Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
Fix #3130: Crash at fuzzing target replacer (#3133)
* Fix #3130: Crash at fuzzing target replacer * Add additional test case based on fuzzer feedback
Bill Glover committed
Mar 11, 2020 at 22:12 UTC
cfe85a9fe625fea55dc4f809fd91b5c061064508
2 files changed
+15
-1
replacer.go
+7
-1
@@ -124,6 +124,8 @@ func (r *Replacer) replace(input, empty string,
124
125
// iterate the input to find each placeholder
126
var lastWriteCursor int
127
+
128
+scan:
129
for i := 0; i < len(input); i++ {
130
131
// check for escaped braces
@@ -145,7 +147,11 @@ func (r *Replacer) replace(input, empty string,
147
148
// if necessary look for the first closing brace that is not escaped
149
for end > 0 && end < len(input)-1 && input[end-1] == phEscape {
148
- end = strings.Index(input[end+1:], string(phClose)) + end + 1
150
+ nextEnd := strings.Index(input[end+1:], string(phClose))
151
+ if nextEnd < 0 {
152
+ continue scan
153
+ }
154
+ end += nextEnd + 1
155
}
156
157
// write the substring from the last cursor to this point
replacer_test.go
+8
@@ -156,6 +156,14 @@ func TestReplacer(t *testing.T) {
156
input: `\{'group':'default','max_age':3600,'endpoints':[\{'url':'https://some.domain.local/a/d/g'\}],'include_subdomains':true\}`,
157
expect: `{'group':'default','max_age':3600,'endpoints':[{'url':'https://some.domain.local/a/d/g'}],'include_subdomains':true}`,
158
},
159
+ {
160
+ input: `{}{}{}{\\\\}\\\\`,
161
+ expect: `{\\\}\\\\`,
162
+ },
163
+ {
164
+ input: string([]byte{0x26, 0x00, 0x83, 0x7B, 0x84, 0x07, 0x5C, 0x7D, 0x84}),
165
+ expect: string([]byte{0x26, 0x00, 0x83, 0x7B, 0x84, 0x07, 0x7D, 0x84}),
166
+ },
167
} {
168
actual := rep.ReplaceAll(tc.input, tc.empty)
169
if actual != tc.expect {