Skip to content

text/template: panic: Call using zero Value argument #10634

Description

@bep

This was discovered running go-fuzz on Hugo's template handling.

OS: Linux
Go version: 1.4.2

The following program panics:

package main

import (
    "html/template"
    "io/ioutil"
)

func main() {
    t, err := template.New("foo").Funcs(funcs).Parse(data)
    if err != nil {
        return
    }
    t.Execute(ioutil.Discard, "foo")
}

var data = "{{ A 433937734937734969526500969526500 }}"

var funcs = map[string]interface{}{
    "A": func1,
}

func func1(args ...interface{}) int {
    return len(args)
}
oroutine 1 [running]:
text/template.errRecover(0xc20802ff08)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:104 +0x14f
reflect.Value.call(0x526d20, 0x5d64e0, 0x13, 0x578bf0, 0x4, 0xc2080200a0, 0x1, 0x1, 0x0, 0x0, ...)
    /home/bep/.gvm/gos/go1.4.2/src/reflect/value.go:360 +0x491
reflect.Value.Call(0x526d20, 0x5d64e0, 0x13, 0xc2080200a0, 0x1, 0x1, 0x0, 0x0, 0x0)
    /home/bep/.gvm/gos/go1.4.2/src/reflect/value.go:296 +0xbc
text/template.(*state).evalCall(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0x526d20, 0x5d64e0, 0x13, 0x7f9c2b8fabe8, 0xc20803c6f0, 0x5c3933, ...)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:567 +0xaa4
text/template.(*state).evalFunction(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0xc20803c720, 0x7f9c2b8fabe8, 0xc20803c6f0, 0xc208020080, 0x2, 0x2, ...)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:459 +0x33b
text/template.(*state).evalCommand(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0xc20803c6f0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:359 +0x210
text/template.(*state).evalPipeline(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0xc2080340a0, 0x0, 0x0, 0x0)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:332 +0x1a8
text/template.(*state).walk(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0x7f9c2b8fab10, 0xc20803c7e0)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:167 +0x145
text/template.(*state).walk(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0x7f9c2b8fab58, 0xc20803c6c0)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:175 +0x862
text/template.(*Template).Execute(0xc208072040, 0x7f9c2b8fa918, 0xc20800a1e0, 0x511a20, 0xc20800a2d0, 0x0, 0x0)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:155 +0x3f2
html/template.(*Template).Execute(0xc20803c5d0, 0x7f9c2b8fa918, 0xc20800a1e0, 0x511a20, 0xc20800a2d0, 0x0, 0x0)
    /home/bep/.gvm/gos/go1.4.2/src/html/template/template.go:78 +0xa3
main.main()
    /home/bep/dev/go/src/testmain/main.go:13 +0x119

goroutine 5 [runnable]:
text/template/parse.lexText(0xc20807a000, 0x5d68f8)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/parse/lex.go:228 +0x37b
text/template/parse.(*lexer).run(0xc20807a000)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/parse/lex.go:198 +0x5d
created by text/template/parse.lex
    /home/bep/.gvm/gos/go1.4.2/src/text/template/parse/lex.go:191 +0x1ac
Error: process exited with code 2.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions