Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

encoding/gob: Decode: invalid memory address or nil pointer dereference #6323

Closed
gopherbot opened this issue Sep 4, 2013 · 8 comments
Closed

encoding/gob: Decode: invalid memory address or nil pointer dereference #6323

gopherbot opened this issue Sep 4, 2013 · 8 comments
Labels
FrozenDueToAge

Comments

@gopherbot
Copy link

by arnaud.lb:

gob Decoder.Decode() may crash with the following error:

panic: runtime error: invalid memory address or nil pointer dereference [recovered]
        panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x10 pc=0x50ecba]

goroutine 1257899 [running]: 
encoding/gob.catchError(0xc206293498)
        /usr/local/go/src/pkg/encoding/gob/error.go:38 +0x8d
encoding/gob.(*Decoder).decodeValue(0xc2062933c0, 0xc200000012, 0x65fa80, 0xc2061b0bc0,
0x160, ...)
        /usr/local/go/src/pkg/encoding/gob/decode.go:1228 +0x1ea
encoding/gob.(*Decoder).DecodeValue(0xc2062933c0, 0x65fa80, 0xc2061b0bc0, 0x160, 0x0,
...)
        /usr/local/go/src/pkg/encoding/gob/decoder.go:225 +0x13f
encoding/gob.(*Decoder).Decode(0xc2062933c0, 0x65fa80, 0xc2061b0bc0, 0x0, 0x0, ...)
        /usr/local/go/src/pkg/encoding/gob/decoder.go:202 +0x1c3

I'm currently not able to find exactly which input is causing this, however this crash
happens regularly.

Using go version go1.1.2 linux/amd64
@robpike
Copy link
Contributor

robpike commented Sep 4, 2013

Comment 1:

Dying on this line:
        if engine.numInstr == 0 && st.NumField() > 0 && len(dec.wireType[wireId].StructT.Field) > 0 {
A reproducible example would make this a lot easier to diagnose. It's certainly
data-dependent. Can you provide one?

Status changed to WaitingForReply.

@gopherbot
Copy link
Author

Comment 2 by arnaud.lb:

I'm not able to create a reproducible example. I've tried recording what the Decoder is
reading, but I can't reproduce the crash with the gathered data.
Apparently dec.wireType[wireId] is nil. wireId is a low int (18), doesn't look like
garbage.

@gopherbot
Copy link
Author

Comment 4 by arnaud.lb:

Finally managed to reproduce the crash, here is a reproducing example:
https://gist.github.com/arnaud-lb/1396ea67af6f57ad5efa
It is possible that the input is malformed / corrupted.

@gopherbot
Copy link
Author

Comment 5 by arnaud.lb:

The input contains a `(type id, encoding of a value)`, where `type id` refers to a type
that hasn't been described over the wire.
The decoder doesn't handle this, and crashes when trying to access the `wireType` at
`dec.wireType[wireId]`, which doesn't exist.
I've attached a smaller reproducing example: bug.go
The attached diff fixes the problem for me, although it may not handle all cases.

Attachments:

  1. bug.go (272 bytes)
  2. diff.diff (1430 bytes)

@rsc
Copy link
Contributor

rsc commented Nov 27, 2013

Comment 6:

Labels changed: added go1.3maybe.

@rsc
Copy link
Contributor

rsc commented Dec 4, 2013

Comment 7:

Labels changed: added release-none, removed go1.3maybe.

@rsc
Copy link
Contributor

rsc commented Dec 4, 2013

Comment 8:

Labels changed: added repo-main.

@remyoudompheng
Copy link
Contributor

Comment 9:

This issue was closed by revision 7a73f32.

Status changed to Fixed.

@golang golang locked and limited conversation to collaborators Jun 25, 2016
This issue was closed.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@rsc @remyoudompheng @robpike @gopherbot