returned from MarshalCBOR for well-formedness and some very limited tag validation.
+type MarshalerError struct {
+	typ reflect.Type
+	err error
+}
+
+func (e *MarshalerError) Error() string {
+	return "cbor: error calling MarshalCBOR for type " +
+		e.typ.String() +
+		": " + e.err.Error()
+}
+
+func (e *MarshalerError) Unwrap() error {
+	return e.err
+}
+
 // UnsupportedTypeError is returned by Marshal when attempting to encode value
 // of an unsupported type.
 type UnsupportedTypeError struct {
@@ -1345,6 +1362,14 @@ func encodeMarshalerType(e *encoderBuffer, em *encMode, v reflect.Value) error {
 	if err != nil {
 		return err
 	}
+
+	// Verify returned CBOR data item from MarshalCBOR() is well-formed and passes tag validity for builtin tags 0-3.
+	d := decoder{data: data, dm: defaultDecMode}
+	err = d.wellformed(false, true)
+	if err != nil {
+		return &MarshalerError{typ: v.Type(), err: err}
+	}
+
 	e.Write(data)
 	return nil
 }

encode_test.go

@@ -4183,3 +4183,103 @@ func TestMarshalFieldNameType(t *testing.T) {
 		})
 	}
 }
+
+func TestMarshalRawMessageContainingMalformedCBORData(t *testing.T) {
+	testCases := []struct {
+		name         string
+		value        interface{}
+		wantErrorMsg string
+	}{
+		// Nil RawMessage and empty RawMessage are encoded as CBOR nil.
+		{
+			name:         "truncated data",
+			value:        RawMessage{0xa6},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.RawMessage: unexpected EOF",
+		},
+		{
+			name:         "malformed data",
+			value:        RawMessage{0x1f},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.RawMessage: cbor: invalid additional information 31 for type positive integer",
+		},
+		{
+			name:         "extraneous data",
+			value:        RawMessage{0x01, 0x01},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.RawMessage: cbor: 1 bytes of extraneous data starting at index 1",
+		},
+		{
+			name:         "invalid builtin tag",
+			value:        RawMessage{0xc0, 0x01},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.RawMessage: cbor: tag number 0 must be followed by text string, got positive integer",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			b, err := Marshal(tc.value)
+			if err == nil {
+				t.Errorf("Marshal(%v) didn't return an error, want error %q", tc.value, tc.wantErrorMsg)
+			} else if _, ok := err.(*MarshalerError); !ok {
+				t.Errorf("Marshal(%v) error type %T, want *MarshalerError", tc.value, err)
+			} else if err.Error() != tc.wantErrorMsg {
+				t.Errorf("Marshal(%v) error %q, want %q", tc.value, err.Error(), tc.wantErrorMsg)
+			}
+			if b != nil {
+				t.Errorf("Marshal(%v) = 0x%x, want nil", tc.value, b)
+			}
+		})
+	}
+}
+
+type invalidMarshaler struct {
+	data []byte
+}
+
+func (m invalidMarshaler) MarshalCBOR() (data []byte, err error) {
+	return m.data, nil
+}
+
+func TestMarshalerReturnsMalformedCBORData(t *testing.T) {
+
+	testCases := []struct {
+		name         string
+		value        interface{}
+		wantErrorMsg string
+	}{
+		{
+			name:         "truncated data",
+			value:        invalidMarshaler{data: []byte{0xa6}},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.invalidMarshaler: unexpected EOF",
+		},
+		{
+			name:         "malformed data",
+			value:        invalidMarshaler{data: []byte{0x1f}},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.invalidMarshaler: cbor: invalid additional information 31 for type positive integer",
+		},
+		{
+			name:         "extraneous data",
+			value:        invalidMarshaler{data: []byte{0x01, 0x01}},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.invalidMarshaler: cbor: 1 bytes of extraneous data starting at index 1",
+		},
+		{
+			name:         "invalid builtin tag",
+			value:        invalidMarshaler{data: []byte{0xc0, 0x01}},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.invalidMarshaler: cbor: tag number 0 must be followed by text string, got positive integer",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			b, err := Marshal(tc.value)
+			if err == nil {
+				t.Errorf("Marshal(%v) didn't return an error, want error %q", tc.value, tc.wantErrorMsg)
+			} else if _, ok := err.(*MarshalerError); !ok {
+				t.Errorf("Marshal(%v) error type %T, want *MarshalerError", tc.value, err)
+			} else if err.Error() != tc.wantErrorMsg {
+				t.Errorf("Marshal(%v) error %q, want %q", tc.value, err.Error(), tc.wantErrorMsg)
+			}
+			if b != nil {
+				t.Errorf("Marshal(%v) = 0x%x, want nil", tc.value, b)
+			}
+		})
+	}
+}

stream.go

@@ -84,7 +84,7 @@ func (dec *Decoder) readNext() (int, error) {
 		if dec.off < len(dec.buf) {
 			dec.d.reset(dec.buf[dec.off:])
 			off := dec.off // Save offset before data validation
-			validErr = dec.d.wellformed(true)
+			validErr = dec.d.wellformed(true, false)
 			dec.off = off // Restore offset
 
 			if validErr == nil {

tag_test.go

@@ -1444,3 +1444,49 @@ func TestDecodeRegisterTagForUnmarshaler(t *testing.T) {
 		t.Errorf("Marshal(%v) returned %v, want %v", v2, b, data)
 	}
 }
+
+func TestMarshalRawTagContainingMalformedCBORData(t *testing.T) {
+	testCases := []struct {
+		name         string
+		value        interface{}
+		wantErrorMsg string
+	}{
+		// Nil RawMessage and empty RawMessage are encoded as CBOR nil.
+		{
+			name:         "truncated data",
+			value:        RawTag{Number: 100, Content: RawMessage{0xa6}},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.RawTag: unexpected EOF",
+		},
+		{
+			name:         "malformed data",
+			value:        RawTag{Number: 100, Content: RawMessage{0x1f}},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.RawTag: cbor: invalid additional information 31 for type positive integer",
+		},
+		{
+			name:         "extraneous data",
+			value:        RawTag{Number: 100, Content: RawMessage{0x01, 0x01}},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.RawTag: cbor: 1 bytes of extraneous data starting at index 3",
+		},
+		{
+			name:         "invalid builtin tag",
+			value:        RawTag{Number: 0, Content: RawMessage{0x01}},
+			wantErrorMsg: "cbor: error calling MarshalCBOR for type cbor.RawTag: cbor: tag number 0 must be followed by text string, got positive integer",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			b, err := Marshal(tc.value)
+			if err == nil {
+				t.Errorf("Marshal(%v) didn't return an error, want error %q", tc.value, tc.wantErrorMsg)
+			} else if _, ok := err.(*MarshalerError); !ok {
+				t.Errorf("Marshal(%v) error type %T, want *MarshalerError", tc.value, err)
+			} else if err.Error() != tc.wantErrorMsg {
+				t.Errorf("Marshal(%v) error %q, want %q", tc.value, err.Error(), tc.wantErrorMsg)
+			}
+			if b != nil {
+				t.Errorf("Marshal(%v) = 0x%x, want nil", tc.value, b)
+			}
+		})
+	}
+}

valid.go

@@ -82,11 +82,11 @@ func (e *ExtraneousDataError) Error() string {
 // allowExtraData indicates if extraneous data is allowed after the CBOR data item.
 // - use allowExtraData = true when using Decoder.Decode()
 // - use allowExtraData = false when using Unmarshal()
-func (d *decoder) wellformed(allowExtraData bool) error {
+func (d *decoder) wellformed(allowExtraData bool, checkBuiltinTags bool) error {
 	if len(d.data) == d.off {
 		return io.EOF
 	}
-	_, err := d.wellformedInternal(0)
+	_, err := d.wellformedInternal(0, checkBuiltinTags)
 	if err == nil {
 		if !allowExtraData && d.off != len(d.data) {
 			err = &ExtraneousDataError{len(d.data) - d.off, d.off}
@@ -96,7 +96,7 @@ func (d *decoder) wellformed(allowExtraData bool) error {
 }
 
 // wellformedInternal checks data's well-formedness and returns max depth and error.
-func (d *decoder) wellformedInternal(depth int) (int, error) {
+func (d *decoder) wellformedInternal(depth int, checkBuiltinTags bool) (int, error) {
 	t, ai, val, err := d.wellformedHead()
 	if err != nil {
 		return 0, err
@@ -108,7 +108,7 @@ func (d *decoder) wellformedInternal(depth int) (int, error) {
 			if d.dm.indefLength == IndefLengthForbidden {
 				return 0, &IndefiniteLengthError{t}
 			}
-			return d.wellformedIndefiniteString(t, depth)
+			return d.wellformedIndefiniteString(t, depth, checkBuiltinTags)
 		}
 		valInt := int(val)
 		if valInt < 0 {
@@ -119,6 +119,7 @@ func (d *decoder) wellformedInternal(depth int) (int, error) {
 			return 0, io.ErrUnexpectedEOF
 		}
 		d.off += valInt
+
 	case cborTypeArray, cborTypeMap:
 		depth++
 		if depth > d.dm.maxNestedLevels {
@@ -129,7 +130,7 @@ func (d *decoder) wellformedInternal(depth int) (int, error) {
 			if d.dm.indefLength == IndefLengthForbidden {
 				return 0, &IndefiniteLengthError{t}
 			}
-			return d.wellformedIndefiniteArrayOrMap(t, depth)
+			return d.wellformedIndefiniteArrayOrMap(t, depth, checkBuiltinTags)
 		}
 
 		valInt := int(val)
@@ -156,7 +157,7 @@ func (d *decoder) wellformedInternal(depth int) (int, error) {
 		for j := 0; j < count; j++ {
 			for i := 0; i < valInt; i++ {
 				var dpt int
-				if dpt, err = d.wellformedInternal(depth); err != nil {
+				if dpt, err = d.wellformedInternal(depth, checkBuiltinTags); err != nil {
 					return 0, err
 				}
 				if dpt > maxDepth {
@@ -165,20 +166,29 @@ func (d *decoder) wellformedInternal(depth int) (int, error) {
 			}
 		}
 		depth = maxDepth
+
 	case cborTypeTag:
 		if d.dm.tagsMd == TagsForbidden {
 			return 0, &TagsMdError{}
 		}
 
+		tagNum := val
+
 		// Scan nested tag numbers to avoid recursion.
 		for {
 			if len(d.data) == d.off { // Tag number must be followed by tag content.
 				return 0, io.ErrUnexpectedEOF
 			}
+			if checkBuiltinTags {
+				err = validBuiltinTag(tagNum, d.data[d.off])
+				if err != nil {
+					return 0, err
+				}
+			}
 			if cborType(d.data[d.off]&0xe0) != cborTypeTag {
 				break
 			}
-			if _, _, _, err = d.wellformedHead(); err != nil {
+			if _, _, tagNum, err = d.wellformedHead(); err != nil {
 				return 0, err
 			}
 			depth++
@@ -187,13 +197,14 @@ func (d *decoder) wellformedInternal(depth int) (int, error) {
 			}
 		}
 		// Check tag content.
-		return d.wellformedInternal(depth)
+		return d.wellformedInternal(depth, checkBuiltinTags)
 	}
+
 	return depth, nil
 }
 
 // wellformedIndefiniteString checks indefinite length byte/text string's well-formedness and returns max depth and error.
-func (d *decoder) wellformedIndefiniteString(t cborType, depth int) (int, error) {
+func (d *decoder) wellformedIndefiniteString(t cborType, depth int, checkBuiltinTags bool) (int, error) {
 	var err error
 	for {
 		if len(d.data) == d.off {
@@ -211,15 +222,15 @@ func (d *decoder) wellformedIndefiniteString(t cborType, depth int) (int, error)
 		if (d.data[d.off] & 0x1f) == 31 {
 			return 0, &SyntaxError{"cbor: indefinite-length " + t.String() + " chunk is not definite-length"}
 		}
-		if depth, err = d.wellformedInternal(depth); err != nil {
+		if depth, err = d.wellformedInternal(depth, checkBuiltinTags); err != nil {
 			return 0, err
 		}
 	}
 	return depth, nil
 }
 
 // wellformedIndefiniteArrayOrMap checks indefinite length array/map's well-formedness and returns max depth and error.
-func (d *decoder) wellformedIndefiniteArrayOrMap(t cborType, depth int) (int, error) {
+func (d *decoder) wellformedIndefiniteArrayOrMap(t cborType, depth int, checkBuiltinTags bool) (int, error) {
 	var err error
 	maxDepth := depth
 	i := 0
@@ -232,7 +243,7 @@ func (d *decoder) wellformedIndefiniteArrayOrMap(t cborType, depth int) (int, er
 			break
 		}
 		var dpt int
-		if dpt, err = d.wellformedInternal(depth); err != nil {
+		if dpt, err = d.wellformedInternal(depth, checkBuiltinTags); err != nil {
 			return 0, err
 		}
 		if dpt > maxDepth {