Skip to content

panic: index out of range in VendorProduct.UnmarshalText when input lacks separator #4661

@Alearner12

Description

@Alearner12

The VendorProduct.UnmarshalText function in vulnfeeds/cves/versions.go panics if the input string does not contain a colon. Specifically, it splits the input string by ":" and immediately accesses index [1], which leads to a runtime panic when processing malformed data lacking a colon (e.g., due to malformed input in a source file).

To Reproduce
Steps to reproduce the behaviour:

  1. Call UnmarshalText with a byte slice that does not contain a colon.
  2. Observe the panic.

Example code to reproduce:

package main

import (
	"fmt"
	"strings"
)

type VendorProduct struct {
	Vendor  string
	Product string
}

func (vp *VendorProduct) UnmarshalText(text []byte) error {
	s := strings.Split(string(text), ":")
	vp.Vendor = s[0]
	vp.Product = s[1] // Panic occurs here
	return nil
}

func main() {
	vp := &VendorProduct{}
	// Trigger panic
	_ = vp.UnmarshalText([]byte("malformed_input"))
}

Stack trace when run:

panic: runtime error: index out of range [1] with length 1

goroutine 1 [running]:
main.(*VendorProduct).UnmarshalText(...)
        /path/to/repro.go:16 +0x...

Proposed Fix
Add a length check before accessing the slice indices.

Additional context
I am happy to submit a PR for this if you would like!

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions