github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-12 18:48:08 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Crash in html.go found from fuzzing #6446

New Issue
Closed
opened 2025-11-02 06:56:14 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-02 06:56:14 -06:00
Owner
Copy Link

Originally created by @AdamKorcz on GitHub (Dec 3, 2020).

This is a bug report for a crash found with the PostProcess fuzzer from here.

The version of gitea is the the master branch downloaded with git clone https://github.com/go-gitea/gitea

Stacktrace:

goroutine 17 [running, locked to thread]:
code.gitea.io/gitea/modules/markup.shortLinkProcessorFull(0x10c001189f80, 0x10c000341500, 0x0)
        code.gitea.io/gitea/modules/markup/html.go:660 +0x25e5
code.gitea.io/gitea/modules/markup.shortLinkProcessor(0x10c001189f80, 0x10c000341500)
        code.gitea.io/gitea/modules/markup/html.go:607 +0x4b
code.gitea.io/gitea/modules/markup.(*postProcessCtx).textNode(0x10c001189f80, 0x10c000341500)
        code.gitea.io/gitea/modules/markup/html.go:440 +0x7d
code.gitea.io/gitea/modules/markup.(*postProcessCtx).visitNode(0x10c001189f80, 0x10c000341500, 0x7fe4b1d20101)
        code.gitea.io/gitea/modules/markup/html.go:380 +0x1525
code.gitea.io/gitea/modules/markup.(*postProcessCtx).visitNode(0x10c001189f80, 0x10c000341420, 0x1)
        code.gitea.io/gitea/modules/markup/html.go:430 +0x66c
code.gitea.io/gitea/modules/markup.(*postProcessCtx).visitNode(0x10c001189f80, 0x10c000341340, 0x1)
        code.gitea.io/gitea/modules/markup/html.go:430 +0x66c
code.gitea.io/gitea/modules/markup.(*postProcessCtx).postProcess(0x10c001189f80, 0x60800001bea0, 0x60, 0x60, 0x683286c0dcf93c66, 0x10c001edddd8, 0x56422f, 0x1725480, 0x10c0006a4360)
        code.gitea.io/gitea/modules/markup/html.go:341 +0x305
code.gitea.io/gitea/modules/markup.PostProcess(0x60800001bea0, 0x60, 0x60, 0xf1f147, 0x4, 0x10c000675f20, 0x0, 0x10c0001d2c59, 0x0, 0x56a394, ...)
        code.gitea.io/gitea/modules/markup/html.go:193 +0xdd
code.gitea.io/gitea/fuzz.Fuzz2(0x60800001bea0, 0x60, 0x60, 0x18)
        code.gitea.io/gitea/fuzz/fuzz.go:24 +0x12f
main.LLVMFuzzerTestOneInput(...)
        command-line-arguments/main.711778661.go:21
main._cgoexpwrap_441dadf043a3_LLVMFuzzerTestOneInput(0x60800001bea0, 0x60, 0x1e6d000)
        _cgo_gotypes.go:53 +0x5c
AddressSanitizer:DEADLYSIGNAL
=================================================================
==11==ERROR: AddressSanitizer: ABRT on unknown address 0x00000000000b (pc 0x0000005c1481 bp 0x10c001edcf90 sp 0x10c001edcf78 T0)
SCARINESS: 10 (signal)
    #0 0x5c1481 in runtime.raise runtime/sys_linux_amd64.s:165

DEDUP_TOKEN: runtime.raise
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT runtime/sys_linux_amd64.s:165 in runtime.raise
==11==ABORTING

Input buffer:

0x52,0xfe,0xff,0x0,0x0,0x44,0x1,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x5b,0x5b,0x30,0x5b,0x3a,0x3a,0x3a,0x3d,0x0,0x27,0x0,0x5d,0x5d,0x21,0x5d,0x3a,0x21,0x0,0xd1,0x82,0x0,0x44,0x1,0x0,0x0,0x0,0x6f,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x5b,0x5b,0x30,0x5b,0x3a,0x3a,0x3d,0x27,0x3a,0x8,0x0,0x0,0x0,0x80,0x5d,0x5d,0x5d,0x21,0x5d,0x3a,0x21,0x0,0xd1,0x82,0x0,0xcc,0x5b,0x3c,0x3c,0x5b,0x31,0x5b,0x7c,0x3c,0x3c,0x3a,0x3a,0x5b,0x5b,0xdf,0x0

or with ASCII characters:

R\xfe\xff\x00\x00D\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00[[0[:::=\x00'\x00]]!]:!\x00\xd1\x82\x00D\x01\x00\x00\x00o\x00\x00\x00\x00\x00\x00\x00\x00\x00[[0[::=':\x08\x00\x00\x00\x80]]]!]:!\x00\xd1\x82\x00\xcc[<<[1[|<<::[[\xdf\x00
Originally created by @AdamKorcz on GitHub (Dec 3, 2020). This is a bug report for a crash found with the PostProcess fuzzer from [here](https://github.com/go-gitea/gitea/pull/13818). The version of gitea is the the master branch downloaded with `git clone https://github.com/go-gitea/gitea` Stacktrace: ``` goroutine 17 [running, locked to thread]: code.gitea.io/gitea/modules/markup.shortLinkProcessorFull(0x10c001189f80, 0x10c000341500, 0x0) code.gitea.io/gitea/modules/markup/html.go:660 +0x25e5 code.gitea.io/gitea/modules/markup.shortLinkProcessor(0x10c001189f80, 0x10c000341500) code.gitea.io/gitea/modules/markup/html.go:607 +0x4b code.gitea.io/gitea/modules/markup.(*postProcessCtx).textNode(0x10c001189f80, 0x10c000341500) code.gitea.io/gitea/modules/markup/html.go:440 +0x7d code.gitea.io/gitea/modules/markup.(*postProcessCtx).visitNode(0x10c001189f80, 0x10c000341500, 0x7fe4b1d20101) code.gitea.io/gitea/modules/markup/html.go:380 +0x1525 code.gitea.io/gitea/modules/markup.(*postProcessCtx).visitNode(0x10c001189f80, 0x10c000341420, 0x1) code.gitea.io/gitea/modules/markup/html.go:430 +0x66c code.gitea.io/gitea/modules/markup.(*postProcessCtx).visitNode(0x10c001189f80, 0x10c000341340, 0x1) code.gitea.io/gitea/modules/markup/html.go:430 +0x66c code.gitea.io/gitea/modules/markup.(*postProcessCtx).postProcess(0x10c001189f80, 0x60800001bea0, 0x60, 0x60, 0x683286c0dcf93c66, 0x10c001edddd8, 0x56422f, 0x1725480, 0x10c0006a4360) code.gitea.io/gitea/modules/markup/html.go:341 +0x305 code.gitea.io/gitea/modules/markup.PostProcess(0x60800001bea0, 0x60, 0x60, 0xf1f147, 0x4, 0x10c000675f20, 0x0, 0x10c0001d2c59, 0x0, 0x56a394, ...) code.gitea.io/gitea/modules/markup/html.go:193 +0xdd code.gitea.io/gitea/fuzz.Fuzz2(0x60800001bea0, 0x60, 0x60, 0x18) code.gitea.io/gitea/fuzz/fuzz.go:24 +0x12f main.LLVMFuzzerTestOneInput(...) command-line-arguments/main.711778661.go:21 main._cgoexpwrap_441dadf043a3_LLVMFuzzerTestOneInput(0x60800001bea0, 0x60, 0x1e6d000) _cgo_gotypes.go:53 +0x5c AddressSanitizer:DEADLYSIGNAL ================================================================= ==11==ERROR: AddressSanitizer: ABRT on unknown address 0x00000000000b (pc 0x0000005c1481 bp 0x10c001edcf90 sp 0x10c001edcf78 T0) SCARINESS: 10 (signal) #0 0x5c1481 in runtime.raise runtime/sys_linux_amd64.s:165 DEDUP_TOKEN: runtime.raise AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: ABRT runtime/sys_linux_amd64.s:165 in runtime.raise ==11==ABORTING ``` Input buffer: ``` 0x52,0xfe,0xff,0x0,0x0,0x44,0x1,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x5b,0x5b,0x30,0x5b,0x3a,0x3a,0x3a,0x3d,0x0,0x27,0x0,0x5d,0x5d,0x21,0x5d,0x3a,0x21,0x0,0xd1,0x82,0x0,0x44,0x1,0x0,0x0,0x0,0x6f,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x5b,0x5b,0x30,0x5b,0x3a,0x3a,0x3d,0x27,0x3a,0x8,0x0,0x0,0x0,0x80,0x5d,0x5d,0x5d,0x21,0x5d,0x3a,0x21,0x0,0xd1,0x82,0x0,0xcc,0x5b,0x3c,0x3c,0x5b,0x31,0x5b,0x7c,0x3c,0x3c,0x3a,0x3a,0x5b,0x5b,0xdf,0x0 ``` or with ASCII characters: ``` R\xfe\xff\x00\x00D\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00[[0[:::=\x00'\x00]]!]:!\x00\xd1\x82\x00D\x01\x00\x00\x00o\x00\x00\x00\x00\x00\x00\x00\x00\x00[[0[::=':\x08\x00\x00\x00\x80]]]!]:!\x00\xd1\x82\x00\xcc[<<[1[|<<::[[\xdf\x00 ```
GiteaMirror added the type/bug label 2025-11-02 06:56:14 -06:00
GiteaMirror commented 2025-11-02 06:56:15 -06:00
Author
Owner
Copy Link

@zeripath commented on GitHub (Dec 4, 2020):

So this causes a panic which should be caught and an error page shown.

Looking at the code:

c9effd5364/modules/markup/html.go (L658-L660)

To get a panic here the length of val at this point has to be only 1 and either equal to " or '.

Thus a much simpler reproducible error is:

[[a|b=']]

E.g. https://try.gitea.io/arandomer/pathological/raw/branch/master/Another.md

https://try.gitea.io/arandomer/pathological/src/branch/master/Another.md

Now it looks like as a result of the chi pr the panic catcher has been broken as that panic should have and would have been caught by macaron previously and hidden showing a 500...

@zeripath commented on GitHub (Dec 4, 2020): So this causes a panic which should be caught and an error page shown. Looking at the code: https://github.com/go-gitea/gitea/blob/c9effd5364caaed040f78b4298a34fbf98420fba/modules/markup/html.go#L658-L660 To get a panic here the length of val at this point has to be only 1 and either equal to " or '. Thus a much simpler reproducible error is: ``` [[a|b=']] ``` E.g. https://try.gitea.io/arandomer/pathological/raw/branch/master/Another.md https://try.gitea.io/arandomer/pathological/src/branch/master/Another.md Now it looks like as a result of the chi pr the panic catcher has been broken as that panic should have and would have been caught by macaron previously and hidden showing a 500...
GiteaMirror commented 2025-11-02 06:56:15 -06:00
Author
Owner
Copy Link

@zeripath commented on GitHub (Dec 4, 2020):

Lines 651-664 or simply 658 should probably just get a Len check on them - a similar panic would be possible with [[a|b="]]

@zeripath commented on GitHub (Dec 4, 2020): Lines 651-664 or simply 658 should probably just get a Len check on them - a similar panic would be possible with `[[a|b="]]`
GiteaMirror commented 2025-11-02 06:56:15 -06:00
Author
Owner
Copy Link

@zeripath commented on GitHub (Dec 4, 2020):

Mea culpa - I added this and totally missed that ' would pass both tests. A simple Len check would definitely prevent this and is likely to be the cheapest solution.

@zeripath commented on GitHub (Dec 4, 2020): Mea culpa - I added this and totally missed that `'` would pass both tests. A simple Len check would definitely prevent this and is likely to be the cheapest solution.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label type/bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#6446
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?