encoding/json: fix "data changed underfoot?" panic

Given a program as follows:

	data := []byte(`{"F": {
		"a": 2,
		"3": 4
	}}`)
	json.Unmarshal(data, &map[string]map[int]int{})

The JSON package should error, as "a" is not a valid integer. However,
we'd encounter a panic:

	panic: JSON decoder out of sync - data changing underfoot?

The reason was that decodeState.object would return a nil error on
encountering the invalid map key string, while saving the key type error
for later. This broke if we were inside another object, as we would
abruptly end parsing the nested object, leaving the decoder in an
unexpected state.

To fix this, simply avoid storing the map element and continue decoding
the object, to leave the decoder state exactly as if we hadn't seen an
invalid key type.

This affected both signed and unsigned integer keys, so fix both and add
two test cases.

Updates #28189.

Change-Id: I8a6204cc3ff9fb04ed769df7a20a824c8b94faff
Reviewed-on: https://go-review.googlesource.com/c/142518
Reviewed-by: Ian Lance Taylor <iant@golang.org>

diff --git a/src/encoding/json/decode.go b/src/encoding/json/decode.go
index cab4616ba337b339e2e9ff8c12e3444fc87e9fd2..6608415e13b20b857cf2a57fc2f9340b586c5d52 100644 (file)
--- a/src/encoding/json/decode.go
+++ b/src/encoding/json/decode.go
@@ -786,7 +786,7 @@ func (d *decodeState) object(v reflect.Value) error {
                                        n, err := strconv.ParseInt(s, 10, 64)
                                        if err != nil || reflect.Zero(kt).OverflowInt(n) {
                                                d.saveError(&UnmarshalTypeError{Value: "number " + s, Type: kt, Offset: int64(start + 1)})
-                                               return nil
+                                               break
                                        }
                                        kv = reflect.ValueOf(n).Convert(kt)
                                case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
@@ -794,14 +794,16 @@ func (d *decodeState) object(v reflect.Value) error {
                                        n, err := strconv.ParseUint(s, 10, 64)
                                        if err != nil || reflect.Zero(kt).OverflowUint(n) {
                                                d.saveError(&UnmarshalTypeError{Value: "number " + s, Type: kt, Offset: int64(start + 1)})
-                                               return nil
+                                               break
                                        }
                                        kv = reflect.ValueOf(n).Convert(kt)
                                default:
                                        panic("json: Unexpected key type") // should never occur
                                }
                        }
-                       v.SetMapIndex(kv, subv)
+                       if kv.IsValid() {
+                               v.SetMapIndex(kv, subv)
+                       }
                }
 
                // Next token must be , or }.

diff --git a/src/encoding/json/decode_test.go b/src/encoding/json/decode_test.go
index 5fbe67a7063b3233fb30aaaf16ed309fec1a0720..70731a62d6fc0003aa492bfbcc8a7831987aefb1 100644 (file)
--- a/src/encoding/json/decode_test.go
+++ b/src/encoding/json/decode_test.go
@@ -554,6 +554,16 @@ var unmarshalTests = []unmarshalTest{
                ptr: new(map[uint8]string),
                err: &UnmarshalTypeError{Value: "number -1", Type: reflect.TypeOf(uint8(0)), Offset: 2},
        },
+       {
+               in:  `{"F":{"a":2,"3":4}}`,
+               ptr: new(map[string]map[int]int),
+               err: &UnmarshalTypeError{Value: "number a", Type: reflect.TypeOf(int(0)), Offset: 7},
+       },
+       {
+               in:  `{"F":{"a":2,"3":4}}`,
+               ptr: new(map[string]map[uint]int),
+               err: &UnmarshalTypeError{Value: "number a", Type: reflect.TypeOf(uint(0)), Offset: 7},
+       },
 
        // Map keys can be encoding.TextUnmarshalers.
        {in: `{"x:y":true}`, ptr: &ummapType, out: ummapXY},