-
Notifications
You must be signed in to change notification settings - Fork 275
Open
Description
The VendorProduct.UnmarshalText function in vulnfeeds/cves/versions.go panics if the input string does not contain a colon. Specifically, it splits the input string by ":" and immediately accesses index [1], which leads to a runtime panic when processing malformed data lacking a colon (e.g., due to malformed input in a source file).
To Reproduce
Steps to reproduce the behaviour:
- Call UnmarshalText with a byte slice that does not contain a colon.
- Observe the panic.
Example code to reproduce:
package main
import (
"fmt"
"strings"
)
type VendorProduct struct {
Vendor string
Product string
}
func (vp *VendorProduct) UnmarshalText(text []byte) error {
s := strings.Split(string(text), ":")
vp.Vendor = s[0]
vp.Product = s[1] // Panic occurs here
return nil
}
func main() {
vp := &VendorProduct{}
// Trigger panic
_ = vp.UnmarshalText([]byte("malformed_input"))
}Stack trace when run:
panic: runtime error: index out of range [1] with length 1
goroutine 1 [running]:
main.(*VendorProduct).UnmarshalText(...)
/path/to/repro.go:16 +0x...
Proposed Fix
Add a length check before accessing the slice indices.
Additional context
I am happy to submit a PR for this if you would like!
Metadata
Metadata
Assignees
Labels
No labels