-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Invalid simple_keys now cause panics later in decode #548
Comments
niemeyer
added a commit
that referenced
this issue
Nov 19, 2019
No, it's a different issue. Sorry for the bug. This is fixed in 1f64d61. |
thaJeztah
added a commit
to thaJeztah/yaml
that referenced
this issue
Nov 28, 2019
full diff: go-yaml/yaml@v2.2.2...v2.2.7 includes: - go-yaml/yaml@caeefd8 addresses CVE-2019-11253 JSON/YAML parsing vulnerable to resource exhaustion attack - go-yaml/yaml#171 Tighten restrictions on float decoding - go-yaml/yaml#515 Add large document benchmarks, tune alias heuristic, add max depth limits - go-yaml/yaml@f90ceb4 fixes go-yaml/yaml#529 yaml.Unmarshal crashes on "assignment to entry in nil map" - go-yaml/yaml#543 Port stale simple_keys fix to v2 - go-yaml/yaml@1f64d61 fixes go-yaml/yaml#548 Invalid simple_keys now cause panics later in decode Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/yaml
that referenced
this issue
Nov 28, 2019
full diff: go-yaml/yaml@v2.2.2...v2.2.7 includes: - go-yaml/yaml@caeefd8 addresses CVE-2019-11253 JSON/YAML parsing vulnerable to resource exhaustion attack - go-yaml/yaml#171 Tighten restrictions on float decoding - go-yaml/yaml#515 Add large document benchmarks, tune alias heuristic, add max depth limits - go-yaml/yaml@f90ceb4 fixes go-yaml/yaml#529 yaml.Unmarshal crashes on "assignment to entry in nil map" - go-yaml/yaml#543 Port stale simple_keys fix to v2 - go-yaml/yaml@1f64d61 fixes go-yaml/yaml#548 Invalid simple_keys now cause panics later in decode Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Looks like a test case that I missed in #543.
The following test in
unmarshalErrorTests
in decode_test.go passes before that PR, and fails after.I get a panic:
I think we are no longer catching the "stale" case now that we only process the simple_keys stack from the top.
The text was updated successfully, but these errors were encountered: