x/net/html: panic: runtime error: index out of range #27846

tr3ee · 2018-09-25T08:05:30Z

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (`go version`)?

go version go1.10.3 windows/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (`go env`)?

set GOARCH=amd64
set GOBIN=
set GOEXE=.exe
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOOS=windows
set GORACE=
set GOTMPDIR=
set GCCGO=gccgo
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config

NOTE: there are two different issues below

BUG 1

What did you do?

package main

import (
	"strings"

	"golang.org/x/net/html"
)

func main() {
	r := strings.NewReader("<svg><template><desc><t><svg></template>")
	html.Parse(r)
}

What did you expect to see?

No panic exit

What did you see instead?

panic: runtime error: index out of range

goroutine 1 [running]:
golang.org/x/net/html.(*nodeStack).pop(...)
        /path/to/gopath/src/golang.org/x/net/html/node.go:153
golang.org/x/net/html.(*parser).clearActiveFormattingElements(0xc042050410)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:372 +0x4d
golang.org/x/net/html.inHeadIM(0xc042050410, 0x40df23)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:675 +0xff
golang.org/x/net/html.inBodyIM(0xc042050410, 0x2)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:1138 +0x3425
golang.org/x/net/html.parseForeignContent(0xc042050410, 0x1)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:2122 +0x80a
golang.org/x/net/html.(*parser).parseCurrentToken(0xc042050410)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:2190 +0x6f
golang.org/x/net/html.(*parser).parse(0xc042050410, 0xc0420a2000, 0xc042050340)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:2218 +0x62
golang.org/x/net/html.Parse(0x4e14c0, 0xc0420024c0, 0xc0420661e0, 0xc04206ff78, 0xc042048058)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:2244 +0xe2
main.main()
        /path/to/gopath/src/main.go:11 +0x7a
exit status 2

BUG 2

What did you do?

package main

import (
	"strings"

	"golang.org/x/net/html"
)

func main() {
	r := strings.NewReader("<math><template><mn><b></template>")
	html.Parse(r)
}

What did you expect to see?

No panic exit

What did you see instead?

panic: runtime error: index out of range

goroutine 1 [running]:
golang.org/x/net/html.(*insertionModeStack).pop(...)
        /path/to/gopath/src/golang.org/x/net/html/node.go:210
golang.org/x/net/html.inHeadIM(0xc042056340, 0x40)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:676 +0x74f
golang.org/x/net/html.inBodyIM(0xc042056340, 0x0)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:1138 +0x3425
golang.org/x/net/html.(*parser).parseCurrentToken(0xc042056340)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:2192 +0x8b
golang.org/x/net/html.(*parser).parse(0xc042056340, 0xc0420b6000, 0xc042056270)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:2218 +0x62
golang.org/x/net/html.Parse(0x4e14c0, 0xc042054460, 0xc0420701e0, 0xc042079f78, 0xc042048058)
        /path/to/gopath/src/golang.org/x/net/html/parse.go:2244 +0xe2
main.main()
        /path/to/gopath/src/main.go:11 +0x7a
exit status 2

The text was updated successfully, but these errors were encountered:

odeke-em · 2018-09-25T09:51:09Z

Thank you for reporting these bugs @tr3ee! You are on a roll, nice.
/cc @nigeltao @namusyaka @bradfitz

Perhaps this calls for us to fuzz the x/net/html package /cc @dgryski @dvyukov

tr3ee · 2018-09-26T03:20:02Z

Thank you for reporting these bugs @tr3ee! You are on a roll, nice.
/cc @nigeltao @namusyaka @bradfitz

Perhaps this calls for us to fuzz the x/net/html package /cc @dgryski @dvyukov

I think @dvyukov / go-fuzz (It's quite an awesome project BTW) seems perfect to do that. I'd like to help, but I don't know much about this fuzz thing.
Besides, is there anyone already working on it? is it OK to use go-fuzz inside x/net/html?

dvyukov · 2018-09-26T05:47:22Z

but I don't know much about this fuzz thing.

What do you want to know?

Besides, is there anyone already working on it?

I am no not.

is it OK to use go-fuzz inside x/net/html?

What exactly do you mean?

tr3ee · 2018-09-26T09:41:08Z

is it OK to use go-fuzz inside x/net/html?

What exactly do you mean?

I just learned about go-fuzz project and wrote some ugly code tr3ee/net@a59147a

but it works fine for me and already found a crasher.

	"[template]<table></>" +
	"<table><table><_333J" +
	"__Nl1nimuwV_0_t80x_T" +
	"ACB_bic_><table>1_mq" +
	"kW3Y1uzD<table><tabl" +
	"e><__N2_bv__wq_Jqb_4" +
	"x_2i3_pP71A3F_AxqBdv" +
	"L_46_LD_f0_iH_4Jrs_y" +
	"z4L28Kq36Z_E6____ra3" +
	"Tv_><table><table><t" +
	"able><EW><table><tab" +
	"le><table><table>{ta" +
	"ble}<><table><_>{tab" +
	"letableE}<><table><t" +
	"able>[table]<table><" +
	"><><table><table><ta" +
	"ble><table><><tablel" +
	"4cg1_na_5b70h2Qu8Dv_" +
	"Y__T__RY_G>(table)<t" +
	"able><table><table><" +
	"table><table><table>" +
	"<table><<svg><3_><de" +
	"sc><><select>\x00<><><d" +
	"esc><select>\"select\"" +
	"\x00<svg><html><desc><>" +
	"`u3_>\x00<svg><html><D9" +
	"9><select><select>}<" +
	"><html><&><select><>" +
	")<svg>/table<desc><s" +
	"elect><select>\x0f<><1_" +
	"IV_byyC><Kn_DL6Hq0CR" +
	"YBJyOflyuWTozjf__PDU" +
	"H3evJ_n_6tL____kUs9O" +
	"_d2><select><87b_sel" +
	"ect>}<html><CY><sele" +
	"ct><select>)<table><" +
	"table><oOe>\"'<><tabl" +
	"e><table><table>`tab" +
	"le><table><table><><" +
	"table><><table><3q>#" +
	"<table><table>\"table" +
	"\"<><table><table>"

dvyukov · 2018-09-26T09:50:40Z

Working as expected :)

gopherbot · 2019-01-24T17:33:51Z

Change https://golang.org/cl/159397 mentions this issue: html: make (*nodeStack)contains distinguish namespace

gopherbot added this to the Unreleased milestone Sep 25, 2018

dvyukov mentioned this issue Sep 25, 2018

proposal: cmd/go: make fuzzing a first class citizen, like tests or benchmarks #19109

Closed

odeke-em mentioned this issue Sep 25, 2018

x/net/html: fuzz this package #27848

Open

gopherbot closed this as completed in golang/net@4b62a64 Jan 25, 2019

golang locked and limited conversation to collaborators Jan 25, 2020

gopherbot added the FrozenDueToAge label Jan 25, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

x/net/html: panic: runtime error: index out of range #27846

x/net/html: panic: runtime error: index out of range #27846

tr3ee commented Sep 25, 2018 •

edited

odeke-em commented Sep 25, 2018

tr3ee commented Sep 26, 2018

dvyukov commented Sep 26, 2018

tr3ee commented Sep 26, 2018

dvyukov commented Sep 26, 2018

gopherbot commented Jan 24, 2019

x/net/html: panic: runtime error: index out of range #27846

x/net/html: panic: runtime error: index out of range #27846

Comments

tr3ee commented Sep 25, 2018 • edited

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

BUG 1

What did you do?

What did you expect to see?

What did you see instead?

BUG 2

What did you do?

What did you expect to see?

What did you see instead?

odeke-em commented Sep 25, 2018

tr3ee commented Sep 26, 2018

dvyukov commented Sep 26, 2018

tr3ee commented Sep 26, 2018

dvyukov commented Sep 26, 2018

gopherbot commented Jan 24, 2019

tr3ee commented Sep 25, 2018 •

edited

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?