Out of bounds panic on YAML parsing #97651
Comments
k8s-ci-robot
added
needs-sig
|
/sig api-machinery |
k8s-ci-robot
added
sig/api-machinery
|
This piece kubernetes/staging/src/k8s.io/apimachinery/pkg/util/yaml/decoder.go Lines 263 to 282 in 43fcd50 attempts to find line+column position of a json syntax error. To do that it assumes that full input is available which is not true:
The subject happens e.g. when syntax error offset is past buffer size and diff --git a/staging/src/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go b/staging/src/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go
index 1f4b158f968..a60027a05ce 100644
--- a/staging/src/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go
+++ b/staging/src/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go
@@ -247,6 +247,15 @@ func TestDecodeBrokenJSON(t *testing.T) {
}
}
+func Test97651(t *testing.T) {
+ s := NewYAMLOrJSONDecoder(bytes.NewReader([]byte(`{
+ "foo": {
+ "stuff": 1,
+}`)), 1)
+ obj := generic{}
+ s.Decode(&obj)
+}
+
type generic map[string]interface{}
func TestYAMLOrJSONDecoder(t *testing.T) {I am not sure it is easily possible to find line+column of json syntax error as full input may not be available. |
|
@AlexanderYastrebov do you want to submit a patch to decoder.do with a defensive check to avoid the panic ( compare |
|
@dims I think the defensive patch is not the right approach because line calculation is incorrect anyway even when there is no panic: I think the following options are there:
|
k8s-ci-robot
added
triage/accepted
This is probably acceptable. |
I have opened a PR |
|
@lavalamp Thank you for support. |
This bug was privately disclosed and told to open here.
What happened:
NewYAMLOrJSONDecoder from k8s.io/apimachinery/pkg/util/yaml has an index out of bounds issue which can cause callers to panic.
Download attached reproducer file
Run golang test:
When run with k8s.io/apimachinery v0.19.3:
Additionally, this can be seen in kubectl directly (below is kubectl 1.20.0):
Environment:
kubectl version): Verified with 1.19, 1.20repro.txt
The text was updated successfully, but these errors were encountered: