encoding/prototext: fix crash in map parsing
Fuzzer-detected crash when parsing map values which should be messages,
but are not.
Fixes golang/protobuf#1003
Change-Id: Ib34b13d1a6fef7209e7c17dc5d7f4bd8a1ebac87
Reviewed-on: https://go-review.googlesource.com/c/protobuf/+/212397
Reviewed-by: Herbie Ong <herbie@google.com>
diff --git a/encoding/prototext/decode.go b/encoding/prototext/decode.go
index 8951e6b..4e4d0c9 100644
--- a/encoding/prototext/decode.go
+++ b/encoding/prototext/decode.go
@@ -420,10 +420,14 @@
// unmarshalMapMessageValue unmarshals given message-type text.Value into a protoreflect.Map for
// the given MapKey.
-func (o UnmarshalOptions) unmarshalMapMessageValue(input text.Value, pkey pref.MapKey, _ pref.FieldDescriptor, mmap pref.Map) error {
+func (o UnmarshalOptions) unmarshalMapMessageValue(input text.Value, pkey pref.MapKey, fd pref.FieldDescriptor, mmap pref.Map) error {
var value [][2]text.Value
- if input.Type() != 0 {
+ switch input.Type() {
+ case 0:
+ case text.Message:
value = input.Message()
+ default:
+ return errors.New("%v contains invalid value: %v", fd.FullName(), input)
}
val := mmap.NewValue()
if err := o.unmarshalMessage(value, val.Message()); err != nil {
diff --git a/encoding/prototext/decode_test.go b/encoding/prototext/decode_test.go
index 03ba552..525304a 100644
--- a/encoding/prototext/decode_test.go
+++ b/encoding/prototext/decode_test.go
@@ -951,6 +951,16 @@
`,
wantErr: true,
}, {
+ desc: "map contains invalid message value",
+ inputMessage: &pb3.Maps{},
+ inputText: `
+str_to_nested: {
+ key: "one"
+ value: 1
+}
+`,
+ wantErr: true,
+ }, {
desc: "map using mix of [] and repeated",
inputMessage: &pb3.Maps{},
inputText: `
