Skip to content

Commit db8724d

Browse files
Copilotpelikhan
andauthored
Fix fuzz harness panic on malformed options input (#18179)
* Initial plan * initial plan Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * fix: add len(part) >= 2 guard in FuzzParseInputDefinition options parsing to prevent slice bounds panic Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
1 parent 6e56a35 commit db8724d

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

pkg/workflow/workflow_dispatch_inputs_fuzz_test.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ func FuzzParseInputDefinition(f *testing.F) {
111111
f.Add(`{"type":"choice","options":[1,2,3]}`)
112112
f.Add(`{"type":"choice","options":[true,false]}`)
113113
f.Add(`{"type":"choice","options":["",""]}`)
114+
f.Add(`{"options":[" ]`) // malformed: truncated before closing quote/bracket
114115

115116
// Run the fuzzer
116117
f.Fuzz(func(t *testing.T, jsonStr string) {
@@ -219,7 +220,7 @@ func FuzzParseInputDefinition(f *testing.F) {
219220
options := []string{}
220221
for _, part := range parts {
221222
part = strings.TrimSpace(part)
222-
if strings.HasPrefix(part, `"`) && strings.HasSuffix(part, `"`) {
223+
if len(part) >= 2 && strings.HasPrefix(part, `"`) && strings.HasSuffix(part, `"`) {
223224
options = append(options, part[1:len(part)-1])
224225
}
225226
}

0 commit comments

Comments
 (0)