encoding/json: fix Unmarshal hang on recursive pointers

indirect walks down v until it gets to a non-pointer. But it does not
handle the case when v is a pointer to itself, like in:

	var v interface{}
	v = &v
	Unmarshal(b, v)

So just stop immediately if we see v is a pointer to itself.

Fixes #31740

Change-Id: Ie396264119e24d70284cd9bf76dcb2050babb069
Reviewed-on: https://go-review.googlesource.com/c/go/+/174337
Run-TryBot: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Daniel Martí <mvdan@mvdan.cc>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

diff --git a/src/encoding/json/decode.go b/src/encoding/json/decode.go
index 3ca3d7803e2060e40604bfeda27a3114d1c4a129..bdd94e34ce649f5fb5669ae3925fc4293b6a7565 100644 (file)
--- a/src/encoding/json/decode.go
+++ b/src/encoding/json/decode.go
@@ -535,6 +535,14 @@ func indirect(v reflect.Value, decodingNull bool) (Unmarshaler, encoding.TextUnm
                if v.Elem().Kind() != reflect.Ptr && decodingNull && v.CanSet() {
                        break
                }
+
+               // Prevent infinite loop if v is an interface pointing to its own address:
+               //     var v interface{}
+               //     v = &v
+               if v.Elem().Kind() == reflect.Interface && v.Elem().Elem() == v {
+                       v = v.Elem()
+                       break
+               }
                if v.IsNil() {
                        v.Set(reflect.New(v.Type().Elem()))
                }

diff --git a/src/encoding/json/decode_test.go b/src/encoding/json/decode_test.go
index 8da74fa3d35f30d928f4e55db0e4dbfae5adb071..719a9fa290c77909555c78792503f5b98fde4964 100644 (file)
--- a/src/encoding/json/decode_test.go
+++ b/src/encoding/json/decode_test.go
@@ -2334,3 +2334,15 @@ func TestUnmarshalPanic(t *testing.T) {
        Unmarshal([]byte("{}"), &unmarshalPanic{})
        t.Fatalf("Unmarshal should have panicked")
 }
+
+// The decoder used to hang if decoding into an interface pointing to its own address.
+// See golang.org/issues/31740.
+func TestUnmarshalRecursivePointer(t *testing.T) {
+       var v interface{}
+       v = &v
+       data := []byte(`{"a": "b"}`)
+
+       if err := Unmarshal(data, v); err != nil {
+               t.Fatal(err)
+       }
+}